Homelab & Infrastructure
A small host treated like real infrastructure.
The Raspberry Pi is not a novelty box. It runs public portfolio and business applications beside private field tools, with each workload isolated, observable, backed up, and exposed only as far as its purpose requires.
PUBLIC EDGECloudflareTLS · DNS · Tunnel
↕
TRUSTED DEVICESPhone · iPad · workstationPrivate services stay local
Operating principles
The architecture follows the consequence of failure.
A public portfolio and a private equipment database do not need the same exposure. Each application receives its own Compose project, database boundary, persistent storage, port, and deployment path so one release does not take another service down.
Isolate
Separate containers, networks, volumes, ports, environment files, and project names limit the blast radius.
Expose deliberately
Public sites use a managed tunnel. Sensitive tools remain reachable only from trusted local devices.
Persist intentionally
Database volumes and uploaded files survive container replacement and are included in backup planning.
Recover predictably
Known-good branches, migrations, health checks, backups, and rollback instructions make deployment repeatable.
Inside an application stack
Every service has a job and a health signal.
Queue workerSchedulerHealth checksPersistent uploadsProduction envARM64 builds
- 01
fetch known-good branch - 02
build application images - 03
start database and app - 04
run migrations and optimize - 05
verify health + local HTTP - 06
confirm neighboring services
Deployment discipline
A release is not finished when one page returns 200.
Deployment verifies the application, database, worker, scheduler, local web boundary, public edge, and neighboring services. That last check matters: chrisdarden.dev should never earn uptime by breaking HandyHounds or a private tool sharing the host.
- Deploy only reviewed main or a known-good release
- Run migrations before traffic verification
- Check disk capacity, container health, and recent logs
- Re-test every existing public service after a host change
Security boundary
Show the architecture without publishing the keys to it.
This page documents patterns and responsibilities. It intentionally omits credentials, private addresses, internal hostnames, tunnel identifiers, customer records, equipment data, and household inventory.