Case study · platform, and operating it for real

My Cloud Brain

One server I own, running my entire digital life and every app I build. Around 135 containers across 30-plus self-hosted apps, deployed as infrastructure-as-code, fully observable, backed up nightly and restore-tested. I don't just deploy what I build, I operate it.

~135
containers
30+
self-hosted apps
~60
uptime monitors
nightly
backup copies
Why I run my own

I wanted to own my data and prove I can architect and operate real infrastructure, not just write app code. So I replaced rented SaaS (photos, files, notes) and I host every product I build on one machine, with the reliability discipline a platform needs.

Architecture
The platform
edge
Cloudflare Tunnel
public apps
Caddy
branded private URLs, LE DNS-01
Tailscale
private mesh, no open ports
apps (~135 containers)
My products
Flowstate-class apps, Cyclops, Atlas, Beacon…
My data
photos, files, mail, notes
AI engines
Claude Agent SDK on subscription
observability
Grafana + Loki + Prometheus
Uptime Kuma
~60 monitors
Bugsink
error tracking
durability
Restic → off-box storage
nightly, restore-tested
Infra-as-code
every change in a private repo, reversible

Private by default over a Tailscale mesh with no open ports; public apps go out through a Cloudflare tunnel and Traefik; everything else is reached through Caddy on branded URLs with automatic certificates. Every container's logs ship to Loki and surface in Grafana, with an error-burst alert to my phone. Every change lands in an infra-as-code repo, so the box is reproducible and reversible.

Reliability, the parts that bit me
brokeA reboot let the network grab app ports before Docker.
fixedTailscale claimed ports ahead of the containers and crash-looped two apps. I moved every app onto branded Caddy URLs so that race can't happen again, and stopped exposing raw host ports.
brokeA backup was silently skipping a database.
fixedAfter an app upgrade, a backup script still targeted the old stack, so the new database went unbacked-up. Monitoring caught it. Now I verify backups restore, not just that the job ran.
brokeThe media-versus-database backup trap.
fixedPhoto apps store originals on disk and metadata in a database; backing up one without the other is a false sense of safety. I design the backup around that coupling, and I test-restore it.
Why it matters here

This is the SRE-adjacent evidence: I can architect, secure, deploy and operate production infrastructure end to end, with monitoring, alerting, backups and incident habits, on a real box with real irreplaceable data. It's not a claim, it's running right now, and this site is served from it.