dehlwes logo medium
the system · 01 · homelab

The machines.

Everything I run, this site included, lives on hardware I own, plus one small rented edge in the cloud. A small fleet, meshed into one private network, operated as one system, and split into clear trust zones.

nexus nodes + public edges
3+2
live app releases
47
storage pool
8 TB
open ports at home
0
unsupervised nexus actions / yr
13k
nexus fleet · on the tailnet

The nodes that carry the platform. Each hangs in the Nexus system and joins the private mesh, governed, observable, reachable from anywhere.

  • Mac mini M4

    Always-on core & edge
    Apple M432 GBDocker/ColimaTailscale exit node
    ● 24/7

  • Workstation

    GPU node · CAD & gaming
    i5-13600KFRTX 4070 · 12 GB32 GBWindows + Linux (WSL)Sunshine streaming
    ● online

  • Laptop

    Mobile GPU node
    Ryzen 7 5800HRTX 3060 · 6 GB16 GBWindows + Linux (WSL)GPU builds
    ● online

  • NVIDIA DGX Spark

    AI node · local inference & fine-tuning
    GB10 Grace Blackwell128 GB unified1 PFLOP FP4
    ◌ planned 2026
public edge · the public face

What the internet actually reaches. One small rented box off-site holds the only public address; the Mac mini at home serves through it over WireGuard, so nothing here ever listens on an open port.

  • Hetzner Cloud

    Public edge · hosts the deployed sites & services
    4 vCPU8 GB RAM40 GB SSD
    ● 24/7

  • Mac mini M4

    Public node · serve only, at home behind the edge
    Apple M416 GB256 GB SSDWireGuard → Hetzner
    ● serve only
work devices · users on the mesh

These join the tailnet as user devices, not fleet, they operate the system; the system doesn't run on them.

  • MacBook M5

    Daily driver
    Apple M5develops against the fleet
    ● daily

  • iPhone

    Pocket operator
    mesh accessapprovals on the go
    ● daily
off the mesh · by design

Storage never joins the tailnet: LAN-only, out of reach even if the mesh were ever compromised. Security by separation.

  • Synology DS220+

    Storage & backup
    8 TBRAID 1snapshotsHyper Backup
    ● 24/7 · lan only

  • Synology RS1221+

    Storage expansion
    8-bay rackmountup to 128 TBECC2× 10 GbE
    ◌ planned 2026
the mesh

No open ports at home.

The fleet joins a private WireGuard mesh via Tailscale, no public ingress at home; the rented box holds the only public address, and the serve-only Mac mini reaches it over WireGuard. My work devices sit on the same tailnet, but as users, not infrastructure: they operate the system, nothing runs on them. And the NAS never joins the mesh at all, LAN-only by design, so backups stay out of reach even if a node were ever compromised. AI agents reach the fleet the same way I do: through one governed surface.

tailnet · fully meshedpublicworkstationmac mini · corelaptopmac mini · edgeserve onlymacbook · iphoneoperatorshetznerrented edgenaslan only
one network · five tailnet peers fully meshed, one way in, the nas on lan only
a normal day
  1. 01

    Connect once

    A single Tailscale login gives me every machine from anywhere, no VPN config, no port forwarding.

  2. 02

    Develop on the Mac mini

    VS Code Remote-SSH into the always-on core: containers, databases and builds run server-side at full power.

  3. 03

    Stream the GPU

    SolidWorks, Blender and games run on the workstation's RTX 4070 and stream to whatever screen I'm on via Sunshine/Moonlight.

  4. 04

    Storage stays home

    The NAS holds files, versions and backups, deliberately off the mesh, reachable only on the home network.

$ ssh luis@mac-mini.tailnet
$ docker compose up -d
$ moonlight stream workstation.tailnet
# any device, anywhere, same three commands
what running it taught me

Mesh beats VPN

Peer-to-peer WireGuard connections feel near-local, no central bottleneck.

Separate compute from storage

Databases live on compute nodes; the NAS does backup and media.

Automate everything

Monitoring, backups and updates run themselves, the lab can't depend on me remembering.

The quiet core wins

A fanless-quiet M4 that never sleeps turned out to be the most valuable machine in the house.

next · 02
Deployment Engine
the platform