Self-Hosted NAS & Private Cloud
Bare-metal infrastructure automated 100% via Ansible playbooks.
A dedicated, 24/7 low-power private cloud serving as personal production storage, CI runner host, and systems playground. Built on the principle that senior software engineering competence extends through container virtualization, network routing, and bare-metal hardware.
100% Declarative Automation via Ansible
Zero manual SSH snowflake configuration. The entire machine configuration—from disk partition layouts, ZFS pool creation, and Docker compose configurations to firewall rules—is authored in version-controlled Ansible playbooks.
A clean server re-provision from bare metal takes under 15 minutes by executing a single idempotency-tested playbook against the target node.
ZFS RAIDZ Data Integrity & Tiered Storage
Storage is configured with ZFS to prevent silent data corruption (bit rot). Checksums verify all read/write cycles, with scheduled monthly scrubs and automated snapshot schedules.
Critical directories take advantage of NVMe caching and 3-2-1 backup policies using Kopia: end-to-end encrypted, content-addressed snapshots deduplicated and synced daily to remote cold object storage.
Zero Inbound Port Exposure (Tailscale & Cloudflare)
The host has 0 open inbound ports on the WAN router. Remote administrative access uses an encrypted Tailscale WireGuard mesh with ACL restrictions and SSH key enforcement.
Public-facing testing webhooks pass strictly through outbound Cloudflare Tunnels backed by Authelia 2FA authentication, preventing direct IP exposure and automated port scanners.
Automated Modules
ZFS RAIDZ pools, automated scheduled scrubbing, and pool health verification
Mesh VPN routing with zero inbound public router ports required
Encrypted point-to-point network tunnels for dedicated peer links
Reverse proxy, automated Let's Encrypt TLS, and 2FA multi-factor authentication
Self-hosted local LLM runtime with Open-WebUI for private inference
Client-side encrypted, content-addressed deduplicated off-site snapshot backups
Prometheus, Node Exporter, and cAdvisor feeding real-time Grafana dashboards
Private files, contact books, and calendar synchronization infrastructure
Self-hosted event routing, webhook web listeners, and cron task orchestrations