Homelab26

Four jobs, kept apart

• Private services for one household: files, passwords, a dashboard and ad-hoc file transfer, reachable only over a Tailscale tailnet.
• A public Minecraft server with 138 mods, open to the internet on one port.
• A public website for that server, on its own reverse proxy with no route to anything private.
• A four-layer backup system that assumes the Docker disk image can be lost entirely.

Two front doors

The single most important fact about the system: the public path and the private path never touch. Players and website visitors come in through one proxy; your own devices come in through another, on the tailnet. No process on the public path has a network route to any process on the private one.

That is enforced by separate Docker networks and separate bind addresses, not by an access list that somebody has to keep correct. For the same reason there is no top-level compose file: restarting the website must never be able to restart the game server.

What is written down

Nine documents cover the whole machine: architecture and trust boundaries, storage across four drives (random I/O on the SSD, bulk data on the HDD), every network and port, backup retention and restore runbooks, security decisions and their reasoning, day-to-day operations, the Minecraft stack's JVM tuning, the web platform, and the three scheduled tasks that live outside Docker. The original build logs are kept too, because they hold the measurements behind settings that would otherwise look arbitrary.