Selfhost

Selfhost is the platform I’m moving my family and my company onto, away from big tech: e-mail, calendars and contacts, passwords, photos, documents, git, tasks, accounting and more, all running on infrastructure I control in Europe. The guiding rule is “80% of the functionality for 100% of the sovereignty”: some features are less polished than what the big platforms offer, in exchange for full control over the data, the backups and the jurisdiction. I started it in December 2025 and it has grown to some 2,000 commits since. The articles on this site follow it as it happens.

Everything as code. The infrastructure is Terraform, in nine layers applied in order: bootstrap, foundation (network, firewalls, servers and encrypted disks), managed data stores, DNS, e-mail, monitoring, single sign-on, applications and backup. Ansible then configures every server from the operating system up, with 63 roles and 72 playbooks. Secrets live encrypted in the same repository with SOPS and GPG. Servers, object storage and managed PostgreSQL, Valkey and OpenSearch run on Exoscale, with offsite backup storage at Hetzner and DNS at Infomaniak.

The services. Mail runs on Stalwart across two servers, with calendars and contacts, OpenPGP and DANE, including an automated key rollover. One login protects everything: LLDAP for the accounts and Authelia for single sign-on with two-factor authentication, in front of Traefik. Behind it run Vaultwarden for passwords, Immich for photos, Paperless-ngx for documents with OCR and AI-assisted tagging, Forgejo for git with its own build runners, a browser-based PDF toolkit, a task manager, an accounting dashboard, a start page that shows the whole fleet at a glance, and this blog. A Headscale VPN ties the servers, laptops and the home network together.

Watching and recovering. Uptime Kuma checks every service and every server, alerts me on Telegram, and keeps a private status page with the health of every service. Backups run with restic to three separate targets, and PatchMon keeps track of updates across the whole fleet.

Local AI. Two NVIDIA DGX Spark machines, linked to each other, serve AI models locally: they power the AI features of the platform and the team bot I set up at Immovlan, without sending anything to a cloud API. A home server runs Home Assistant and the smart home under the same Ansible setup.

How it’s built. I build it with AI coding agents in a story-driven workflow. Every change is a story with acceptance criteria, its own verification script and an adversarial review, and I decide what ships. So far that’s 24 epics and around 280 stories.

Technologies: Terraform, Ansible, SOPS, GPG, Linux, LUKS, Docker, Traefik, Exoscale (Compute, Object Storage, DBaaS), PostgreSQL, Valkey, OpenSearch, Hetzner Storage Box, Infomaniak DNS, Stalwart, DANE, LLDAP, Authelia, Headscale, Tailscale, Vaultwarden, Immich, Paperless-ngx, Forgejo and Forgejo Actions, Uptime Kuma, restic, PatchMon, Home Assistant, Hugo, NVIDIA DGX Spark, AI coding agents.