Game Track · Home v1 · 20 Sep 2026 · Proposal for Neo & Lan

Its own home, off Neo's estate

Neo's note of 20 September: the program is shared with the Academy team, so it should not run on his personal domain (neotodak.com) or his personal machines (the office fleet, the NAS, the Bandung box). This page proposes a home that Todak Academy and Todak Studios own, names what moves, and prices it. Everything in the student's path lands on Academy or Studios accounts. Neo's fleet may lend a hand in the dry run and nowhere else.

Update, 20 Sep (later the same day). Neo decided the base stays course.neotodak.com. No domain move, no redirects. Everything else on this page, the accounts, the database, the server and the build farm being Todak-owned, still stands as proposed.

Short version

DomainDecided 20 Sep: course.neotodak.com stays as the base. Site, documentation, slides and the showcase live there, as today. The classroom and the collector use paths or subdomains under it.
OwnershipOne rule: every account in the chain belongs to a Todak entity, with Lan and Neo as owners and Kai as IT admin. No personal accounts, no personal tokens, no Siti, no neo-brain.
HostingStatic site and showcase on the Todak Cloudflare account (free). Code in a new todak-academy GitHub organisation (free). Classroom system and course database in a Supabase project inside the Todak organisation, next to the Academy portal's. Collector and publisher desk on the Academy's own server in the Kay rack.
MachinesThe Mac mini becomes an Academy asset, placed at the Academy, reached through a Cloudflare Tunnel on the Todak account, not Neo's private network. No Academy workload on EdgeXpert, tr-home, the NAS or bandung-01.
AI servicesThe two seats do most of the work. Bulk images, 3D and sound go to rented GPU by the hour during class weeks and pay-per-use services through the kit, on Academy accounts with a per-student budget. An Academy GPU box is bought only if a second cohort proves the demand.
CostAlmost nothing new: the hosting is free, the database is the same line as before, GPU rental is a few hundred ringgit per cohort. The one-off is the Mac mini, already approved.

Why this matters

Continuity. If the program lives on Neo's personal domain and machines, it lives only as long as Neo's personal setup does. Lan's team, the lecturers and Kai need a home they can run without Neo in the loop.
Access. Neo's fleet holds his personal agents, his WhatsApp lanes and his brain. Giving the Academy team access to it, or running student jobs next to it, mixes two worlds that should stay apart.
Credibility. A JPK-aligned course on an .edu.my address reads as the institution's course. The same course on a personal domain reads as a side project.
Data. Student prompt records, signed paperwork and grades belong to the Academy under its own data-protection consent, on the Academy's accounts.

The new home, piece by piece

What each piece moves to, who owns it, and what it costs. "Exists" means the account or box is already Todak's.

Piece	Today	Proposed home	Owner	Cost
Domain	course.neotodak.com, classroom.neotodak.com	Unchanged: course.neotodak.com stays as the base (Neo, 20 Sep). Showcase at a path under it; classroom and collector as subdomains of neotodak.com.	Neo's domain, by his decision.	RM0
Site, documentation, showcase	Netlify on Neo's account, repo under Neo's GitHub	Stays on the current deploy (push = deploy). Recommended still: move the repository into the todak-academy organisation and let the deploy pull from there, so the site's code is company-owned even though the address is Neo's.	Address: Neo. Code: todak-academy organisation (proposed).	RM0
Code	Repos under Neo's personal GitHub	New GitHub organisation todak-academy: the site, the Game Kit, the classroom system, and one private repository per student game per cohort. Fine-grained tokens for the kit's hands; no personal tokens.	Owners Lan + Neo, admin Kai	RM0 on the free plan
Classroom system and course database	Supabase project on a separate personal account	A new Supabase project creator-classroom inside the Todak organisation, the same organisation that already holds the Academy portal's database. Students, progress, prompt logs, review reports, signed paperwork, the project brains.	Todak organisation	Free tier, then ~RM120/mo
Collector, publisher desk, build queue, store-review watch	Planned on Neo's fleet (EdgeXpert watchers, Kay .213)	The Academy's own server in the Kay rack (`.213`, already keys-only, already the Academy's): small services that receive prompt events, queue publishing manifests and build jobs, and watch the stores. Alerts by e-mail and a WhatsApp group through a plain business API, not Siti.	Todak Academy, Kayrule-managed	RM0 (exists)
Build farm	Mac mini at the Kenwingston office on Neo's private network	The same Mac mini, bought as an Academy asset, placed in the Academy's IT room on wired power and network, reached through a Cloudflare Tunnel on the Todak account (free) with Cloudflare Access in front. Holds the Studios signing keys in a dedicated keychain, because Studios is the publisher. If it must sit at Kenwingston for practical reasons, it still joins nothing of Neo's: its own tunnel, its own accounts.	Todak Academy (asset), Todak Studios (keys)	One-off, approved
Files: builds, assets, exports	Neo's NAS	Cloudflare R2 bucket on the Todak account, private, signed links for the showcase and the review reports. The Mac mini's 1 TB is the working cache.	Todak	~RM0–20/mo
Images, 3D, sound in bulk	bandung-01 and tr-home (Neo's), EdgeXpert's 3D pipeline	Three layers. The seats first (Astra draws, Claude writes). Then rented GPU by the hour on an Academy account during the weeks that need it, running the same open image and 3D tools the fleet runs today. Then pay-per-use services through the kit's asset service, on Academy keys, with the RM50 per-student budget. An Academy GPU workstation only after cohort 1 shows the load.	Todak Academy	GPU rental ~RM300–700 per cohort (estimate)
Secrets	Neo's credential vault	A team password manager for the Academy (or the Supabase vault of the classroom project), holding the tunnel token, store keys' locations, service tokens. Lan, Neo, Kai.	Todak Academy	RM0–40/mo
The kit's AI hands (build, publish, review)	Neo's Claude and Codex logins	An academy-cc service identity on the Mac mini and the Kay server, signed into Academy-owned seats in the Team and Business workspaces from Classroom v1. Its work is logged like a student's.	Todak Academy	Two seats, already in the seat budget
Monitoring	Neo's fleet monitors and Siti alerts	Cloudflare health checks plus an uptime checker on the Kay server. Alerts to a shared inbox and the WhatsApp group.	Todak Academy	RM0
Store accounts	Todak Studios' Apple, Google Play, itch.io, Steam	Unchanged. These are company accounts and Studios is the publisher of record.	Todak Studios	RM0

Why Cloudflare and not Netlify. Todak already has the Cloudflare account that holds todak.com and todakstudios.com, so the site, the tunnel to the Mac mini, the file bucket and the access control all sit under one company login with no new vendor. Netlify would need a new team on a company card for the same result.

How the pieces reach each other

Student PC or laptopWorkbench pushes code to the todak-academy GitHub organisation. Prompt events go to the collector over HTTPS.

→

Kay .213 · Academy serverCollector, publisher desk, build queue, store watch, uptime. Public address, keys-only SSH, Cloudflare in front.

→

Mac mini · build farmPulls jobs from the queue over its Cloudflare Tunnel, builds every platform, uploads to the stores and to R2, posts the link back.

No private network to join. The student never needs a VPN. The Mac mini is reached only through its tunnel, with Cloudflare Access deciding who may open it (Lan, Neo, Kai, the academy-cc identity).
If a private network is wanted anyway for admin convenience, a small Tailscale network on an Academy plan is the alternative. The free personal plan now allows six users and unlimited devices, but it is meant for personal use, so the Academy should be on a paid starter seat per admin if it goes that way.
Nothing here touches Neo's tailnet, his agents or his brain. The one exception allowed: during the dry run, before cohort 1, Neo's tr-home may build the first reference game to save time. It is removed from the path before enrolment.

Who can do what

Person or identity	Role	Has
Lan (Todak)	Owner	Every account and the domain. Approves at the review gate.
Neo (Todak Studios)	Owner	Every account. Holds the Studios store accounts and signing keys. Bypass at the review gate.
Kai (Academy IT)	Admin	GitHub organisation, Cloudflare project, Supabase project, the Kay server, the Mac mini. Runs the lab image and the installer.
Lecturers	Staff	Classroom system: their classes, prompt journeys, review reports. No server access.
Students	Member	Their own repositories in the organisation, their own seats, their own journey.
academy-cc (the kit's hands)	Service	Fine-grained tokens: push to student repositories, read the queue, upload to stores and R2. Nothing else.

What moves, in what order

About one week of work once the accounts exist. Nothing on the current pages changes until the new home is live and checked.

Accounts (Lan or Kai, one afternoon): the todak-academy GitHub organisation; the creator-classroom Supabase project in the Todak organisation; the Cloudflare Pages project, tunnel and R2 bucket on the Todak account; the todakcreator.com registration if wanted; the Academy password manager.
Site and docs: nothing to move. Transfer the repository into the organisation and point the existing deploy at it.
Classroom: export the current classroom database, import into creator-classroom, transfer the repository, keep it at classroom.neotodak.com, re-test login and grading.
Kay .213: deploy the collector, the publisher desk, the build queue and the store watch as services; wire alerts.
Mac mini: set up as the Academy asset with the tunnel and the Studios keychain, connect to the queue.
Clean-up: remove the Academy's crons and watchers from Neo's fleet; Neo's fleet keeps nothing of the program.

What it changes in the bill

Line	Classroom v1 said	Home v1 says
Site, docs, showcase hosting	RM0 (Neo's Netlify)	RM0 (Todak Cloudflare)
Course database	RM0 → ~RM120/mo	Same, in the Todak organisation
Files	RM0 (Neo's NAS)	~RM0–20/mo (R2)
Bulk images, 3D, sound	RM0 (Neo's GPU boxes)	~RM300–700 per cohort, rented by the hour (estimate)
Academy GPU workstation	Not needed	Deferred; ~RM9k–15k if a second cohort needs it
Secrets, monitoring, tunnel	RM0 (Neo's)	RM0–40/mo
Mac mini, seats, asset budget, legal	Unchanged from Classroom v1

Net effect: a few hundred ringgit per cohort for GPU time, in exchange for a program that the Academy owns end to end.

Decisions for Neo & Lan

1Base address stays course.neotodak.com. Decided 20 Sep
2Hosting on the Todak Cloudflare account (Pages, Tunnel, R2, Access) and a new todak-academy GitHub organisation. Recommended
3Classroom system and course database as a new project in the Todak Supabase organisation. Recommended
4Collector and desk services on the Academy's Kay .213 server, or a new small box on the Todak Hetzner account if Kayrule prefers.
5Mac mini as an Academy asset at the Academy's IT room, reached by Cloudflare Tunnel. Kenwingston only as a fallback location, and even then on its own tunnel.
6Bulk generation on rented GPU hours and pay-per-use services for cohort 1; an Academy GPU box deferred. Recommended
7Who opens the accounts and runs the move: Kai, with Lan as owner. Neo stays owner on everything.

Changelog

v1.1 · 20 Sep 2026. Neo: the base stays course.neotodak.com. Domain move, DNS step and redirects removed; the ownership plan for accounts, database, server and build farm unchanged.
v1 · 20 Sep 2026. First proposal, on Neo's note that the program must not sit on his personal domain or fleet. Supersedes the machine locations in Blueprint v2 section 07 and Classroom v1 section 08.