The Stack

The whole homelab runs on a single System76 laptop named minas-tirith, lid shut, tucked on a shelf. Its battery is the UPS. It's a 24-core i9 with 62 gigs of RAM that spends most of its life bored, load hovering around a quarter of one core, because the job was never horsepower. The job is staying up, and staying mine.

On top of Proxmox it's a stack of unprivileged LXC containers, one service to a container, so a mess in any one of them stays in that one. Everything on it is self-hosted and mine, with no telemetry I didn't turn on myself. When it goes sideways at 2am the person who fixes it is me, which is the entire point.

If you'd rather see it than read it, there's a diagram of how the whole thing fits together, zones and all.

What it runs

Networking and access. Technitium handles DNS and DHCP for the house. The house itself is wired end to end in Cat7 off two symmetrical 2 Gb fiber lines, 4 Gb each way, and the untrusted gear, the cameras and smart plugs and everything else that phones home, lives on its own VLAN where it can't see the machines that actually matter. Caddy sits out front with a wildcard certificate, Authelia guards the things worth guarding with single sign-on and a TOTP prompt, and a Cloudflare tunnel exposes only the handful of services that are meant to face outward.

The house itself. The building is part of the deployment. Security and climate are wired into the same network, and the whole property runs on solar with battery backup, so a grid outage doesn't reach the rack or take the house down with it.

Watching it. Grafana, Loki, and Prometheus for the metrics and logs, Beszel and Uptime Kuma for the at-a-glance "is it alive," and NetAlertX keeping an inventory of everything on the network so a new MAC address doesn't go unnoticed.

Keeping it honest. A Wazuh SIEM chews through the logs, CrowdSec turns away the obvious junk at the edge, and a honeypot or two that page me the moment anything on the LAN touches something it has no business touching.

The useful stuff. A Matrix server for chat that's actually mine, a private Forgejo for the git that never leaves the house, and ntfy as the single sink every other service shouts into when it needs my attention.

Not losing it. Proxmox Backup Server takes deduplicated snapshots onto a ZFS pool, and offsite copies fan out from there into two separate geographic regions with three availability zones in each, so losing a single zone or a whole region doesn't take the backups with it. Backups you have never restored are a rumor, so that path gets tested, not assumed.

The public side

Anything the public can reach runs out on droplets, kept off the home network by design so the open internet never has a route back to the machine my actual life runs on. If one of those boxes gets popped the blast radius is a rented Linux server and a git repo, not the box my husband and I talk on.

The site itself. jcrenshaw.dev is a server-rendered Astro app, not a pile of static files, and the pages you're reading get built on request behind Cloudflare. It pulls its posts from a self-hosted Ghost running on MySQL, which is the CMS I actually write in.

Git out in the open. The FOSS half of my code lives in a second Forgejo at git.jcrenshaw.dev, out where people can actually clone it, my own git host instead of somebody's platform waiting to change the terms out from under me. I moved this site's repo onto it and pointed the deploy straight at it, and GitHub isn't in the loop anymore.

How it ships. Coolify runs the deploy end. I push a commit to Forgejo, Forgejo pokes Coolify, Coolify builds the site and swaps it live, and the whole trip from a git push to a changed page takes no hands after mine. It regenerates the link-preview cards in the same pass, so nothing rots between builds.

The desktop

The machine I actually sit at runs Arch I built up by hand, pulling the CachyOS repos and the linux-zen kernel for the tuning, under Hyprland with the Noctalia shell stretched across an ultrawide. It's the whole argument in one box: my tools, my choices, nothing on it I didn't put there myself. If the front door of this site feels familiar, that's why: it's dressed as the desktop I'm typing this on.

Where the work happens. Mostly the terminal, I'm a terminal guy through and through: Ghostty with zsh underneath and nano for quick edits. It's all Rust now, so a JetBrains IDE when I want the full weight of one, and VSCodium with the Microsoft telemetry filed off the rest of the time.

Where AI earns its keep. Claude Code does the heavy lifting I point it at, kept on rails by Cadence for planning and Hindsight for memory that survives between sessions. Useful exactly where it's useful, which is the whole argument I make about the stuff.

Staying in touch. The same Matrix server that runs the house is where my husband and I talk, so our conversation isn't a product someone else gets to mine.