Zero inbound ports
The only door in is a Cloudflare Tunnel on the control-plane Pi. It publishes self-hosted services without opening a single inbound port.
The fleet
Tailscale mesh · every node reaches every other
01
Control plane
Raspberry Pi
Coordinates jobs across the fleet, and carries the only door in from outside: a Cloudflare Tunnel.
02
Standby
Raspberry Pi
Interchangeable with the control plane, so either role can move if a machine dies. It has done exactly that once, for real.
03
GPU compute
Dedicated GPU box
Runs the machine-learning pipeline, plus a local open-weight model so routine jobs cost nothing.
04
Deploy host
Mac mini
Holds the fleet’s database backups and vault archives, hosts the sync hub, and pushes site and demo deploys.
05
NAS storage
Network-attached storage
Holds the data everything else reads and writes, on its own subnet.
Networking
Private mesh · one tunnelled way in
Every machine sits on the same private Tailscale mesh, so any of them can reach any other directly without exposing anything to the open internet. Storage sits on its own subnet, reachable from the machines that mount it rather than from everything.
Access in front of everything
Every published service sits behind Cloudflare Access, so an unauthenticated request never reaches the app.
The door can move
The standby Pi carries its own connector, so the tunnel moves with the control-plane role in a failover.
What runs on it
Almost all of it on the two Linux machines
Control plane · carries the most
Tower · Nexus · Prospect · Waypoint · Breadcrumbs
Tower hands work to whichever machine should run it (how that works). Nexus watches node health, running jobs and my own notes. Plus the Cloudflare tunnel, a few private services, and the nightly timers that merge, lint, snapshot and publish.
GPU compute
Loupe, every model on my own hardware
Loupe and its ML pipeline (the writeup), a local open-weight model for jobs that do not need a frontier model, and the semantic index the dashboard searches.
Deploy host
Backups, vault archives, the sync hub, and the machine deploys are pushed from.
Storage
The bytes the rest of it reads and writes, on its own subnet.
Standby
Idle until it is not.