// homelab
Isolation follows data sensitivity
15+ LXCs and VMs on my own hardware, a public dedicated server, an edge VPS — three tiers, one principle: convenience doesn't decide where a workload runs, the sensitivity of its data does. This setup isn't a toy next to the work; it's the infrastructure the work runs on.
// not a showroom, production
Three tiers
// categories, not inventory
What runs here
Storage & backups
ZFS mirror, daily snapshots with verify, encrypted off-host backups — the NAS only ever sees ciphertext.
DNS & network
own resolver with adblock, secondary resolver, everything internal with real certificates.
Document pipeline
two Paperless instances (private/business) plus my own RAG search across the documents.
Agents
several self-hosted agent instances, skills as versioned infrastructure, LLM out of the action path.
Media & household
media server, photos, password manager, recipes — the household's cloud replacement.
Monitoring
metrics, uptime, dashboards — measurement before optimization.
// pinned to the wall
Principles
- Isolation follows data sensitivity — sensitive data never leaves the house.
- Never unencrypted onto the NAS: storage only sees ciphertext.
- Measure, then optimize — measure first, touch second.
- Backups are proven, not assumed: snapshot before every intervention.
- LLM out of the action path: models produce text, deterministic code acts.