root:~$ whoami

URX

Technical Support Engineer, Cloud & DevOps.

I design, secure and run a production-style private cloud on one Linux server, and I build the software that runs on it. It hosts 28 services for media, messaging, automation, smart home and local AI, published through Cloudflare with an origin that only answers Cloudflare.

URXSERVERup since 1 Jan 2020
Booting services…
URX pool, 7 × HDD (hover or click bay)
nvme pool, 4 × NVMe
public via CloudflareLAN or VPN onlybackgroundhover a light or bay to read it
28self-hosted services
47running containers
2 GPUs12 GB VRAM, NVIDIA
29 TiBraw ZFS storage
19public HTTPS hosts
5projects I build

$ whichClick a technology to see where it runs on my server.

~/architecture

From the internet to the disk

Select a layer to see what it does and how it is configured.

~/request-path

What happens to a request

Pick a scenario and press Play to follow the packet hop by hop through the stack.

~/ai

Two GPUs, local AI, no cloud API bills

Both NVIDIA cards are passed into containers through the NVIDIA container runtime. They run language models, photo recognition, vehicle detection and video transcoding on my own hardware, so prompts, photos and camera feeds never leave the house.

Quadro RTX 4000

GPU 1  81:00.0
Architecture
Turing, 2,304 CUDA cores, 288 Tensor cores
Memory
8 GB GDDR6
Power cap
125 W
Runs
Ollama local language models (gemma4:e4b)
8 of 12 GB pooled VRAM66%

NVIDIA T1000

GPU 0  03:00.0
Architecture
Turing, 896 CUDA cores
Memory
4 GB GDDR6
Power cap
50 W, persistence mode on
Best at
Low-power video encode/decode and lighter ML
4 of 12 GB pooled VRAM33%
driver 580.173.02CUDA 13.0both cards idle at P8 between jobshost: 2× Intel® Xeon CPU, 56 threads, 94 GiB RAM

Who talks to the local LLM

Ollamagemma4:e4b on the RTX 4000internal network only24 CPU / 32 GiB cap
RTX 4000 load2%P8 idlesimulated run
Press “Send a sample job” to watch a request go through the GPU.

Other GPU workloads

Private by design

Prompts, photos, face data and camera feeds are processed on my hardware. The model API sits on an internal Docker network and is never published.

Fair sharing

Hard caps keep AI from starving everything else: the LLM runtime is limited to 24 CPUs / 32 GiB RAM, photo ML to 12 CPUs / 24 GiB, and URXFilms runs critiques one photo at a time in its own GPU lane.

Practical cost

Workstation GPUs with 50 to 125 W caps give me article writing, photo critique, smart photo search and transcoding with no per-token or per-seat fees.

~/apps

Apps running on my own platform

I write these myself and run them on the same server, with staging, snapshots and rollback.

~/automation

Workflows that run while I sleep

Self-hosted n8n with its own Postgres and Valkey runs publishing, AI writing, sensor logging and chat bots on schedules. On my Windows machine, PowerShell scripts handle the daily chores around my projects.

~/smart-home

Sensors, a wall panel, and Home Assistant

An ESP32 air-quality node I programmed feeds a 7-inch touch panel I built with ESPHome, Home Assistant and my n8n reports.

Sentinel, bedroom, ESP32 + BME680
181
Moderate
050100150200250500

Sample reading from the node's /json endpoint, 24 Oct 2026 01:03. BSEC accuracy 3/3 (fully calibrated).

Daily report preview (n8n to Telegram and Discord)
HA Panel, Waveshare ESP32-S3 7" touch, 800×480. Tap the pages and tiles.
ESPHome · LVGL · BLE proxy Tap any tile to send an encrypted HA API call

How the pieces connect

SentinelESP32 + BME680
→ 30 s →
PanelESPHome + LVGL
⇄
Home Assistantencrypted native API
Sentinel/json
→ 10 min →
n8ndata table
→ 10:00 →
ReportTelegram, Discord
  • The panel also proxies Bluetooth for Home Assistant, pulls Pristina weather and air pollution every 10 minutes, and sleeps from 01:30 to 07:30.
  • Its DNS points at my on-server ad filter, and the Network page shows how much it blocked.
  • Wi-Fi is split into main, guest and IoT networks on 2.4 and 5 GHz, each switchable from the panel.
~/services

What the platform does for me

Each service is described by what it does. Turn on software names to see the tool behind it.

~/storage

Two-tier ZFS

Bulk data lives on spinning disks and anything latency-sensitive lives on NVMe. Every app gets its own dataset, so quotas and snapshots apply per service. Select a pool to inspect its datasets.

ZFS clone rehearsal

zero-cost copy-on-write

Before any schema migration touches production, I clone the live dataset and run the upgrade against the clone first.

SnapshotsRecursive on both data pools, weekly on Sunday at 00:00
Retention4 weeks on HDD, 3 weeks on NVMe
Before deploysManual snapshots plus the previous image kept for one-command rollback
RehearsalsZFS clones of live data to test upgrades and migrations before they touch production
App backupsPhoto DB dumps, scripted game DB dumps, dated proxy config copies
QuotasPer-dataset, e.g. Time Machine capped at about 2 TiB; per-user quotas in URXFilms
~/operations

How it stays up

Self-healing

Every container has a restart policy. 32 running containers define healthchecks, and all 32 reported healthy at audit.

Isolation

About 38 Docker bridge networks from a custom 172.16.0.0/16 pool, one per stack. Databases publish no host ports.

Limits

CPU and RAM caps on every catalog app. LXC guests are pinned to CPU sets with memory caps.

Hardening

no-new-privileges, targeted capabilities instead of privileged mode, unprivileged LXC for nested Docker, non-root images.

Releases

Snapshot, tag the running image, build, redeploy, check health and logs. Rollback is one retag and one rollback command.

Alerts

n8n reports to Telegram and Discord; CrowdSec decisions sync to Cloudflare; Prometheus scrapes the photo platform every 5 s.

Schedule (click row)Automated job
every 1 minSync camera SFTP logs to the IDS (inode-preserving rsync)
every 2 minPush CrowdSec ban decisions to a Cloudflare IP list (my Python script)
every 5 minSync reverse-proxy access and error logs to the IDS
every 10 minLog the bedroom air-quality sensor to n8n
every 2–3 hAI news scout writes a draft article; publisher posts the next one to WordPress
8× a day per pageAuto-posting to 7 social media pages with random delays
dailyCopy the renewed TLS certificate into the encrypted-DNS server; 10:00 air-quality report
weeklyRefresh Cloudflare IP ranges with validation and rollback; recursive ZFS snapshots
monthlyHash the archive to find duplicate files
~/training

Where I learned the workflow

My DevOps course took one small Node.js app through every stage of a delivery pipeline, and I completed all of it. Select a stage to see the exercises behind it, or run the whole pipeline.

DevOps course, Tectigon Academy
100% complete
readya simulation of the course workflow
Press “Run the pipeline” to send the app through all six stages.

The AWS Courses

Four courses by Amazon Web Services that take the same ideas to the cloud: AWS foundations, then code, build and test, release and deploy, and operate and monitor. Select a course, or run a deployment through all four.

DevOps on AWS
4 of 4 courses complete
readya simulation of what the four courses cover
Press “Run a deployment on AWS” to take an app from the cloud foundations to a monitored release.

Licenses and certifications

~/skills

What this shows