Services

A Minecraft world kept for friends, one of two services here that people outside the household reach. Players arrive through the edge node rather than through the house, and are invited by name rather than the world being open.

invited players only reached through the edge

The teams of a youth robotics program build and run their own web applications here, in a virtual machine apart from the containers, on a network of its own that reaches the internet and nothing else in the house. Each team is kept from the others, and none of it can reach the estate. How it is built, and what was chosen over what.

Docker PostgreSQL Cloudflare Tunnel

Self-hosted notifications, and the one service that must work when nothing else does. The auxiliary node runs a second copy, so a message still leaves the house when the usual sender is itself what failed. Alerts are plain text, and test messages never go to the live topics.

self-hosted a copy on the other node

One front door for everything with a name, holding the certificates and deciding what each name is allowed to reach. It is the only container the others may talk to, which is what makes the bridge filter simple enough to reason about.

TLS the only hub on the bridge

The application serving these pages, and a private half that is not on the internet at all. Public pages leave through an outbound-only tunnel, so nothing here waits for a connection from outside.

public and private tiers outbound only

Two different questions, so two services. One samples the path to the internet every few minutes and draws it, which is how a sustained problem is told from a single poor evening; the other checks that each service answers, and says so when one stops.

a graph over months a check every minute

The household's name resolution, filtered, with the queries logged per device. It is the one service here the rest of the house depends on without knowing it, which is why it is on the node that is always up rather than the one by the television.

for the whole house per-device log

A type-1 hypervisor runs every service in its own isolated Linux environment. Containers rather than full virtual machines: lower overhead, faster backups, and a restore measured in seconds.

Proxmox VE Debian LXC systemd

A copy-on-write filesystem with end-to-end checksums, so silent corruption is detected and repaired from the mirrored copy rather than quietly served. Compression, instant snapshots, and scheduled integrity scrubs come with it. The RAID controller runs in pass-through mode so the filesystem sees real disks.

ZFS mirrored vdevs lz4 compression SMART monitoring

A private WireGuard mesh links every device — desktop, phone, server — into one network regardless of physical location. Peers connect directly rather than through a middleman. The router forwards nothing to a service: no port forward, nothing exposed, nothing that answers a stranger.

Tailscale WireGuard policy-based ACLs split DNS

The rare service that should be public — this page, for instance — is published through an outbound tunnel. The server dials out; visitors are served by the edge network. Still no inbound path, and DNS, certificates, and caching are handled upstream.

Cloudflare Tunnel Cloudflare DNS automatic TLS

Nightly snapshot-based backups run without interrupting anything, with daily, weekly and monthly retention. A second copy is encrypted locally and pushed to object storage off-site, so what leaves the building is unreadable to the provider, and a third lands on the auxiliary node, which re-reads and checksums what it holds every week. Restores are rehearsed monthly by a scheduled job, not assumed.

Cloudflare R2 rclone client-side encryption snapshot backups

The server pushes alerts to a phone when a backup fails, a drive reports errors, or an off-site copy does not complete — through a self-hosted notification service rather than a public one, so nothing can be read or spoofed from outside.

ntfy self-hosted authenticated push

Nothing on the server can reach the vault, on purpose. Each automated job holds one narrowly scoped credential in a file only it can read, placed there from the desktop and checked hourly, and every key does a single job — the backup key reaches one bucket, the network key cannot create more keys.

1Password per-job credentials scoped API tokens

A game server for friends, invited individually rather than left open to the internet. The alert relay, latency and uptime monitoring, DNS filtering for the house, the reverse proxy that fronts everything, and the application serving this page. Ahead: network file shares and a virtual tabletop for the campaign.

Minecraft Caddy ntfy AdGuard Home ASP.NET Core