Homelab & Self-Hosted Infrastructure

The edge: a reverse WireGuard tunnel

The home lab never exposes its own IP. Instead, a small rented node acts as an edge ingress: it holds the public IP and the DNS records, and forwards traffic to the lab over a WireGuard tunnel that the lab dials outbound. Nothing at home listens on a public address, so the residential IP never leaks — and if the edge ever takes abuse, it's a disposable lever I can null-route or rebuild without touching a single service.

What's running

Thirty-odd containers, each defined in its own Docker Compose project, behind a reverse proxy that terminates TLS and routes each subdomain. A few of these back the links elsewhere on this site; most are just how I choose to own my own data. The AI platform gets its own section below.

Federated & social

Files & personal

Media libraries

Knowledge & archival

Operations, privacy & the boring bits

The AI platform: “Task Studio”

This is the part I'm proudest of. On top of the homelab runs a self-hosted, agentic AI platform — a password-gated console I call Task Studio that turns a plain-English request into a finished deliverable: a researched report, a small website, generated images, or a fully narrated, scored and captioned marketing video. Every model runs on my own hardware. There is no OpenAI, no Anthropic, no third-party API anywhere in the loop — the LLM that reasons, the diffusion models that render, the voice that narrates, and the model that turns an image into a 3D mesh are all local.

It started as something smaller: a worker for an online task marketplace (built with the platform operator's permission) that polls open bounties, uses a local model to judge which are genuinely AI-suitable, drafts a proof, routes it through a human-review queue, submits it, and sweeps any earnings to a cold wallet. That pipeline — classify → draft → review → dispatch — became the spine everything else hangs off.

Three hosts, one agent

The work is split across three machines so a weak orchestration box never blocks the GPU, and the GPU box never has to hold state. A bot host takes the request and dispatches the agent; the agent host runs the agent runtime and the media tooling; and a GPU rig serves the actual models. The bot reaches the agent over a locked-down reverse-SSH tunnel, and the agent drives the GPU host over HTTP and SSH.

A local media pipeline the agent drives

The agent doesn't just write text — it can call a full production toolbox, review its own output (a vision model describes each render so the agent can judge it), and composite the pieces together. All of it local, much of it able to fan out across both GPUs:

Eva — one assistant, every platform

The same brain is reachable as Eva, a chat assistant that lives on Discord, Matrix and Nostr at once through a microservice hub: platform-specific bots forward commands to a central service (with accounts, permissions and bans) that answers from the local model and can queue Task Studio jobs, pinging you back when the work finishes. It even does cross-platform crypto tips — send someone coins on Matrix from Discord via a derived, redeemable code.

Rebuildable on purpose

All three hosts are captured as Ansible. If hardware dies, the reproducible parts — the bot stack, the agent runtime, every media CLI, the model manifest — come back with a command, and the hand-built GPU rig has an honest runbook rather than a fantasy one-click. Model swaps are a deliberate, documented playbook, not a scramble. It's a research toy in scope and a production system in discipline.

The stack

Boring on purpose — everything here is standard, reproducible, and something I'd be comfortable handing to a client.