Someone asked me a simple question this morning: what is actually running on your network right now? I started answering from memory and got about halfway before it sounded thin. So I stopped guessing and ran a census.
The answer: more than twenty live systems across a dozen machines, sitting on one flat home network. A public edge with real certificates. A private mesh VPN I control end to end. A three-node Kubernetes cluster built from laptops, hosting two public applications with their own release pipeline. Raspberry Pis doing broadcast and status work. And a knowledge vault that documents all of it, which is the only reason this list exists at all.
Here is the whole estate, ring by ring.
Ring one: the public faces
These answer to anyone on the internet, behind HTTPS and a single front door.
- This site. WordPress in containers on a Synology NAS, with a hand-built HUD theme, object caching, a project portfolio and a stack page. It is operated through an AI agent over MCP, which is also how it got patched in an hour when PHP2Shell landed.
- Unplugged. An Open edX learning platform running on the cluster, with its database kept outside it on purpose. Its first course was drafted from a real security incident. More here.
- JobHunt, hosted. The multi-user build of my job-search command centre, running in its own Kubernetes namespace. Every release goes brief, build, CI on two databases, deploy, verify live, merge. Nothing reaches main before it has been seen working in production.
- A self-hosted task board that every project on this list reports into, and the control plane for my own mesh VPN, so no third party decides which of my devices can talk to each other.
Ring two: the engine room
Nobody sees this ring. Everything above depends on it.
- Talos Kubernetes. Three control-plane nodes, one per repurposed Dell laptop, running as VMs on KVM hosts. A floating API address that survives a node being pulled. A load balancer handing out service addresses. NFS storage kept off-cluster, because the nodes are treated as disposable. The build story covers what broke.
- TALOS WARD. An operations HUD on the management box that sits outside the cluster, so it stays up when the cluster does not. Node health at one-second resolution, etcd membership, backups with restore, reboot and rebuild controls behind press-and-hold, and a switch that grants or revokes AI SSH access in one click.
- The edge. Cloudflare DNS, a reverse proxy terminating TLS with certificates issued over DNS challenge, and split DNS so the same name works inside and outside the house.
- Two NAS units. One runs the containers, the proxy and the VPN coordinator. The other runs the learning platform’s database and the private Git server that holds my code.
Ring three: on the desk
The small machines. Most of them have a screen of their own.
- camhdmi. A Raspberry Pi that turns any USB webcam into a clean HDMI feed, controlled from a phone. Built in a weekend, open source on GitHub, written up here.
- event-pi. A Pi with a Sense HAT on the desk. Its LED face tracks what my AI coding agent is doing, live, through hooks. Homelab alerts are next.
- LINK WARD. A dedicated Debian box running Linkwarden for fifteen years of bookmarks, with its own HUD, a heartbeat trace and nightly backups.
- A self-hosted password vault, because the most sensitive data I own should not live on someone else’s server.
- Local tools: JobHunt’s original single-user app on my workstation, a Chrome extension that triages saved Facebook reels into my notes, and a skill manager for the AI agents I work with.
The pattern underneath
Twenty systems is a number. What makes it an estate is that the same rules repeat everywhere.
- Every box gets a HUD. Cluster, bookmarks, cameras: each one shows its own heartbeat, and a gap in the trace means a real failure.
- AI access is a lever. Agents reach machines through one dedicated key that a single control revokes. Temporary root during a build gets removed when the build ends.
- State lives off the disposable parts. Databases sit outside the cluster. Storage sits outside the nodes. Credentials are encrypted before they go anywhere.
- Nothing counts until it is written down. Every project has a note in my vault with what was decided, what failed and how it was fixed. That vault is where this census came from.
Honest status
A census that only lists wins is a brochure. Here is what is still open:
- Two backup systems have never had a restore drill. Untested backups are a hope with a timestamp.
- The learning platform needs shared object storage before course imports work through its own UI.
- Three devices still live on DHCP leases they have not been formally promised.
- Linkwarden is LAN-only until its public route is built.
- Nobody has rebooted the main NAS to prove the VPN comes back by itself. That test gets scheduled, on purpose, before it happens by accident.
Why bother
I spent eleven years running IT and AV for a 558-room hotel and conference operation. The lesson that stuck: the team that knows exactly what it is running sleeps through the night. The one that guesses gets the 3 a.m. call.
This network is that lesson applied at home, in public, with the receipts. Every system on this list is either already a project on this site or a write-up waiting to happen.