Self-Hosted NAS & Private Cloud
Bare-metal infrastructure automated 100% via Ansible playbooks.
A dedicated, 24/7 low-power private cloud serving as personal production storage, CI runner host, and systems playground. Built on the principle that senior software engineering competence extends through container virtualization, network routing, and bare-metal hardware.
Codified Automation & Zero Configuration Drift
Every service, container network, and system configuration is defined in the private nas-services repository containing over 40 modular Ansible roles.
No manual SSH tinkering or unrecorded system edits exist on the machine. Running the main playbook ensures complete idempotency—rebuilding the host from a clean OS install to full operational capability in minutes.
Sensitive keys, credentials, and Tailscale pre-auth tokens are encrypted at rest using Ansible Vault, ensuring that infrastructure code can be safely versioned and audited.
$ ansible-playbook -i inventory.ini site.yml --vault-password-file=.vault_pass
Status: 42 roles executed · 0 failed
Zero-Trust Network Mesh & ZFS Data Integrity
Network Isolation Without Inbound Ports
The server operates with zero public open router ports. All remote access is routed through an encrypted Tailscale WireGuard mesh network.
Exposed webhooks and web interfaces pass through Cloudflare Tunnels protected by Authelia MFA (multi-factor authentication) and Caddy TLS reverse proxying.
ZFS RAIDZ & Content-Addressed Backups
Storage pools utilize ZFS RAIDZ with automated copy-on-write integrity, periodic scrub operations, and automated snapshot policies to prevent silent data corruption (bitrot).
Disaster recovery is handled by Kopia: snapshots are encrypted client-side and deduplicated before transmission to off-site cloud storage.