A personal cloud, operated like a platform.
Around 30 applications in more than 40 containers on a single low-power host — behind a reverse proxy and a mandatory passwordless login, deployed declaratively via GitOps and monitored end to end. Private, reproducible, and with no third-party cloud.
Harden, understand, measure yourself
Hardening guide
16 steps, ordered by D3FEND, each with a self-check question. For your own website or homelab.
Open →D3FEND explained
What the MITRE catalogue is, how it is structured, and how to use it to measure your own defences.
Open →D3FEND cube
272 techniques as a 3D city. Explore the example or rate your own setup in a few minutes.
Open →Layers, not sprawl
Each tier has one clear job. Requests come through exactly one HTTPS entry point, pass filtering, a reverse proxy and a central SSO gate — no service is reachable without a login.
Dive deeper
Lots of performance per watt, in one case
No loud rack: a compact, low-power mini-server sits in the same Corsair 9000D case as the main rig and is wired directly over 10 GbE. A dedicated NAS holds the bulk data.
Learn more →One entry, one login — nothing else
No sprawl of open ports. Requests pass exactly one HTTPS entry point, a layer of filtering in front of it, a reverse proxy with a wildcard certificate, and a central SSO gate. Internal services are simply unreachable from outside.
Learn more →Own DNS — ad-free and split-horizon
DNS is the first stop of every connection — so it runs on your own network. AdGuard Home filters ads and trackers for every device, resolves internal names locally, and sends everything else out encrypted. Deliberately redundant, so DNS never becomes a single point of failure.
Learn more →One login that knows every app
Authentik is the homelab’s central identity. Apps integrate in two ways: OIDC when they speak it natively, or ForwardAuth when the reverse proxy should gate them. High-value apps use both.
Learn more →Security as layers, not as a wall
Anything exposed to the open internet is scanned around the clock — that is not a threat scenario, it is the normal state. The answer is not a single wall but a chain of independent controls: filter before computing, check before rolling out, and look regularly for what was missed. This page describes the principles on purpose — the configuration stays inside.
Learn more →From idea to a running change — and back
Every change takes the same path: captured in Git, checked automatically, deployed automatically, documented for humans in the wiki and for the AI in the "Second Brain." The loop closes because the AI reads its own knowledge back and assists the next change.
Learn more →AMP — game servers at the push of a button
AMP (CubeCoders’ Application Management Panel) is the homelab’s game-server hub. Instead of setting up each server by hand, an ADS controller manages any number of isolated instances through a web panel — Minecraft, Valheim, Palworld and more. It ships like every other service: as a container via Dockhand, behind the reverse proxy and login.
Learn more →Your own cloud — with real everyday value
Behind the tech is a simple idea: the same services you would otherwise rent from big providers run here on your own hardware. Same convenience, full data sovereignty, no subscription.
Learn more →Data that doesn’t get lost
The backup strategy is built around one concrete disaster scenario: "the boot disk dies." Non-overlapping sets make sure each file is backed up exactly once — and an offsite copy survives even a total local loss.
Learn more →See problems before they hurt
What you don’t measure, you can’t operate. Metrics, logs and synthetic checks flow into one place, dashboards show the whole health picture at a glance, and alerts speak up before anyone notices.
Learn more →A smart home that works offline
The heart of the house is a Home Assistant instance with roughly 2,600 entities across 41 domains — lights, heating, air quality, presence, cameras, security, the car and energy. It runs as its own VM, locally, vendor-neutral and with no forced cloud. If the internet drops, the house keeps working, and the data never leaves the network.
Learn more →Your own cloud, service by service
The principles behind it
One identity for everything, passwordless via passkey. Every service sits behind the central login.
Git is the source of truth. A push triggers an automatic redeploy.
Data stays on your own hardware. No third-party cloud as a single point of failure.
Edge filtering, reverse proxy, mandatory SSO, isolated databases, least privilege.
Every new stack automatically gets a health probe, metrics and logs — and typical failures heal themselves.
Configuration as code — any service rebuildable from version control.