Spectre, a self-hosted everything

An HP laptop that stopped being a laptop and became the family infrastructure: media server, photo library, password manager, document archive, ebook library, and an offline copy of Wikipedia, all self-hosted on Arch Linux and Docker. Twenty-nine containers, zero restart loops, no subscription renewals, and nothing reachable from the public internet.

The design

Every service sits behind Tailscale with per-service HTTPS. Download traffic is pinned inside a VPN tunnel that fails closed, and I verified the isolation by checking egress IPs rather than trusting the config. Backups are layered: nightly local mirrors with database dumps, versioned document history, and an encrypted offsite set.

The moment it broke

This year I ran a full adversarial audit of my own stack: parallel inspectors combing containers, permissions, backups, and network exposure, with findings verified before they counted. It found real problems. A malicious torrent was quietly seeding from the media stack. Secrets sat world-readable on disk. And the nightly backup script reported success while silently skipping failures, which is worse than no backup because it buys false confidence. Those three were fixed the same day: the torrent killed, permissions locked to 600, the script rewritten to check every exit code and say so when things fail. The rest of what the audit turned up became a follow-up list, some of it closed over the next two days, some of it still open, which is the honest shape of any real audit. The audit itself became a repeatable practice rather than a one-off scare.

What it demonstrates

Operations discipline applied at home: defense in depth, backup strategy that assumes failure, and the willingness to audit your own work like a hostile stranger would. Self-hosting is my proving ground for owning systems end to end.