Self-hosted AI & app infrastructure

The Challenge

My products and client systems needed one hardened, affordable home – and a WordPress publishing pipeline needed Claude Code as a text engine without the site ever holding API credentials.

The Approach

A root-side queue worker lets the WordPress site use Claude Code headless: the site queues tasks through WP-CLI, the worker claims them and runs Claude Code with a locked-down configuration (no tools, strict JSON-schema output, hard timeouts, no session persistence), and returns results through WP-CLI as the site user. It runs from cron every minute and wakes instantly on a kick file. The same pattern runs my own scheduled agents with explicit tool allow-lists and Slack reporting. Underneath is one Hetzner VPS: HestiaCP with nginx and Apache, MariaDB and PostgreSQL, mail with DKIM and SPF, fail2ban, Docker Compose services behind the proxy, systemd timers, GitHub Actions deploys and a written runbook.

Key Features

• Headless Claude Code queue worker: no tools, strict JSON-schema output, hard timeouts
• Runs from cron plus a kick file; no API credentials on the site, and the worker never reads the site's config
• Scheduled Claude Code agents with tool allow-lists and Slack reporting
• HestiaCP with nginx and Apache/PHP-FPM, MariaDB and PostgreSQL, mail with DKIM and SPF, fail2ban
• Docker services: two R Shiny apps, n8n, Qdrant and a Python search API, bound to localhost behind the proxy
• systemd timers, GitHub Actions deploys and a runbook: no production restarts without confirmation