My name is

David Cumps

A passionate geek, always curious, always learning.

Family accounts on self-hosted infrastructure: onboarding, self-service passwords, 2FA, and what parental visibility looks like in Sieve.

Building the identity layer before there was much to identify against, and the OIDC decision I got to make twice.

One reverse proxy design for the whole fleet, with its routing table in Valkey and its certificates feeding the mail server.

Private networking between data centers with a self-hosted control plane, and a Tailscale sidecar for every container.

Running a mail server is easy. Convincing Gmail that your mail server exists legitimately is the actual work.

Deploying Stalwart across two nodes, with every piece of state pushed out into managed backends.

Full-disk encryption for servers I will never physically see, and why the unlock step stays manual.

How SOPS and two GPG keys let me commit every credential this platform needs to the repository itself.

The blog went quiet in February while the platform kept growing. Here's what happened, and the plan for writing it all down.