What actually runs on it

Everything here runs in containers on one always-on machine in a cupboard in Denmark. No cluster, no orchestrator, no rack — just Docker Compose and a file of YAML I actually understand.

Some of it is reachable from the internet. Most of it deliberately is not, and the difference is a decision made per service rather than a default.

Open ports
0
Machines
1
Certificates to renew
0
Monthly bill
electricity

Services

  • Private Git

    Private

    Self-hosted Forgejo. Repositories, issues and pull requests on hardware I own, rather than handed to someone else. Sign-ups are disabled and every page requires authentication — it exists for exactly one user, and it is not linked from here.

    • Forgejo
    • SQLite
    • Docker
    Not published

  • Dashboard

    Local only

    Container health, service stats and tunnel state on one pane of glass. Kept off the internet on purpose: it reads the Docker API, and nothing that can enumerate containers belongs on a public hostname.

    • Homepage
    • docker-socket-proxy
    Local network only

  • Cloudflare Tunnel

    Public

    How anything gets in at all. The server dials out and holds the connection open, so there is no port forwarding, no static IP, and nothing on the router listening for strangers.

    • cloudflared
    • QUIC
    —

  • Media and backups

    Planned

    Not built yet. The plan is object storage for offsite backups and something to serve media around the house without a subscription.

    • TBD
    —

No open ports, anywhere

The usual way to self-host is to forward a port on the router and hope. This does the opposite: the server dials out to Cloudflare and keeps that connection open. Traffic arrives down a pipe the server itself opened, so there is nothing inbound to find, scan or brute-force.

  1. 01

    Your browser

    Asks for a hostname on notacloudserver.net.

  2. 02

    Cloudflare edge

    Terminates TLS. Certificates are its problem, not mine.

  3. 03

    Encrypted tunnel

    A QUIC connection the server opened, outbound.

  4. 04

    cloudflared

    A container on the server holding the other end.

  5. 05

    The service

    Answers on the Docker network. Never on the router.

The whole thing, listed

Host
Single x86 machine, always on
OS
Debian 13 (trixie)
Runtime
Docker Engine + Compose
Ingress
Cloudflare Tunnel
Version control
Self-hosted Forgejo
Dashboard
Homepage
This site
Astro on Cloudflare Pages
Open ports
Zero
Start

Under construction

Get in touch

Happy to talk about homelabs, packaging, automation, or anything else on this site.

Email
Needs JavaScript — the address is not written into the page.Hidden from scrapers until you ask for it.
LinkedIn
David Frandsen
Location
Denmark

Replies are faster on weekday evenings than at any other time.