What Happens When You Give AI Agents Root Access to Your Homelab
I built an autonomous AI system that manages my homelab. It writes code, reviews PRs, monitors services, and sometimes tries to delete things it shouldn't.
The idea started simply enough: what if I had an AI assistant that could actually do things on my infrastructure, not just talk about them? Six months later, I have a multi-agent system running on a Proxmox VM where specialized AI workers write code, review each other's PRs, monitor Docker containers, and deploy changes, all coordinated through a message mesh.
The architecture
Hrolbot runs as a systemd service on a Debian VM with 4 cores and 8GB RAM. It's the orchestrator. It receives tasks from Discord, delegates to specialized workers (frontend, backend, reviewer, testing, DevOps), and reports results back. Each worker runs as a separate Linux user with its own Claude Code session, working in isolated Git worktrees.
The coordination layer
Workers communicate through an MCP (Model Context Protocol) mesh, a shared filesystem of mailboxes, tasks, and state documents. When the backend worker finishes a feature, it writes a handoff document. The reviewer picks it up, reviews the branch, and posts findings. The orchestrator monitors everything and intervenes when workers get stuck.
The safety layer
Giving AI agents shell access requires guardrails. A hook system blocks destructive commands (force push to main, DROP TABLE), protects sensitive files (.env, SSH keys), and auto-lints code after edits. A circuit breaker tracks consecutive failures. After three it forces the agent to stop and reassess instead of spiraling.
Does it actually work?
Surprisingly well. The workers have built entire frontend features, caught real bugs in code review, and deployed fixes to production services. The dual-dispatch system, which sends the same task to two different AI models and compares results, catches errors that a single model would miss. It's not replacing a human developer, but it's a genuine force multiplier for a one-person operation.
What I'd do differently
Start with better logging. When an agent makes a mistake at 3 AM, you need a clear audit trail to understand what happened. I also underestimated how much prompt engineering matters. The difference between a vague task description and a precise one is the difference between useful output and wasted API credits.