The Motivation: Security by Design
The goal was never to spin up a few Docker containers to see if they worked. It was to build a self-hosted environment with genuine security and modularity baked in from the start. A foundation where I could host websites, automate workflows, and track analytics whilst maintaining absolute ownership of the data and iron clad control over the network perimeter.
The Architecture: Secure Ingress & Isolation
The core philosophy is Zero Trust. The host server operates with no open inbound ports to the public internet. External traffic routes through a Cloudflare Tunnel into an internal Nginx reverse proxy, which handles SSL termination and directs traffic across an isolated Docker bridge network. If a service does not have an explicit proxy rule, it is completely invisible to the outside world.
Services are deliberately decoupled. Rather than bundling databases into individual application stacks, a standalone master PostgreSQL server sits at the centre. Applications like n8n for workflow automation and Umami for privacy-first, cookie-free analytics connect to it internally, which makes for cleaner backups, easier resource management, and faster deployment of anything new.
Network Filtering & Privacy
OPNsense handles the firewall and packet inspection, but the unsung hero of this layer is AdGuard. It runs as a network-wide DNS sinkhole, meaning every device on the network benefits from aggressive ad and tracker blocking without touching a single browser extension. It also makes blocking TikTok for the kids trivially easy. One rule, network-wide, done. I cannot overstate how much peace that has bought me.
The OpenClaw Environment
Sitting in complete isolation is a dedicated Debian instance running OpenClaw. It has its own contained environment, its own resource limits, and a clear mandate: go nuts, within API sending limits. It is the part of the infrastructure I trust least and therefore sandbox the most.
Sharing the Knowledge
Building this meant working through some genuinely awkward problems around Linux permissions, Docker networking, and DNS routing. This project page will grow over time, linking out to guides, blog posts, and technical breakdowns as they are published. The aim is to strip out the private configuration details and focus on the underlying concepts: securely exposing a local service via Cloudflare, decoupling a database layer, or routing websockets through Nginx. The blueprints will be here. The pitfalls are already paid for.