Decisions
Every one of these was written down before it was built, with the alternatives and why they lost. Most of them are boring. That is the point: a boring decision that is written down beats a clever one that has to be rediscovered. The pieces they describe are laid out in the estate.
They are grouped by the kind of judgement rather than the order they were made, because the reasoning is the transferable part — a reader running nothing like this estate should still recognise the trade-off.
Where the boundary is
Three decisions about what may be reached from outside, and by what. Each one narrows the surface rather than adding a control on top of it.
A mesh, not port forwards
Nothing at home is reachable from the internet. Every management surface sits behind a private mesh with per-device keys or inside the house, never on the internet, and anything public leaves through an outbound-only tunnel or a disposable machine elsewhere. A port forward is a hole that stays open after the reason for it is forgotten. The mesh also fixed what port forwards never solve, which is reaching the house from a phone on cellular without thinking about it.
The edge node is disposable
The one machine that faces the internet holds no state and no credential, is built entirely from code, and is allowed to reach exactly one port at home. When anything about it looks wrong, it is destroyed and rebuilt rather than investigated. This also sets a floor under what a compromise of it can cost.
This site is served from the house
It could have lived on a static hosting service or on the public edge. It lives at home, through the outbound tunnel, because that is the least machinery and it is the estate describing itself in the present tense. It is up when the house is up, and that was a deliberate choice. What must survive the house going dark is a separate conversation.
What the estate is built on
Two choices about the machine itself, both preferring a component that another machine can take apart and read over one that is faster today.
ZFS, not the RAID controller
The server came with a capable hardware RAID controller, and it is used as a plain disk controller instead. A ZFS pool can be imported by any machine that can read the disks; an array built by a controller can be read only by that controller's family. Checksums on every block, snapshots for backups, and a pool that survives the controller dying are worth more than the controller's cache.
Proxmox, not bare Debian or a NAS operating system
Proxmox is Debian with a capable container and virtual machine layer and a web console that shows the whole machine at once. A NAS operating system would have made storage easy and everything else awkward; bare Debian would have meant reinventing the console. Every service runs in its own unprivileged container, which is the isolation boundary the whole estate leans on.
What keeps it
Backups, credentials and alerting: the parts that only prove themselves on the worst day, so each is designed around how it fails rather than how it runs.
Three backup copies, one off-site, none on the desktop
The first copy is local, the second is encrypted in object storage off-site, and the third is on the auxiliary node. The desktop held the third copy for a while, in the same basement as the server, and stopped the day it became clear that a workstation is not a backup target: it has to be awake at half past midnight, and a server role does not belong on it. The auxiliary node took the copy over and checks it weekly. Restores are rehearsed monthly by a machine.
A self-hosted alert relay, not a hosted one
The alert relay is the one service that must work when everything else does not. A hosted relay is one more account, one more outage that is not yours, and one more place the content of an alert lives. The relay runs at home, the phone subscribes over the mesh, and the auxiliary node runs a copy so "the primary node is down" can still be delivered.
One credential per provider, none of them the operator's
Every automated process holds the narrowest credential that does its job, and nothing shares a credential with the operator. Not one per consumer: the credentials are refreshed together, and splitting them would mean more rotations and more chances to miss one. Providers that offer scoping are used to the hilt; the audit found several that offered it and had gone unused. The rule that came out of it: before deploying anything that needs a credential, ask what the narrowest credential that works is, and whether the provider can scope at all.
Two nodes, not one bigger one
Two modest nodes beat one large one when what matters is noticing that a machine has gone quiet. The auxiliary node was a retired desktop, an ASUS ROG G11CD, that was going to be thrown away. It watches the primary node, holds the third backup copy, and doubles as the living-room television.
And one that is simply personal
Not every decision is architecture. This one paid for the machine that faces the internet.
The game server is self-hosted
Hosting a Minecraft world at home instead of renting one costs less each month, keeps the world and its backups in hand, and gave the public edge a reason to exist. Friends reach it through the edge with no software to install. The old subscription was cancelled the day the self-hosted server was verified from the outside.
Ruled out, and staying ruled out
- A media library. The GPU's value was never Plex.
- Any secret store or agent on a node at home. Each one adds a root-level surface for a convenience nobody asked for.
- A dedicated gateway router. Designed in full, then declined: the spend was not justified by the problem it solved.
What these decisions cost to get right is in Lessons.