Infrastructure
Homelab
A small business with sensitive data wants the tools it runs on hardware it owns, with no open ports and nothing only one person understands.
I designed and operate a private stack on a Proxmox host: Docker Compose services defined as code, Caddy terminating TLS via the Cloudflare DNS API so no port opens inbound, every service under one wildcard domain resolvable only inside a Tailscale mesh, redundant DNS, automated backups and monitoring.
Result: 21 apps in 32 containers, one domain, zero open inbound ports, months of uptime, and a repo a second operator could rebuild from.
What runs on it
- Automation: n8n for workflows, ntfy for push notifications, and a self-hosted Firecrawl for turning web pages into clean text
- Documents and tools: BentoPDF, Presenton for slide decks, Reactive Resume, Linkding for bookmarks, and a watermark remover
- Media and feeds: Audiobookshelf and my own RSS Service
- Network: Caddy as the reverse proxy and AdGuard Home for DNS and ad blocking
- Monitoring and upkeep: Uptime Kuma, Beszel, Dozzle for logs, Dockge for managing Compose stacks, Watchtower for updates, and Dashy as the front door
- My own projects: Bench Studio, the Decoder Ring feedback monitor, and a small image host for social posts
One service, the image host for social posts, is reachable from the internet through an outbound Cloudflare tunnel, so it still opens no inbound port. Everything else answers only inside the mesh. The stack is private by design, so there is no public link.