A map of everything I run, so the rest of these posts make sense

Almost everything I write here happens on one of about eight machines and services. Rather than re-explain the setup in every post, here is the map once. When a later post says “the hypervisor” or “the tunnel”, this is what it means.

Two halves: what sits in my apartment, and what sits on someone else’s edge with no open ports between them.

  HOME
   ISP A ─┐
   ISP B ─┼──► four routers, no single authority        <- the current mess
   ISP C ─┘              │
                         ├──► Proxmox host ──┬── VMs and containers
                         │   Ryzen mini PC   ├── private registry
                         │   iGPU, unused    └── databases for side projects
                         │
                         └──► M1 MacBook Air ──  the machine I write on

  EDGE  (nothing above has a port open to the internet)
   Cloudflare Tunnel  ────► selected homelab services
   Cloudflare Pages   ────► this site
   ??? ───────────────────► nothing watches any of it     <- the obvious hole

The home half

Three ISPs. Not because I need the bandwidth. I need the failure independence: fibre that goes out during municipal work, a second line on a different physical route, and a mobile connection that keeps the house online when both are down. Consumer internet in Dhaka fails often enough that this is practical rather than paranoid.

Four routers, which is three too many. The network grew one purchase at a time, each box added to solve a specific complaint, and now DHCP is served in two places and two subnets overlap. Nothing has one routing authority. It works until it does not, and when it does not, it presents as a DNS problem every single time. Consolidating this onto one MikroTik is next on the list and will get its own post.

One Proxmox host, which is a Ryzen mini PC rather than anything that belongs in a rack. VMs and LXC containers on it: a private Docker registry, a few databases, whatever a side project needs that week. This is where I get to make mistakes that would be firing offences at work, which is most of the value of owning it.

It has integrated graphics I have never used for anything. At some point I want to find out whether that is enough to run a model locally at a speed a person would tolerate. I have opinions about local inference and no measurements, so that stays off the blog until it is the other way round.

The edge half

Nothing at home has an inbound port open. Not 22, not 443, nothing. Everything that reaches the outside world does so from the inside out, through a tunnel, which means there is no listening service on my home IP for anyone to find.

Public surface, and what each piece costs:

The bill is not the point, though it is a nice property. The point is that every item on that list has no server I am responsible for patching. The attention cost of infrastructure is the part that gets undercounted, and it is the part that wakes you up.

The hole in the map

Nothing on either half is monitored. I find out that a service is down the same way a stranger would, by opening it and getting nothing, which is a bad way to run anything that a client touches.

The two obvious answers both fail my constraints. Hosted monitoring bills per check, which is hard to justify across a dozen small sites. Self-hosted monitoring is another server to patch and another thing that can go down quietly. And neither one can see a service that has no open port, which is all of the interesting ones.

I do not have a good answer to this yet. It has been sitting on the list long enough that I will probably end up building something.

What this means for the posts

Two consequences worth stating up front, because they shape everything else I publish.

Constraints come first. When something has to fit inside a free tier or a scheduled execution budget, I cannot solve it by paying more, so I have to understand it instead. Most of what I have learned in the last two years came from that corner.

And every failure I write about is one I had to fix myself, on hardware I own, with nobody else to escalate to. That is a much smaller sample than a large production estate gives you, but it is a much more honest one. Nothing here is a summary of somebody else’s postmortem.

The map will change. When it does, I will update this post rather than let every later post quietly point at a network that no longer exists.