What I run at home

How it's wired

Everything sits behind a reverse proxy that terminates HTTPS and talks to a private mesh network, so nothing binds to the public internet. A single sign-on provider fronts the apps that need auth; a secrets manager injects credentials at runtime; a cron-driven backup job keeps the data safe; and a self-hosted bot proposes image updates via pull requests. It's a modest stack, but it's wired like it matters.

• Identity & SSO

  One OIDC provider fronts the apps that need accounts, so a single login carries across the services I actually use.

• Reverse proxy & networking

  HTTPS termination with automatic wildcard certs, routing only over a private mesh. No service exposes a public port.

• Code & CI

  Self-hosted git hosting plus a container-native CI runner, with an automated bot opening update pull requests.

• AI

  A local LLM web UI paired with an embedding model for the bits of inference I'd rather keep on my own hardware.

• Apps & feeds

  Recipes, RSS, a private search engine, and a dashboard launchpad — the daily-driver tools that replaced their cloud equivalents.

• Observability

  A host-native metrics agent with first-class container views, plus an error-tracking sink for the apps that report crashes.

• Backups

  A network-isolated, read-only backup container snapshots bind-mounted data on a schedule to a local restic repo.

• Secrets

  All credentials live in a dedicated secrets manager and are injected into containers at runtime — never committed, never on disk in plaintext.