the homelab
self-hosted everything, running on cloud free tiers, a 2009 macbook, and a phone on a usb-c dock. all of it meshed over tailscale. priorities in order: privacy, then cost (zero dollars), then resilience.
total monthly spend: $0. total machines: six. sense of control: immeasurable. one of these also serves a government website. shhh.
01 / the fleet
-
a
the big one
an arm cloud box with 4 cores and 24 gb of ram for the grand price of nothing. runs an llm proxy that routes to azure openai. mostly idle, which is very funny for the largest machine in the fleet.
-
b
the music box
one core, one gig of ram, running navidrome and a 55 gb music library. the most fragile thing i own and it knows it.
-
c
the watchtower
uptime kuma and ntfy, pinging everything every 60 seconds and pushing alerts to my phone. if this one dies nobody gets told anything, which i'm aware is a design flaw.
-
d
the spare
a west coast vm that does nothing but be a tailscale exit node for when i'm traveling. sometimes doing nothing is the job.
-
e
the 2009 macbook pro
running ubuntu at my parents' place. usually off because of the power bill. do not depend on it. i don't.
-
f
the phone
an android on a docking station working as a residential exit node. don't ask why, it's load-bearing.
02 / the network
one tailscale tailnet holds it all together. magicdns on, and a tag-based acl with four tiers: personal, server, family, and untrusted. servers can talk to each other, family devices can reach the servers but not each other or my stuff, and the phone can't reach anything at all. it exists purely to be an exit.
every service binds to the tailscale interface only. nothing is public-facing.
03 / house rules
-
i
self-host by default
anything touching private data or inference stays on my machines. that's the whole point.
-
ii
simple over impressive
grafana, prometheus, and loki were considered and rejected as overkill. kuma pings things. that's enough.
-
iii
one-line commands only
backslash line-continuations have betrayed me for the last time. every command pastes clean or it doesn't ship.
04 / lessons learned the hard way
-
>
free tiers have fine print
oracle's free tier locks you to one region, so much for geographic diversity. and student cloud egress fees will quietly make storage a trap.
-
>
dead exit nodes fail silently
when an exit node dies, everything downstream just times out with no obvious reason. i learned this from a music scrobbling outage, which is the most homelab sentence ever written.
-
>
tiny routers can't handle it
mips-based travel routers run out of ram trying to run tailscale. some hardware just wants to be left alone.
05 / up next
a web frontend for the llm proxy, disk alerts before the music library eats its drive, and a dead man's switch for the watchtower so the thing watching everything is also watched.