Everything here runs on hardware I own.
A small server in the living room, a hypervisor, a handful of virtual machines, and a GPU box that wakes up when something needs a model. It runs the media stack, the document pipeline, the home automation, and this site.
Building it was the point. Operating it is what taught me the rest: what fails at three in the morning, what a bad default costs six months later, and why the boring answer is usually the one that is still running.
categories, never service names · cached 60s server-side when live · falls back to this frozen state
How traffic gets here
Visitor
Anyone on the public internet, arriving at a domain name.
Edge
Terminates TLS, caches aggressively, absorbs abuse. The only thing the public ever talks to.
Web host
A virtual machine running containers behind a reverse proxy. It reaches out to the edge; the edge never reaches in.
LLM node
A GPU machine that runs local models. Private side only: no public path reaches it, by design.
Public path · edge → web host only
Zero inbound ports · no residential IP published · categories only, never service names
Why it is built this way
Outbound only
Nothing is port-forwarded. The host opens a connection outward and the public traffic comes back down it. There is no inbound door to find, and no residential IP address published anywhere.
Two separate paths
Public sites and personal services do not share a route. What the internet can reach is a deliberately short list; everything else is only reachable over a private mesh, from my own devices.
Cached at the edge
This site is static and cached aggressively, so it keeps serving even when the machine behind it is off. A homelab going down should cost me a maintenance window, not a visitor.