itzcelyrian@nexus ~ ❯ ./whoami
Hey, I'm Celyrian
I run my own corner of the internet. Mail, DNS, git, identity, media, this site: all self-hosted on my own hardware. Self-taught over ten-plus years of breaking Linux and rebuilding it better.
01 / whoami
The short version
Self-taught systems engineer who likes operations and security boundaries: containerized deployments, hardened edges, identity and certificates, storage that doesn't lose data.
Ship it, repeatably
GitOps deployment automation. The repo is the source of truth; disk drift gets reconciled away.
Least privilege
Zero-trust edges, scoped tokens, identity and certificates done properly.
Boring on purpose
Reliable infrastructure and boring fixes: the kind of uptime you can forget about.
02 / what I run
The machine room
One Debian compute server and a TrueNAS storage box. Almost everything is a Docker container, deployed by Arcane over GitOps. This is what happens when you open one of my subdomains:
anatomy of a request
you ❯ https://celyrian.com
this very page, same as every public subdomain. DNS points at the edge, never at home
Pangolin edge · Hetzner VPS
Traefik terminates TLS, SSO gates the private apps. The only machine the internet ever sees.
WireGuard tunnel · Gerbil ❯ Newt
dialed outbound from home. Nothing listens on the router, the home IP is in no public record.
home · Debian 13 Trixie
UFW default-deny, every stack composed from a Gitea repo. Disk drift gets reconciled away.
the container answers
response rides the same tunnel back out. Round trip, zero exposure.
service catalogue · 25 self-hosted, many behind Pangolin SSO
03 / experience --sorted
Where the hours went
One cell per year, the row caps at ten.
04 / stack --all
The toolbox
A + means it joined the toolbox within the last year.
// edge · mesh · security
// identity · data · observability
05 / infrastructure --status
Four machines
Three boxes at home plus a Hetzner VPS at the edge. Forty-odd containers, and everything public rides the self-hosted Pangolin tunnel on that VPS.
Compute Server
- OS
- Debian 13 Trixie
- CPU
- Ryzen 9 3950X
- GPU
- RTX 4060
- RAM
- 128 GB DDR4
NAS Server
- OS
- TrueNAS 24.04
- CPU
- Celeron N5095
- Pool
- 8×12 TB IronWolf
- RAID
- RAIDZ3
Nexus
- OS
- CachyOS
- CPU
- Ryzen 7 5700X
- GPU
- RTX 3090
- WM
- Hyprland
Proxy
- OS
- Debian 13 Trixie
- CPU
- 2 vCPU · Xeon
- RAM
- 4 GB
- Runs
- Pangolin
06 / desktop --history
Rice history
Four years of Hyprland on CachyOS. Scroll to cycle through the builds, or drag.
07 / ./say-hi
Let's talk
Homelab war stories, security questions, or just to say hi. All welcome.