Provisioned from bare metal to production — a hardened Arch host running a 10-service container stack: reverse-proxied web apps, Immich photo library, file sync, encrypted Restic backups, and a single zero-trust Cloudflare Tunnel. GitOps delivers a push to production in minutes, with zero data loss and zero breaches to date. Muamua ships through it.
- Runs a 10-service production stack on self-built dedicated hardware — reverse-proxied web apps, photo library (Immich + Postgres), file sync, backup automation
- Zero data loss and zero breaches across the infrastructure's lifetime — encrypted Restic backups to physically separate storage
- Hardened by default — root-less containers with all capabilities dropped, LAN-only surfaces, a single Cloudflare Tunnel as the only external path (no open inbound ports)
- Automated the delivery pipeline — GitOps from push to production: CI builds, Arcane pulls and recreates, including locally-built images
- Caught failures before users did — per-service health checks with instant Gotify alerting
задача
Wanted production-grade self-hosting — real services, real personal data, real internet exposure — without cloud bills or privacy trade-offs.
подход
Built a dedicated server from parts: Arch on LUKS2+btrfs, 10+ containers with dropped capabilities, a single zero-trust Cloudflare Tunnel as the only door in, GitOps delivery, and encrypted Restic backups to separate storage.
результат
Zero data loss and zero breaches across its lifetime. A push reaches production in minutes, and a per-service health checker pages the phone before users notice.