ROUTINE / HIGH-VOLUME → EFFICIENT TIER
Triage, health sweeps, maintenance checks, cleanup, notifications, and other scheduled workflows use efficient models with scoped permissions.
AI HOMELAB — ENGINEERING DEEP DIVE
Four AI agents operating a private, self-hosted cloud.
One Ubuntu host runs the core services. Two gateways coordinate four purpose-built agents with separate roles, model tiers, and permissions. Family and friends use the services; the operational complexity stays behind the interface.
Snapshot updated
- active containers
- 21
- AI agents
- 4
- forwarded router ports
- 0
- active health checks
- 31
- agent gateways
- 2
- % uptime · 90d
- 99.9
CH. 01
Four agents. Distinct roles. Explicit boundaries.
The Operations Relay handles routing and schedules; the Inference Relay handles stronger reasoning tasks. Each agent receives only the tools and permissions its role requires.
▸ CLICK AN AGENT TO OPEN ITS DOSSIER
⬢ FLEET COREUbuntu · one box, every service
CH. 02
Use stronger models where the risk justifies them.
Routine, high-volume automation uses efficient open-weight models. Frontier-class models are reserved for complex engineering, security-sensitive work, and analysis that benefits from deeper reasoning.
COMPLEX / HIGH-TRUST → FRONTIER TIER
Infrastructure changes, security-sensitive operations, complex coding, and research analysis are routed to stronger models and require higher-trust tools.
CH. 03
Outbound-only access, with no forwarded router ports.
Public-facing access travels through Cloudflare Tunnel. Administrative access uses restricted SSO or an encrypted Tailscale mesh.
01 · FAMILY & FRIENDS PATH
Cloudflare Tunnel provides outbound-only access with WAF and TLS, without exposing router ports.
02 · ADMIN PATH
Cloudflare Access with a restricted Google SSO allow-list, or an encrypted Tailscale mesh.
03 · HOST CONTROLS
Zero forwarded router ports, fail2ban active, and sensitive files restricted through host permissions.
CH. 04
A request becomes an automated media workflow.
The pipeline coordinates request intake, search, download, subtitles, import, and playback without requiring each user to understand the services underneath.
- 01
Request
Jellyseerr · family portal
- 02
Match + grab
Sonarr / Radarr
- 03
Search
Prowlarr · 6 indexers
- 04
Download
encrypted client
- 05
Subtitles
Bazarr
- 06
On screen
Jellyfin · refresh after import
CH. 05
System map and operating surface.
AI OPERATIONS
- Inference Relay
- Operations Relay
- Bibi · engineer
- Hermy · router
- Buggy · watchdog
- Trader · research
EDGE / NETWORK
- Cloudflare Tunnel
- Cloudflare Access
- Tailscale mesh
- fail2ban
MEDIA & PHOTOS
- Jellyfin
- Immich · AI photo search
- Jellyseerr
AUTOMATION
- Sonarr
- Radarr
- Prowlarr
- Bazarr
- media automation (*arr stack)
- FlareSolverr
SECURITY
- Vaultwarden
- Cloudflare WAF
- Google SSO
- forced encryption
OPERATIONS
- Uptime Kuma · 31 health checks
- Homarr dashboard
- Komodo · Docker UI
- restic backups · 7d/4w/6m
CH. 06
Engineering decisions.
Multi-agent orchestration
Four agents have distinct responsibilities and permission boundaries, coordinated across two gateways.
Tiered model routing
Efficient open-weight models handle routine automation; frontier-class models are reserved for engineering and analysis that need stronger reasoning.
Zero-trust networking
No forwarded router ports. Access uses outbound-only tunnels, restricted SSO, or an encrypted mesh.
Always-on observability
Uptime Kuma runs 31 active health checks, while the watchdog summarizes abnormal results and routes them for review.
Scheduled autonomy
Health sweeps, maintenance checks, and research summaries run on defined schedules with scoped permissions.
Backed up & recoverable
Nightly restic snapshots use 7-day, 4-week, and 6-month retention with scheduled integrity checks.
CH. 07
Technology stack.
AI / ORCHESTRATION
- Inference Relay
- Operations Relay
- Frontier + open-weight model tiers
- Model router
- MCP tools
- Scheduled automation
INFRASTRUCTURE & NETWORKING
- Docker Compose
- Ubuntu Linux
- Cloudflare Zero Trust
- Tailscale
- Komodo
- Nginx
- fail2ban
SELF-HOSTED SERVICES
- Jellyfin
- Immich
- Vaultwarden
- Prowlarr
- Sonarr
- Radarr
- Bazarr
- Jellyseerr
- Uptime Kuma
- Homarr