Capability · infrastructure

Self-hosted infrastructure lab

Active

Where I run, break and fix real infrastructure — around thirty containerised services behind a single reverse proxy.

UbuntuDockerTraefikAuthentikCrowdSecGitea CI

What it is

An Ubuntu 24.04 server running around thirty Docker services behind a Traefik reverse proxy, with single sign-on, an intrusion-prevention layer, DNS filtering and a full CI/CD setup. It’s where I get ongoing, hands-on practice with deployment, security and real-world operations — including the self-hosted Gitea instance and runner that build and deploy this very portfolio.

How it fits together

  • Traefik terminates TLS and routes every service, fronted by Cloudflare, with separate internal and external entrypoints and HTTP/3.
  • Authentik provides single sign-on as a Traefik forward-auth middleware in front of internal tools; CrowdSec adds intrusion prevention and Pi-hole handles DNS filtering.
  • Gitea and a Gitea Actions runner give me self-hosted git and CI/CD — the build-and-deploy target for this site.
  • The Docker socket is exposed to Traefik only through a hardened socket-proxy, and each application runs on its own isolated Docker network.
  • Portainer and Dozzle handle container management and logs; alongside these run application, media and utility stacks.
Homelab topology Traffic arrives through Cloudflare to a Traefik reverse proxy that terminates TLS and applies Authentik single sign-on, then routes to self-hosted services: Gitea and its CI runner, application containers, and a media stack. auth Cloudflare DNS · edge · WAF Traefik reverse proxy · TLS Authentik SSO · forward-auth Gitea + runner self-hosted git · CI/CD App containers JobTrack · this site Media stack Jellyfin · *arr

What’s next

Retiring the legacy WordPress site now that this portfolio replaces it, then tightening backup verification and expanding automated health checks and alerting across the stack.