The last post on this blog is dated February 23rd. It ended with a to-do list: monitoring, backups, Git hosting, password management, migrating out of Google. Then nothing for almost six months.

The silence wasn’t abandonment. It was the opposite problem. Every evening I could spend on the project went into building, and writing kept losing the coin toss. The git history for those six months holds close to 400 commits. The platform I described in February, two mail servers and a blog, has grown into a five-node fleet, plus a Mac Mini doing AI inference and a family NAS that got adopted into the infrastructure whether it liked it or not.

So here’s the plan: one post every Tuesday until I’ve caught up. This post is the map, so you know what’s coming and can decide which Tuesdays to show up for.

What actually got built

A rough inventory, in the order it happened:

• Monitoring with Uptime Kuma on its own instance, because checking services by hand stopped scaling around service number eight.
• Backups with restic, to Exoscale object storage and an offsite Hetzner Storage Box, with restore drills. Actual restore drills, not the “I’m sure it works” kind.
• Forgejo for Git hosting. The repository that defines this infrastructure now lives on the infrastructure it defines, which still makes me smile.
• Vaultwarden for family passwords, Homepage as a dashboard for all of it, Tududi for tasks, and a small accounting dashboard I wrote myself.
• PatchMon to keep track of pending updates across the fleet, because five servers is past the point where you remember what needs patching.
• All DNS moved into Terraform. Four domains, every record in git, no more clicking around a registrar panel.
• Immich for photos, running on a Synology NAS at my own home, adopted into the mesh and wired into the same backup and SSO machinery as everything else.
• Paperless-ngx for documents, with OCR running on a Mac Mini through Apple’s Vision framework and a local LLM doing the classification. No cloud API sees a single page.

And the failures, which are honestly the better stories. A provider changed their DNS API and quietly broke certificate renewal for the entire fleet, with the first certificate a month from expiry and renewal already failing when I noticed. One week in June produced three different flavors of zombie network connection, each with a different root cause. And this summer, an interaction between DANE, Let’s Encrypt certificate rotation, and a detail of RFC 7671 I understood only after it hurt me silently bounced inbound mail for longer than I want to admit. That last one gets a long post.

How the catch-up works

Three arcs, in roughly chronological order.

The first arc revisits the foundation. The February architecture post compressed three months of work into an overview; these posts go back and do the deep dives. Secrets management with SOPS, LUKS on everything, running Stalwart, actually getting mail delivered, the private mesh with Headscale, Traefik, single sign-on, and email accounts for children. They’re written now, with six extra months of knowing what broke later.

The second arc covers the services from the March-to-May stretch: monitoring, backups, Forgejo, Vaultwarden, and friends. One service per post, including what went wrong during each rollout.

The third arc is the recent era, where the interesting problems stopped being “how do I install X” and became “how do I keep fifteen containers with network sidecars healthy across five hosts”. This is where the war stories live: the zombie connections, the certificate time-bomb, the DANE incident.

At the very end, one post on how I build all of this as a single person, with AI agents doing much of the implementation work under adversarial code review. That workflow deserves its own writeup once the results are on the table.

What’s still missing

The honest note to end on: the original goal of this project was moving my family out of Google Workspace, and the actual data migration hasn’t happened yet. Fifteen years of email, calendars, and contacts are still sitting in Takeout’s waiting room while I built the place they’ll land. That work is coming, and it will get written up when it’s real, not before.

New posts land every Tuesday. There’s an RSS feed if you’d rather subscribe than remember. See you next week, when we start at the beginning: how to keep secrets in a git repository without losing sleep.