Uses
What I run, and what runs while I'm asleep.
An honest inventory rather than an aspirational one. The homelab exists mostly to give long-running jobs — increasingly, coding agents — somewhere to live that isn't my laptop.
Homelab
hostAn M4 Mac Mini running OrbStack. Quiet, sips power, and handles everything I ask of it.
orchestrationDocker Compose, split into stacks by function rather than one enormous file. Deploys are a git pull and a script.
storageSynology NAS over NFS. A launchd agent mounts it at boot and drops a sentinel file so nothing starts against an empty mountpoint.
proxyCaddy, reverse-proxying every service to a .lan hostname so I am not memorizing port numbers.
monitoringTelegraf into InfluxDB, drawn by Grafana — host, container, and NAS metrics. Telegraf runs natively rather than in a container, so it reports the real host instead of the OrbStack VM.
backupsNightly launchd agents. SQLite databases snapshot with VACUUM INTO, get an integrity check, land on the NAS, and prune after 30 days.
exposureNone. LAN or home VPN only. Unauthenticated internal tools do not get public addresses.
Agents
runtimeHerdr — keeps agent terminal sessions alive across machines so work continues after I close the laptop.
agentsClaude Code, mostly. The value is in long-running unattended tasks, not autocomplete.
isolationEach agent gets its own git worktree and container. Nothing touches main without review.
reviewEverything an agent produces goes through the same pull request process as anything I write.
Development
gitdelta as the pager, diff3 conflict style, and a `git fix` alias that opens every conflicted file at once.
languagesElixir and Ruby day to day. Python for anything throwaway.
runtime managementmise and asdf, depending on the project. Every codebase disagrees about which Erlang it wants.
containersDocker and Compose for local services and for anything that needs to run the same way twice.
Security tooling
static analysisBrakeman and bundler-audit in CI on every Rails project, plus Sobelow for Phoenix.
proxyingBurp Suite and mitmproxy for anything that speaks HTTP and shouldn’t.
reversingGhidra, plus the usual collection of one-off scripts.
secret scanninggitleaks, in CI and as a pre-commit hook. Catching a credential before it is committed is the only cheap time to catch one — after it lands, rewriting history is the good outcome.
credentialsA password manager and hardware keys. No secrets in the repo, which I learned the hard way.
This site
generatorAstro, with content collections for posts.
hostingCloudflare Pages. Static output, no server to patch.
typeIBM Plex Mono and Public Sans, self-hosted — no third-party font requests.
analyticsNone.