The shift: from owning to renting

• We used to own CDs, DVDs, books → local, offline, durable.
• Now: streams, subscriptions, pay-per-use, geo-locks.
• Access can be revoked; data gets extracted; costs creep up.
• Privacy & resilience suffer.

Why self-hosting?

• Control: data locality, portable formats, reversible choices.
• Cost: avoid subscription sprawl; reuse commodity hardware.
• Privacy: reduce data exhaust; least-privilege access.
• Resilience: independent recovery path; fewer external dependencies.

Architecture overview

• Ingress: Traefik (TLS), Keycloak (SSO/MFA), CrowdSec (reputation).
• Orchestration: Docker + Portainer (per stack).
• Network privacy: Pi-hole + Unbound, Gluetun (egress VPN).
• Access: Tailscale & Headscale (LAN-over-WAN).
• Storage: Unraid + ZFS (SSD cache → HDD pool).
• Observability & DR: Prometheus/Telegraf + Grafana; ZFS replication.

Stack map

• Security & network: Traefik • Keycloak • CrowdSec • Pi-hole • Unbound • Gluetun • Tailscale/Headscale
• Orchestration & storage: Docker • Portainer • Unraid • ZFS
• Data & collaboration: Nextcloud • OnlyOffice • Imaginary • Full-Text Search • ClamAV • Redis • DB
• Media & streaming: Radarr • Sonarr • Lidarr • Readarr • Prowlarr • FlareSolverr • Calibre-Web/CalibreVNC • AutoM4B • Plex • Kodi
• Home & sensing: Home Assistant • Grocy • ebusd • ESPHome • Node-RED • MQTT • Speedtest Tracker • Signal
• AI & dev: Ollama • Open WebUI • code-server
• CCTV: Frigate • go2rtc
• Passwords: Vaultwarden (OTP stored elsewhere)
• Sensors & lab: InfluxDB (Mycodo)

What it looks like

The real map, deliberately blurred: addresses and hostnames stay at home.

Personal files

• Nextcloud as the personal hub (files / photos / mobile sync).
• OnlyOffice for docs; Full-Text Search; Imaginary for images.
• ClamAV / Redis / DB behind the scenes; quotas & lifecycle rules.
• Backups per dataset (ZFS snapshots → replicated).

Media & streaming

• *arr pipeline: Prowlarr/FlareSolverr → Radarr/Sonarr/Lidarr/Readarr.
• Libraries & metadata (Calibre, LazyLibrarian, Calibre-Web, AutoM4B).
• Plex for remote playback; Kodi DB on the TV.
• Compliance: personal-use copies of media I own; no redistribution; I comply with French and local laws.

Home automation & sensing

• Home Assistant + Node-RED scenarios; ESPHome devices.
• Frigate + go2rtc + Coral TPU for CCTV.
• ebusd for heating; MQTT as the glue.
• Speedtest Tracker; push alerts via Signal.
• Mycodo + InfluxDB for the mushroom lab (sensors, graphs, alarms).

AI, dev & specialty stacks

• Ollama + Open WebUI: local LLMs, private by default.
• code-server: edit configs safely from a browser.
• Manyfold: asset manager for 3D models; Foundry VTT for tabletop RPG.

Operate it in ~1h / week

• Upgrades (per stack): docker compose pull && docker compose up -d (pinned tags).
• Health: Grafana alerts; a quick glance when I'm at my desk.
• Front-door sanity: test 1–2 Traefik routes; Keycloak MFA; CrowdSec anomalies.
• Storage & quotas: Nextcloud usage / pool capacity panels.
• ZFS snapshots & sends are automated by cron.

Underlay: hardware, storage, orchestration

• Main host (~10 years old): 64 cores, 256 GB RAM.
• 12 × 12 TB HDD + 8 × 1 TB SSD; Unraid + ZFS (SSD cache → HDD).
• Docker everywhere; Portainer templates & visibility.
• Secondary host (older 4 TB disks) as ZFS replication target.

Full autonomy* — the explicit exception

• I self-host ~200 services for my digital life… except email.
• Solo email is hard: deliverability & IP reputation, DKIM/SPF/DMARC, blocklists, inbound spam filtering, rDNS, 24/7 uptime.
• Pragmatic setup: own the domain; outsource mailboxes; optionally mirror IMAP locally; use a trusted SMTP relay for notifications.

The goal isn't No-Cloud; it's Know-Cloud.