What's Running in My House
Five machines live in my house, and every one of them runs Debian. Between them they handle my music, my movies, my files, my notes, my search engine, a couple of local AI models and a BBS running on a computer that doesn't physically exist.
The public stuff lives on rented servers: the blogs, the Mastodon instance, the BBSes people actually call. This post is about what stays home.
How traffic gets in
The ISP's modem sits in bridge mode and does nothing else. An EdgeRouter-X handles the real work as gateway, firewall and NAT. Behind it there's a small managed 8-port switch and a Ubiquiti access point. LAN DNS comes from dnsmasq.
Public web traffic hits the router, gets forwarded to one box, and that box decides where it goes. It's an nginx reverse proxy I call the ingress. Every public site hosted at home passes through it, so there's exactly one place to look when something breaks. The ingress also pushes dynamic DNS updates to deSEC, which hosts the public hostnames.
Tailscale ties everything together, home machines and VPSes alike. Because of that, almost nothing needs to be open to the internet except web ports. SSH, admin panels, Grafana and Portainer are all reachable over the mesh and invisible from outside. Let's Encrypt covers HTTPS everywhere.
The workstation
My desktop does more than a desktop probably should. Ollama runs local LLMs on it, with Open WebUI as the front end, so I can ask a model something without sending it to anyone.
It also runs a few Python tools I wrote for myself, a project manager and a book manager, as systemd user services. Nothing fancy. They do what I need.
Then there's the BBS. 86Box emulates a vintage PC, and that PC runs Renegade BBS. A custom Telnet bridge with HAProxy in front lets modern callers dial into a machine that only exists as an emulator process on my desk. I enjoy this more than is reasonable.
The laptop is the workstation's travel companion. It isn't always connected, so nothing important lives on it.
The home server
This is the Docker box, and the closest thing I have to a proper server. Jellyfin serves video. Tiny Tiny RSS is my feed reader, published to the web so I can read from anywhere. Grafana and Prometheus keep an eye on everything, and Portainer manages the containers.
LiteLLM sits here too, as a single gateway in front of the LLMs. Tools talk to one endpoint instead of needing to know which model lives where.
It's also where the bulk storage is. NFS and Samba shares hang off it, and every night it pulls encrypted Borg backups down from the VPSes.
The Mac Mini that doesn't run macOS
A Mac Mini running Debian 13 hosts Nextcloud with OnlyOffice. That's where my files, calendar and documents live.
It also serves an educational mythology website on PHP and MariaDB. Old stack. Still works.
The OptiPlex
A Dell OptiPlex 7050, also on Debian 13, is the busiest machine in the house. It's the nginx ingress I mentioned, and it carries a lot besides:
- Navidrome for music streaming
- Gitea for my own Git repos
- Trillium for notes
- SearXNG, a private metasearch engine
- Several Gemini capsules on Molly Brown Then there's the retro-computing lab, which is the part I'd show a visitor first. A "retro internet gateway" and museum, protocol bridges so old machines can talk to the modern network, and a retro FTP server. The OptiPlex is also a node in InterDOOR, a federation for BBS door games.
What I'd tell a newcomer
Write it all down in one file. Mine is a single Markdown "source of truth," and I keep it current, because the day you need it is the day you've forgotten what's in it.
Back up before every change. Then test a restore once in a while. A backup you've never restored is a guess.
Put one reverse proxy at the front. Retire things on purpose: keep a rollback copy for a while, then delete it. Cloudflare Tunnels, FreshRSS and a pile of old VirtualBox VMs have all gone that way.
And if you can get away with flat files, do it. The Gemini capsules ask almost nothing of me. WordPress and its database ask a lot more.