A production environment running 24/7. Built to regain sovereignty over my data, drop the dependency on SaaS services and centralise the operational management of the home, finances and critical communications.
The technological core and its automated deployment.
The base OS choice prioritises long-term stability and support. Running an LTS release guarantees security patches for 5 years. It runs headless (no GUI) to dedicate 100% of the hardware to the productive services.
Instead of heavy virtual machines I use containers. This decouples applications from the base OS: if a service fails or needs specific libraries, it doesn't affect the rest. Config lives in text files, enabling near-instant backups and rebuilding the whole system in minutes — Infrastructure as Code (IaC).
Organisation, maintenance and system monitoring/diagnostics.
The Docker CLI is powerful, but for a global view I use Portainer. It's the visual command centre for the lifecycle of containers, virtual networks and persistent data volumes.
A self-hosted proactive monitoring system. It constantly evaluates the availability of every infrastructure node and HTTP endpoint, so I catch outages before they hit daily operations.
Critical security automation. Watchtower watches Docker image registries and, when it detects a new upstream version, pulls the image and recreates the container with the same configuration automatically.
For low-level observability. Glances hooks directly into the system APIs to monitor I/O bottlenecks, per-core CPU load and memory usage, exporting the data to the main dashboard.
Defence in depth and robust access control.
Security starts outside the local network. I use a three-layer architecture so no malicious connection ever touches the server:
A centralised identity provider (IdP). It acts as security middleware under a Zero-Trust paradigm: before the reverse proxy serves the app, Authentik intercepts the traffic and validates identity, forcing MFA even on apps that don't support it natively.
I migrated all my data from Google Drive to this local instance. It gives me physical control over files, photos and documents with no third parties. It syncs both ways and handles CalDAV and CardDAV.
A lightweight implementation of the Bitwarden API written in Rust. Vital for operational security: it stores the 2FA seeds and complex passwords of the whole infrastructure under a Zero-Knowledge architecture.
A combined solution for network hygiene and remote access. Pi-Hole acts as a local DNS sinkhole, blocking telemetry and ad domains at the network level. OpenVPN sets up an AES-256-GCM encrypted tunnel for secure remote SSH maintenance.
Federated messaging infrastructure and advanced mail routing.
My own mail cluster to regain communication privacy. Receiving and storing mailboxes happens 100% locally through Postfix (MTA) and Dovecot (IMAP). To guarantee deliverability, outbound mail is routed via an authenticated SMTP relay, with the domain identity backed by strict DNS cryptography.
A private Matrix homeserver running Synapse. Enterprise-grade real-time messaging with end-to-end encryption (E2EE) by default. I use Element as the client and set up bridges to pull third-party networks (WhatsApp, Telegram) into my own server.
Local productivity, analytics and remote programming.
A remote development environment (IDE) based on Visual Studio Code. I code, build and deploy using the underlying server's power. Being browser-accessible, I can develop smoothly from an iPad or any machine without setting up the environment.
A fully self-managed web analytics platform. It tracks this portfolio and other projects. Sending no telemetry to third parties, I ensure strict GDPR compliance and respect for visitor privacy.
An advanced document manipulation suite (OCR, split, rotate) without uploading sensitive documents (payslips, contracts) to third-party sites. All processing runs in the server's local RAM.
A practical demonstration of fullstack development and deployment. This site isn't on shared hosting: it runs directly inside a container in this very infrastructure.
Personal data analysis and asset management.
An app dedicated to tracking the costs of my personal vehicle fleet. I compute the real TCO (total cost of ownership) from historical data.
A finance system based on Zero-Based Budgeting. Unlike a spreadsheet, it offers bank sync and real-time reports. Currently on hold due to the lack of European banking integrations.
This whole infrastructure was deployed with open-source software. If you're interested in implementing similar corporate or private solutions, I can help.