No door to the public internet. A cloud front door authenticates every visitor and reaches home only over an encrypted overlay. How the lab is exposed, and how little.
Click the map to enlarge.
PUBLIC
a visitor · public internet
request ↓
CLOUD FRONT DOOR · hardened droplet
Caddy · reverse proxy, known hosts only
auth gate · OAuth sign-in, per-capability
automatic Let's Encrypt TLS · fail2ban · default-deny firewall
TAILSCALE · encrypted overlay, the only way in ↓
HOME · no inbound residential ports open
Softserve · subnet router
services · Plex · Home AI
segmented network · isolated bridge, macvlan-isolated DNS
Security posture
The whole design is one idea: the house is never directly reachable, and everything that is reachable is authenticated and hardened.
Zero residential inbound ports open. Nothing at home listens to the public internet.
Authentication at the edge. OAuth sign-in, then per-capability access, before a request reaches home.
Automatic TLS. Let's Encrypt certificates, renewed without intervention.
Tailscale-only reach. The droplet reaches home only over an encrypted overlay; administration is the same path.
Named domains only. The front door serves only its configured domains; an unknown host gets no certificate and no answer.
Segmented internal network. Services sit on an isolated bridge; DNS runs on a macvlan-isolated filter.
Hardened host. A default-deny firewall, fail2ban on SSH, and unattended security updates.
Secondary resolver off-site. A second DNS instance keeps name resolution working if the primary is down.
A visitor never reaches my house directly. They reach a hardened cloud droplet that signs them in and proxies only what their capabilities allow, and that droplet is the only thing that can reach home at all, over an encrypted Tailscale overlay that also carries my own administration. Inside, services sit on an isolated network and DNS runs on a segregated filter. For who gets in and what they may do, see the friend onboarding flow behind the Home AI gate; the machines behind the door are the lab overview, and what they compute is the AI and scheduling maps.