Selfhosted

To become independent, you don't have to ask for independence. To become independent you have to be independent.

This is the story of how I am slowly becoming independent. Disclaimer: If you don't understand anything, that's fine. I created this documentation for myself.

Why am I doing this

My name is Francisco, in french it means "free person" . Some people in life want performance, some other want reliability. The only thing I care about is freedom. To do what I want, when I want and how I want to.

Current infrastructure

Server: Intel NUC 11, 16 GB RAM, 1 TB NVMe. Ubuntu Server. Connected via 1 Gbps symmetric FTTH (dynamic IP). The Razer Core X eGPU is used as a job session, not always-on: long continuous attach (including idle) has hard-hung the host. Power it for Whisper/TTS/ComfyUI work, then power it off and reboot; see GPU services / eGPU sessions and GPU setup.

NUC Tailscale (verified 2026-10-08): thebeachlab joined the GitHub tailnet thebeachlab.github, replacing its previous client login to Headscale at https://hs.beachlab.org. Its control server is now https://controlplane.tailscale.com, MagicDNS name nuc.tail520737.ts.net, and IPv4 address 100.91.63.61. tailscaled is enabled and active. The 192.168.1.0/24 subnet advertisement was removed with sudo tailscale set --advertise-routes=; the NUC now advertises no subnet routes. Access the NUC using its Tailscale address. Source: live NUC tailscale status --json, tailscale debug prefs, systemctl is-enabled tailscaled, and systemctl is-active tailscaled; Mac tailscale ping 100.91.63.61 and successful OpenSSH access to 100.91.63.61:622 with the existing host key.

RPi 5 (pibot1): Mounted in the G Mobile Lab (vehicle). Runs Bluetti BLE bridge, I2C sensors (CO2, temp, humidity, pressure), GPS NEO-6M, IMU MPU-6050, and Starlink gRPC telemetry. Connects to server via Starlink + Tailscale.

NAS: Synology DS411slim, DSM 6.2.4-25556 Update 8. See NAS access and Tailscale compatibility for the verified configuration and the legacy kernel's package requirements.

Previous servers (non-operational):

• Suitcase — 2015 Skylake i3-6100, 8 GB RAM, 500 GB SSD
• Sister — X79 Xeon E5-2670 v2 (10c/20t), 40 GB RAM, 1 TB NVMe

TOC

Server setup

• Getting started
• Securing SSH access
• Backups
• Web server (Nginx)
• Passkey access (Authentik)
• Service administration
• Git server
• SFTP server
• VPN Server (OpenVPN)
• WireGuard VPN
• Server Safeguards (resource limits + alerts)
• Troubleshooting

Services

• Msgvault communications archive
• Taskwarrior and Nextcloud Tasks sync
• Transmission Daemon (NordVPN)
• Mumble voice server
• iOS Push Notifications (iGotify)
• Drop (protected URL downloads)
• Remote browser
• n8n automation (removed)
• Auto USB copy
• Node.js / PM2
• OpenClaw TUI Quick Access (tmux)
• OpenClaw runtime maintenance

Monitoring

• Grafana (TimescaleDB dashboards)

IoT and telemetry

• IoT (Mosquitto MQTT)
• MQTT Telemetry — server stats (alpha/stats)
• MQTT to TimescaleDB and PostgREST
• Bluetti Mobile Lab telemetry pipeline
• Raspberry Pi 5 (pibot1)

Databases and APIs

• PostgreSQL
  • TimescaleDB
  • Strapi CMS
  • PostgREST API
  • PostgREST JWT Gateway

AI and GPU

• Knowledge graphs and agent loops (WIP)
  • Obsidian
  • LangGraph
  • Graphiti
  • Neo4j Community and Browser
  • Graph tools
• GPU setup
• GPU Service Management (on-demand Whisper/RAG/TTS)
• Whisper Web (protected upload + diarization)
• eBook RAG (SFTP Inbox)
• Qwen3-TTS Voice Cloning (multilingual)
• ComfyUI (Stable Diffusion node editor)
• Hailo AI dataflow compiler

WIP / archived

• Understanding DNS (WIP)
• OBS ninja (WebRTC) (WIP)
• STUN/TURN Server (WIP)
• Minecraft server
• Nextcloud
• Mail server (Postfix) (incomplete)
• openHAB (BTicino/OpenWebNet and Apple Home)