Introduction
My personal infrastructure serves as both my daily experimentation ground and a practical tool running my professional and personal services. It covers home automation, application hosting, local AI, and network security.
Hardware
The infrastructure relies on several machines with well-defined roles:
- Mac mini M4: main server, accessible only via SSH. Hosts numerous services through Docker: n8n (automation), two Odoo instances (CRM/invoicing for my micro-enterprise and for Cluvo), Ollama with Open WebUI (local LLM), Grafana, and various VMs for ad-hoc experiments.
- Synology NAS: centralized storage for personal data, application backups, and lightweight services like local streaming.
- Raspberry Pi 4 and Raspberry Pi 3: two Home Assistant instances, each with their own Zigbee network. The separation is necessary because my outbuilding (studio/office) is too far from the house for a single Zigbee network. A third Home Assistant is planned for the garages, facing the same distance issue.
- Raspberry Pi 5: three critical roles in a single machine. It serves as the Nginx reverse proxy for the entire infrastructure (sole entry point, ports 80 and 443), the local bastion for SSH access to internal machines, and the WireGuard VPN server for applications accessible only via a local IP.
Bastions and External Access
Two IONOS VPS servers complete the infrastructure:
- The first serves as an external bastion: entry point for all SSH connections from outside. To access the Mac mini from my MacBook Air while traveling, the connection goes through a double proxy jump — first the IONOS VPS, then the local bastion (RPi 5), before reaching the target machine.
- The second is entirely dedicated to Vaultwarden (password manager), isolated from the rest of the infrastructure as a security choice.
Network Architecture
Only ports 80 and 443 are open on my router, redirected to the Raspberry Pi 5's reverse proxy. Subdomains are configured at domain name providers to point to the router's IP, then the Nginx reverse proxy routes to internal services. TLS certificates are managed and renewed automatically.
Home Automation
For three years, I've been accumulating consumption and event data through Home Assistant. Automation covers lighting, alarm, heating, and other equipment.
Planned Evolutions
The infrastructure is constantly evolving. Upcoming projects include: setting up a video surveillance system for outdoor areas, installing a managed switch with separate VLANs, adding solar panels and air conditioning integrated into the home automation system, and most importantly an AI-powered decision pipeline fed by three years of accumulated data, capable of automatically optimizing energy consumption.
