The build◣
What is actually running, and how it is described.
| Layer | What runs it |
|---|---|
| Cloud | Two Ampere A1 instances, Ubuntu on ARM |
| Mesh | NetBird — WireGuard, self-hosted control plane |
| Identity | Pocket ID — passkey-first OIDC, no third party in the path |
| Public ingress | Traefik, nginx, oauth2-proxy |
| Home compute | Four-node Proxmox cluster, one of them a Dell Precision T7610 |
| Storage | Ceph across the cluster, ZFS at rest |
| Router | OpenWrt on retired consumer hardware |
| Provisioning | Terraform for the cloud and the cluster, Ansible for the nodes |
| Backups | restic, pulled to home storage rather than pushed |
A few choices worth the words◣
Two cloud boxes, not one. Identity runs on one, public ingress on the other, and nothing in the first one's firewall admits the second. A compromise of the thing facing the internet should not land on the thing holding the keys. It costs an extra instance and buys a boundary that cannot be argued away later.
Peers reach what they need, not the subnet. The mesh could hand every device the whole home network. It doesn't. The box serving this page can open exactly two ports on two machines — enough to proxy a dashboard and a book library, and nothing else. Scoping by port rather than by host matters more than it sounds: one of those machines also runs something that was never meant to be published.
Backups are pulled, not pushed. Home reaches out to the cloud and takes a copy; the cloud holds no credential that reaches back. A restore is tested by opening the databases and counting what is inside them, because a backup nobody has restored is a rumour.
It is all in files. The cloud, the cluster and the mesh are described in Terraform and Ansible, so the answer to "what did I click eighteen months ago" is a diff rather than an effort of memory.