A personal cloud, operated like a platform.
Around 20 services on a single low-power host — behind a reverse proxy and a mandatory login, deployed declaratively via GitOps and monitored end to end. Private, reproducible, and with no third-party cloud.
Layers, not sprawl
Each tier has one clear job. Requests come through exactly one HTTPS entry point, pass a reverse proxy and a central SSO gate — no service is reachable without a login.
Dive deeper
Lots of performance per watt, in one case
No loud rack: a compact, low-power mini-server sits in the same Corsair 9000D case as the main rig and is wired directly over 10 GbE. A dedicated NAS holds the bulk data.
Learn more →One entry, one login — nothing else
No sprawl of open ports. Requests pass exactly one HTTPS entry point, a reverse proxy with a wildcard certificate, and a central SSO gate. Internal services are simply unreachable from outside.
Learn more →Own DNS — ad-free and split-horizon
DNS is the first stop of every connection — so it runs on your own network. AdGuard Home filters ads and trackers for every device, resolves internal names locally, and sends everything else out encrypted. Deliberately redundant, so DNS never becomes a single point of failure.
Learn more →One login that knows every app
Authentik is the homelab’s central identity. Apps integrate in two ways: OIDC when they speak it natively, or ForwardAuth when the reverse proxy should gate them. High-value apps use both.
Learn more →From idea to a running change — and back
Every change takes the same path: captured in Git, deployed automatically, documented for humans in the wiki and for the AI in the "Second Brain." The loop closes because the AI reads its own knowledge back and assists the next change.
Learn more →AMP — game servers at the push of a button
AMP (CubeCoders’ Application Management Panel) is the homelab’s game-server hub. Instead of setting up each server by hand, an ADS controller manages any number of isolated instances through a web panel — Minecraft, Valheim, Palworld and more. It ships like every other service: as a container via Dockhand, behind the reverse proxy and login.
Learn more →Your own cloud — with real everyday value
Behind the tech is a simple idea: the same services you would otherwise rent from big providers run here on your own hardware. Same convenience, full data sovereignty, no subscription.
Learn more →Data that doesn’t get lost
The backup strategy is built around one concrete disaster scenario: "the boot disk dies." Non-overlapping sets make sure each file is backed up exactly once — and an offsite copy survives even a total local loss.
Learn more →See problems before they hurt
What you don’t measure, you can’t operate. Metrics, logs and synthetic checks flow into one place, dashboards show the whole health picture at a glance, and alerts speak up before anyone notices.
Learn more →A smart home that works offline
The heart of the house is a Home Assistant instance with roughly 2,600 entities across 41 domains — lights, heating, air quality, presence, cameras, security, the car and energy. It runs as its own VM, locally, vendor-neutral and with no forced cloud. If the internet drops, the house keeps working, and the data never leaves the network.
Learn more →Your own cloud, service by service
The principles behind it
One identity for everything. Every service sits behind the central login.
Git is the source of truth. A push triggers an automatic redeploy.
Data stays on your own hardware. No third-party cloud as a single point of failure.
Reverse proxy, mandatory SSO, isolated databases, least privilege.
Every new stack automatically gets a health probe and metrics.
Configuration as code — any service rebuildable from version control.