scottydelta

I just helped a product manager friend host and run their app on a VPS.

It was a single file app.py flask app with over 10,000 lines of code. It had html and css defined as variables in that single file!

I am sure this is gonna end well.

It's back online!

How is the progress?

It's not about cracking it. I'm just following the agents' reasoning as they work through the exploit to better understand the recently discovered PHP bugs. A great way to spend a few bucks, in my opinion :D

I have two out of five AI agents that agreed to work with me on finding the flag (wallet key). Here's the progress so far:

1. GLM-5.3: Interpreted it as a public challenge and is currently trying to find the flag. https://ibb.co/zHLJhz0B

2. GLM-5.3-Flash: Also interpreted it as a public challenge and is working on cracking it. https://ibb.co/bg2DDtXq

3. GPT-6.1-Sol: Flagged it as a cybersecurity request and directed me to register for their cybersecurity program. https://ibb.co/0j83PWn9

4. DeepSeek-v4.1-Flash (via OpenRouter): Refused to execute the exploit. https://ibb.co/QvVxnM5k

5. Claude Fable-5.1 (via OpenRouter): Returned a provider-side content filter error. https://ibb.co/39q1N1NV

All sessions with different agents are running on Tarvis (https://tarvis.io), an app I'm building. Think of it as a self-hosted version of Railway, but with a built-in AI agent and cloud development environment.

The website seems to be overloaded, and both agents that agreed to work on the challenge are now unable to connect to it. HN's hug of death, I guess.

EDIT: It's back online!

I am working on something similar, so here is the shameless plug: tarvis.io

Users can install any number of apps (catalog has over 750 apps) into their workspace and it comes with daily backups, backups to your own store, ssl domains and secure by design.

We are in beta and launching soon.

For each user we create a new VPS that belongs to them.

With the recent change in Bitwarden's license, not sure for how long they will continue to be self hosting friendly.

I am also using Vikunja instead of trello.

Tbh in general I am fine if the self hosted app uses postgres or a container Db instead of sqlite only.

I have been self hosting for over a decade and recently have seen more people in my circle doing that and I have been helping them.

At first it was hard but then i made it into a product. I am working on Tarvis.io which makes self hosting accessible to non technical users as well. It comes with installation assistant, ssl domains and backups inbuilt into it.

You can install open source apps from a catalog or drop any github repo and it installs and run it for you.

With Tarvis, I have been self hosting more since I am able to install and delete apps with one click, it makes it easy to try things.

I literally built this for self hosting apps at Tarvis.io

You can drop any GitHub repo and the agent builds and deploys the app to your Tarvis workspace along with taking care of ssl domain and any other configuration and making sure the app is healthy.

I developed tarvis.io which is being used by friends and family to self host notion alternative and run hermes agents. This let's them run self hosted apps as actual apps without having to worry about the server or setups.

One friend was running a gitlab runner on a laptop but moved to tarvis given how easy it is. Tarvis has a catalog of 750 apps already so I am sure you can find a few things from there to run 24/7.

IMO being able to see all the apps in a catalog and being able to easily add that app and experiment helped me figure out which apps I should be running.

I am self hosting treg for development. You can setup and run treg with one click on tarvis.io

I am developing tarvis.io that allows you to self host apps without managing the servers. In addition to that it also comes with cloud dev env where you can do coding and spawn dev servers and you can host same app in your tarvis workspace as a self hosted app. Tarvis takes care of security, storage, backups and ssl domains. Each app auto gets ssl domain and only you can access your apps. Give it a try!

I am running deepseek harness as self hosted app on tarvis for myself. You can run pi as self hosted harness there too by telling the agent to set it up and then access on the go from the browser.

I implemented similar feature in my app https://tarvis.io

Tarvis allows people to self host apps without managing servers. Each workspace gets their wild card cert at *.weightedreply.tarvis.site.

Then when any app is installed by user in their workspace, they get subdomians under that wildcard without leaking what apps are running there. N8n app gets n8n.weightedreply.tarvis.site and hermes gets hermes.weightedreply.tarvis.site.

The proxy and auth is handled by self hosted pomerium so no dns records are published for any app subdomians under that workspace url.

I am using Google certificate manager which is free to generate and manage these wildcard certs. I know Google is not preferred but that's the only free service I could find to do this.

A bit late but I am working on Tarvis.io and it does exactly that. I have been self hosting servers and managing infras since a decade and after doing the same thing over and over again, I made self hosting into a web interface where apps install with a click and work on browser. I will add this to Tarvis and a service like this can be spawned on browser with a click.

> We and our 1736 partners use cookies and other tracking technologies to improve your experience on our website. We may store and/or access information on a device and process personal data, such as your IP address and browsing data, for personalised advertising and content, advertising and content measurement, audience research and services development. Additionally, we may utilize precise geolocation data and identification through device scanning.

This is from the cookie banner on this website, this is just insane level of privacy invasion with no option to reject cookies.

Why does it have to be a desktop app vs a self hostable web app?

That way it can truly run asynchronously, even with the computer switched off.

The interesting thing is they changed default mode for Claude code to auto mode and auto mode uses sonnet to decide whether the command is safe or not. With their Sonnet model outage, the entire thing stopped working.

here is the error it was throwing:

> Error: claude-sonnet-5[1m] is temporarily unavailable (overloaded), so auto mode cannot determine the safety of Edit right now. Wait a moment and then try this action again. If it keeps failing, continue with other tasks that don't require this action and come back to it later. Note: reading files, searching code, and other read-only operations do not require the classifier and can still be used.

It's better explained in this blog article:

How the GOP Used a Two Santa Clauses Tactic to Con America for Nearly 40 Years by Thom Hartmann[0]

> First, when Republicans control the federal government, and particularly the White House, spend money like a drunken sailor and run up the US debt as far and as fast as possible. This produces three results - it stimulates the economy thus making people think that the GOP can produce a good economy, it raises the debt dramatically, and it makes people think that Republicans are the "tax-cut Santa Claus."

> Second, when a Democrat is in the White House, scream about the national debt as loudly and frantically as possible, freaking out about how "our children will have to pay for it!" and "we have to cut spending to solve the crisis!" This will force the Democrats in power to cut their own social safety net programs, thus shooting their welfare-of-the-American-people Santa Claus.

[0] https://www.thomhartmann.com/blog/2018/02/how-gop-used-two-s...

I am surprised no one has mentioned the The Two Santa Claus Theory[0] in play here.

[0] https://www.commondreams.org/views/2009/01/26/two-santa-clau...

And why would I go from my self hosted infra on a dedicated server to a dependency on Railway?

My setup already works and what you are suggesting is weaker than my setup.

Well everyone is trying to create an environment where they can safely delegate tasks to agents.

I am no different, but my approach is a dedicated powerful computer on your desk rather than something in the cloud. I am calling it Tarvis AI (derived from TARS from Interstellar and Jarvis from Iron Man), more details here: https://tarvisai.com

I have tried many of the VM/cloud-based agent setups, and they either tend to be only novelties since you can’t do much with 2-4 vCPUs + limited RAM or they start racking up expensive cloud bills.

I realized that the underlying operating systems for AI have to be built from the ground up for agents instead of taking current OSes and taming them for agents. Not sure how much of that philosophy is followed by Cloudflare. Excited to see growth in this area.

Makes sense. It took me some experimentations with a few open source libraries and docker-compose to arrive at my setup. My setup also requires me to access agents via a terminal app on my phone so it's nice to have a web app like your offering.

Are you offering browser access to the agents in your setup?

Trying to wrap my head around how it differs from my current on-the-go setup that is claude code. On claude's phone app or web app I can choose a repo, ask it for a feature and it writes the code, runs my tests + add more tests and creates a new branch. Then I can click on create PR or configure claude code to auto create PR.

I also have another setup which is a self-hosted docker compose behind my vpn with one container with claude code agents managed using agent of empires[0] and another container with playwright with sse. Using this setup, my agents get access to actual browser where it can test things live and I can access the app started by agent on domain:port. This is something I don't get with Claude. [0] https://github.com/agent-of-empires/agent-of-empires

If you email me (it's on my HN profile), I can send one to you the moment we are taking D2C orders. We still have to make it self-serve ready for end consumers. Really thanks for your interest :)

Thanks for the suggestions, I will add something like that to the website.

The thing is majority platforms like paddle.com don't supoort hardware products. I was looking at fastspring as well but hit the same wall. I will still try reaching out to paddle.com support to see if they will allow it. Thank you for the suggestion.

I see, the thing is we are very new and plan on launching soon. We are still trying to figure out our B2C/D2C pricing.

Yes, we're using an off-the-shelf Raspberry Pi for v1. We are working on figuring out a custom board for v2, because we can't scale with Raspberry Pi as a dependency, especially with RPi prices constantly rising due to the RAM shortage.

Also, we want to test our OS extensively before we release it to be used with a BYOD model. We are launching soon and after that we will try to offer BYOD model as well.

If you are interested in trying it out and helping me in evaluation, please reach out to me via email on my HN profile. Thank you

Thank you for your kind words. I am pasting one of the comments I made on this thread regarding challenges with online sales at the moment:

> Trust me, I really wish it were that easy. We're based out of Spain, so to sell in the US (or other countries) we either need to figure out assembly of the device there, or we need to solve cross-border payments, logistics, customs clearance, tax remittance to individual states, and hardware compliance. That said, we're working hard on all of it and plan to go D2C as soon as possible.

For the pricing part, I am still trying to figure out the pricing for retail consumers. It was relatively easier to do for B2B but for retail, there are a lot of factors and moving parts such as import duties, taxes, shipping etc.

Trust me, I really wish it were that easy. We're based out of Spain, so to sell in the US (or other countries) we either need to figure out assembly of the device there, or we need to solve cross-border payments, logistics, customs clearance, tax remittance to individual states, and hardware compliance. That said, we're working hard on all of it and plan to go D2C as soon as possible.