Selected Work / Infrastructure
Personal Homelab
Self-hosted media and services on my own hardware, reachable from anywhere but exposed to no one.
A Minisforum Venus Series machine running Ubuntu hosts Jellyfin and Navidrome behind a Caddy reverse proxy. Everything sits on a Tailscale tailnet: the services bind only to the tailnet address, so they are unreachable from the public internet and from the local network alike.
Certificates are real rather than self-signed. Caddy proves domain ownership through DNS, which means trusted TLS on hostnames that nothing outside the tailnet can even connect to — no port forwarding, no exposed home address.
Media traffic deliberately never touches a CDN. Video streaming through a general-purpose CDN violates most free-tier terms, and the same account serves this website, so the two are kept strictly apart.