Topology How it fits together, and where the line between public and home actually runs.
Two zones, drawn on purpose. Everything the public can reach runs on rented droplets.
Everything that matters runs at home, behind a boundary the open internet has no route
across. The line between them is the whole design.
The diagram is wider than a phone. Scroll it sideways to follow the zones.
Managed, on purpose The edge Cloudflare in front of everything public caching, WAF, and stay-online, so the nines live here, not on the origin Mail A managed sender, deliberately not self-hosted deliverability is the hard part, and a home IP lands in spam Offsite backup Two providers, two geographic regions three availability zones each, so one region loss isn’t a backup loss a tunnel out to the handful of services meant to face outward backups leave the house, encrypted Public zone: rented droplets If one of these gets popped the blast radius is a rented Linux box and a git repo Coolify runs the deploy end The site Astro, server-rendered not a pile of static files pages get built on request behind the edge cache link-preview cards regenerate in the same pass, so nothing rots The CMS Self-hosted Ghost on MySQL the thing I actually write in content source of truth the site pulls posts from it was somebody else’s hosted product, now it’s mine Public git Forgejo at git.jcrenshaw.dev the FOSS half of my code my own git host instead of somebody’s platform waiting to change the terms out from under me CI runs here too, on my infra Package repos Signed apt and rpm, self-hosted plus my own Flatpak repo nothing publishes unless it installs cleanly first, and the build gate proves it, every time no store gets to gatekeep me git push, Forgejo pokes Coolify, builds and swaps live The boundary: two crossings only. The tunnel inbound, code and artifacts outbound. No VPN. No port forwarding. The public side is kept off the home network by design, so the open internet never has a route back to the machine my actual life runs on. Home zone: owned, walled, publishes outward only Wired end to end in Cat7 off two symmetrical 2 Gb fiber lines · the untrusted gear lives on its own VLAN · the whole property runs on solar with battery backup minas-tirith one System76 laptop, lid shut, on a shelf, and its battery is the UPS A 24-core i9 with 62 gigs that spends most of its life bored. Proxmox underneath, then a stack of unprivileged LXC containers, one service to a container, so a mess in any one of them stays in that one. Caddy out front with a wildcard certificate, so everything internal terminates here CrowdSec turns away the obvious junk at the edge before it ever reaches a service Authelia single sign-on and a TOTP prompt in front of the things worth guarding one strong front door instead of a different login on every tool Technitium DNS and DHCP for the house Grafana · Loki · Prometheus the metrics and the logs Wazuh a SIEM chewing through logs Beszel at-a-glance “is it alive” Uptime Kuma the other half of that answer NetAlertX so a new device isn’t missed Honeypots page me the moment they’re touched ntfy the single sink everything shouts into Matrix chat that’s actually mine Private git a second Forgejo for the git that never leaves the house my own machines’ configuration lives here, not on a platform Proxmox Backup Server dedup snapshots onto ZFS The desktop The machine I actually sit at. Arch built up by hand, CachyOS repos and the linux-zen kernel, under Hyprland with the Noctalia shell across an ultrawide. Ghostty · zsh · nano mostly the terminal, a terminal guy through and through JetBrains · VSCodium the full weight of an IDE when I want it, telemetry filed off Claude Code · Cadence · Hindsight useful exactly where it’s useful, kept on rails Untrusted VLAN The cameras, the smart plugs, everything that phones home, on its own segment, where it can’t see the machines that matter. The property Security and climate on the same network. Solar with battery backup, so a grid outage doesn’t reach the rack or take the house down with it. a push is the only trigger