Sovereign Homelab

Why Run Your Own

There’s a specific satisfaction in running your own infrastructure — not as a proof of concept, but as a daily driver. Every service here is something I use. When it goes down, I feel it. That pressure makes you actually care about reliability instead of just talking about it.

The Machine

Single bare-metal box. No cloud provider, no managed service, no abstraction layer I can’t trace. Docker Compose orchestrates everything. The network is flat, storage is local, and backups go to an external drive. I’ve got a second Raspberry Pi handling DNS — DNSGuard and Unbound, with the ability to switch between local recursion and DoT upstream fetching.

Planned for the near term: encrypted offsite backups to AWS Glacier. Cold storage costs pennies per month and gives me an actual safety net if the hardware dies.

What Runs Here

50 services across the machine. A few worth calling out:

• Caddy — reverse proxy, auto TLS, routes everything
• NetBird — mesh VPN so I can reach this from anywhere
• Vaultwarden — self-hosted password manager
• Gitea — self-hosted git with CI runner and container registry
• Sage — my AI agent (Hermes), runs locally on CUDA GPU, talks to me over Matrix
• OpenClaw Gateway — AI agent orchestration
• Immich — photo library with ML-powered face recognition (OpenVINO)
• Matrix federation — two homeservers (cloudcitadel.in, hanumara.online), both with LiveKit for voice and video
• SearXNG — self-hosted metasearch
• Home Assistant + Frigate — smart home automation and AI-powered security camera object detection
• Folio — this site, built and deployed via Gitea CI/CD. Push to beta branch, Gitea builds the Docker image, pushes to the on-box registry, and deploys via SSH back to this machine. Nothing leaves the box.
• Media streaming — Jellyfin with automated library management, subtitles, and analytics
• Arcane — Docker management and backup
• Camofox — headless browser for automated tasks

AI Pipeline

The AI stuff runs across two machines. My main box runs Open WebUI as the frontend. The actual inference happens on a separate machine with a CUDA GPU running llama.cpp server — quantized GGUF models, mostly Q4_K_M. I use it through OpenCode on my laptop when I’m at a desk, and through my Hermes agent on Matrix when I’m out.

LocalAI runs as a second inference option on the main box, capped to one model at a time. The constraint is intentional — it keeps the memory footprint lean.

Obsidian + CouchDB

CouchDB is here for one reason: live sync of my Obsidian notes. The eventual goal is connecting those notes to my AI agents — giving them context from my actual thinking instead of just public documentation. Not fully built yet, but the plumbing is there.

Observability

This is the part that separates a toy from something you can actually rely on. Every container exports metrics. Alloy collects, Prometheus stores, Grafana visualizes. Loki handles logs. node_exporter, process_exporter, and smartctl_exporter keep an eye on the hardware.

When a container restarts at 2 AM, Grafana alerts me before I notice. The smartctl exporter is the most important — a failing disk doesn’t give you graceful degradation, it gives you silence then data loss. It catches the warning signs.

What I’d Change

Single box, single point of failure. The next step is a second node with automatic failover. At this scale it’s a tradeoff: complexity versus reliability. I’m comfortable here for now.