ROUTINE / HIGH-VOLUME → EFFICIENT TIER
Triage, health sweeps, maintenance checks, cleanup, notifications, and other scheduled workflows use efficient models with scoped permissions.
AI HOMELAB — ENGINEERING DEEP DIVE
Five AI agents operating a private, self-hosted cloud.
One Ubuntu host runs the core services. Two gateways coordinate five purpose-built agents with separate roles, model tiers, and permissions. Family and friends use the services; the operational complexity stays behind the interface.
Snapshot updated
- active containers
- 21
- AI agents
- 5
- forwarded router ports
- 0
- active health checks
- 31
- agent gateways
- 2
- % uptime · 90d
- 99.9
CH. 01
Five agents. Distinct roles. Explicit boundaries.
The Operations Relay handles routing and schedules; the Inference Relay handles stronger reasoning tasks. Each agent receives only the tools and permissions its role requires.
▸ CLICK AN AGENT TO OPEN ITS DOSSIER
⬢ FLEET COREUbuntu · one box, every service
CH. 02
Use stronger models where the risk justifies them.
Routine, high-volume automation uses efficient open-weight models. Frontier-class models are reserved for complex engineering, security-sensitive work, and analysis that benefits from deeper reasoning.
COMPLEX / HIGH-TRUST → FRONTIER TIER
Infrastructure changes, security-sensitive operations, complex coding, and research analysis are routed to stronger models and require higher-trust tools.
CH. 03
Outbound-only access, with no forwarded router ports.
Public-facing access travels through Cloudflare Tunnel. Administrative access uses restricted SSO or an encrypted Tailscale mesh.
01 · FAMILY & FRIENDS PATH
Cloudflare Tunnel provides outbound-only access with WAF and TLS, without exposing router ports.
02 · ADMIN PATH
Cloudflare Access with a restricted Google SSO allow-list, or an encrypted Tailscale mesh.
03 · HOST CONTROLS
Zero forwarded router ports, fail2ban active, and sensitive files restricted through host permissions.
CH. 04
A request becomes an automated media workflow.
The pipeline coordinates request intake, search, download, subtitles, import, and playback without requiring each user to understand the services underneath.
- 01
Request
Jellyseerr · family portal
- 02
Match + grab
Sonarr / Radarr
- 03
Search
Prowlarr · 6 indexers
- 04
Download
encrypted client
- 05
Subtitles
Bazarr
- 06
On screen
Jellyfin · refresh after import
CH. 05
System map and operating surface.
AI OPERATIONS
- Inference Relay
- Operations Relay
- Bibi · engineer
- Hermy · router
- Buggy · watchdog
- Trader · research
- Triply · fare scout
EDGE / NETWORK
- Cloudflare Tunnel
- Cloudflare Access
- Tailscale mesh
- fail2ban
MEDIA & PHOTOS
- Jellyfin
- Immich · AI photo search
- Jellyseerr
AUTOMATION
- Sonarr
- Radarr
- Prowlarr
- Bazarr
- media automation (*arr stack)
- FlareSolverr
SECURITY
- Vaultwarden
- Cloudflare WAF
- Google SSO
- forced encryption
OPERATIONS
- Uptime Kuma · 31 health checks
- Homarr dashboard
- Komodo · Docker UI
- restic backups · 7d/4w/6m
CH. 06
Engineering decisions.
Multi-agent orchestration
Five agents have distinct responsibilities and permission boundaries, coordinated across two gateways.
Hybrid RAG memory
Each agent remembers its own past work and nothing of anyone else's. A lookup runs two searches at once - one on meaning, one on exact wording - so a question finds the right note whether it repeats the original phrasing or not. Around 799 notes are indexed, and the embeddings are computed on the host, so operational memory never leaves the network. Built on sqlite-vec and SQLite FTS5 with a local EmbeddingGemma model.
Tiered model routing
Efficient open-weight models handle routine automation; frontier-class models are reserved for engineering and analysis that need stronger reasoning.
Zero-trust networking
No forwarded router ports. Access uses outbound-only tunnels, restricted SSO, or an encrypted mesh.
Always-on observability
Uptime Kuma runs 31 active health checks while the watchdog summarizes abnormal results and routes them for review. Health sweeps, maintenance checks, and research summaries run on defined schedules with scoped permissions.
Backed up & recoverable
Nightly restic snapshots use 7-day, 4-week, and 6-month retention with scheduled integrity checks.
CH. 07
Technology stack.
AI / ORCHESTRATION
- Inference Relay
- Operations Relay
- Frontier + open-weight model tiers
- Model router
- MCP tools
- Scheduled automation
- Hybrid RAG memory
- EmbeddingGemma embeddings
- sqlite-vec
- FTS5 BM25
INFRASTRUCTURE & NETWORKING
- Docker Compose
- Ubuntu Linux
- Cloudflare Zero Trust
- Tailscale
- Komodo
- Nginx
- fail2ban
SELF-HOSTED SERVICES
- Jellyfin
- Immich
- Vaultwarden
- Prowlarr
- Sonarr
- Radarr
- Bazarr
- Jellyseerr
- Uptime Kuma
- Homarr