Lab · architecture and operation
Operating systems means testing their abstractions.
I operate part of my own infrastructure because operation asks different questions than a diagram: What stays available when a drive fails? What permission does a model actually hold? Which boundary survives when a public application is compromised?
The Lab documents those questions through architecture, experiments, incidents, and open work. It is not live monitoring and not a complete inventory.
01 · Governing principle
Isolation follows data sensitivity.
The first question is not where capacity happens to be free. Placement starts with the data, the required reachability, and the damage a compromised workload could cause. Hardware and providers may change; this rule should remain stable.
02 · Trust zones
Boundaries become legible through denied paths
This model is deliberately abstract. It shows roles and constraints, not hosts, addresses, ports, or protected routes.
- 01
HOME / SENSITIVE
Private and sensitive processing in separate runtime boundaries.
No public ingress. A public application receives no return path into this zone.
- 02
PUBLIC / DEDI
Public services and lower-sensitivity work with logical separation.
Reachable, but not a transit path into private processing. Secrets remain scoped to each service.
- 03
EDGE
A narrow network capability for defined external requirements.
Revocable, preferably read-only keys. No client datasets and no second application platform.
- A public compromise does not become an inbound path into the private network.
- An edge cannot leak datasets it never stores.
- A model cannot use a token it never receives.
03 · Systems index
Roles instead of service tiles
This state describes responsibilities and boundaries at the last full inventory review. It is not an availability promise.
| Area | Role | State | Zone | verified |
|---|---|---|---|---|
| Storage & recovery | Redundancy, snapshots, and encrypted off-host backups | operating · full restore path open | HOME / SENSITIVE | |
| DNS & network | Internal resolution, filtering, and certificate foundation | operating | HOME | |
| Document pipelines | Separated private and business document processing | operating | HOME / SENSITIVE | |
| Public platform | Web services, Git/CI, and a controlled HTTP edge | operating | PUBLIC / DEDI | |
| Static egress | Narrow outbound access for external allowlists | restricted | EDGE | |
| Agent systems | Separated runtimes and versioned capabilities | active development | by trust domain |
04 · Current work
Three open work lines
- Restore confidence
- Prove the complete recovery path as a practiced procedure instead of inferring it from individual backups.
- Agent capabilities
- Distribute capability on demand, mirror canonical knowledge read-only, and bind outward effects to inspectable approval.
- Migration residue
- Systematically remove old proxy, service, and documentation traces left by earlier operating models.
05 · Agent infrastructure
The model is not the security boundary
The shared layer is a versioned repository of rules, skills, standards, and scripts. Small routers load context only when needed. Each runtime receives only the tools its task actually needs.
- 01
Knowledge
Canonical notes and project documentation; self-hosted agents read from a separate mirror.
- 02
Capabilities
Versioned procedures with narrowly assigned scripts, references, and templates.
- 03
Trust domains
Separated environments for different household and work contexts; profiles alone are not treated as tenant isolation.
- 04
Action boundary
The model drafts text. Deterministic code holds tokens, checks roles, and requires approval for side effects.
Untrusted text may influence a draft. It does not receive a privilege.
06 · Incidents and migrations
Operation becomes credible through history
Short entries record what changed and which rule followed. Deeper material remains with the relevant Note or Project.
Homelab rebuild
A grown estate became a documented model. Not every old container had a usable backup.
Dedicated-server rebuild
More complex orchestration gave way to Caddy and ordinary Compose stacks, provisioned with Ansible from the rostr repository.
DNS migration
Two resolvers were compared in a dedicated benchmark environment before the operating decision.
Document reconciliation
Collections were reconciled with SHA-256 and database signals. No LLM was needed.
NVMe disappeared from the mirror
The pool remained reachable in a degraded state; current backups were verified before intervention. No data loss.
Agent baseline migration
A named snapshot and full backup came before schema migration and acceptance tests.
07 · Known imperfections
Open work belongs to system state
These items are safe to publish and supported by existing operating notes. Security findings that would reveal a real attack surface do not belong here.
Restore confidence
Individual backups are verified. A complete restore across the entire path is not yet proven as a repeatable procedure.
Hardware lifecycle
The NVMe that failed and later reappeared remains a replacement candidate. Visible again does not mean trustworthy again.
Migration backlog
Not every retired service has been fully removed from proxy configuration and documentation.