Where the build actually is, as opposed to where the documentation says it should be. Updated as things change; last revised 28 July 2026.
The honest summary: one machine out of roughly two dozen is doing real work. The design is far ahead of the deployment, which is a problem this project is aware of and writing about rather than hiding.
Live
The US gateway VPS — tier 1, the public edge. Running and carrying real traffic:
| Component | State |
|---|---|
| Hardened SSH (key-only, non-default port) | Live, verified |
| Firewall ruleset | Live, verified across reboots |
| Caddy with real Let’s Encrypt certificates | Live, via DNS challenge |
| Edge intrusion detection and blocking | Live, verified |
| Dynamic home-address tracking for tunnel rules | Live, verified |
| WireGuard (server side) | Live, no peers enrolled yet |
| Mesh coordination service | Live |
| Notification service | Live |
| Uptime monitoring | Live |
That last group went in on 28 July and matters more than it looks: the mesh coordinator is a prerequisite for any VM joining the private network, so its being live unblocks the entire VM tier.
In progress
- The tunnel back to home. Blocked on the home-side gateway VM, which cannot exist until there is a hypervisor to run it on. Three defects are already known in that runbook section, found by reading rather than by running.
- A real fully-qualified name for the mail server. The gateway’s hostname was set correctly, but the change left it without a proper domain-qualified name. Nothing currently cares. The mail server will, so it needs deciding before that runbook starts.
Not started
- The standby gateway in Europe. Its runbook is written and carries every correction learned on the primary. Nothing has been provisioned.
- All physical hardware. The hypervisors, the storage tier, and the witness node are specified in detail and not yet racked. The architecture describes an intended end state, not a room.
- Every service VM. Sixteen of them, zero built.
Proven on test hardware, not yet in production
Not deployed, but no longer theoretical. The automation for the VM baseline, log shipping, and the security monitoring stack has been executed against throwaway virtual machines and verified on the running result rather than from the automation’s own self-report.
That distinction earned its keep. Running the code found defects that four separate document reviews had missed entirely — including one case where the stated mitigation for a known vulnerability did not actually hold, and several where a verification step was structurally incapable of failing.
The gap, stated plainly
Roughly forty runbooks exist. Eight sections of one of them have been fully executed on a real host.
Every review pass, every new design document, and every good idea added to the backlog widens that gap. The gap — not any missing feature — is the actual risk to this project.
There is now a rule about it: new ideas get one paragraph in a backlog file and nothing else until the current tier is running. An idea earns its way out only if deferring it would make some decision expensive to reverse later. Two have qualified so far, and neither was a feature — both were addressing decisions that become costly once hardware is physically installed.
What comes next
- Finish the remaining sections of the primary gateway runbook.
- Rack and configure the hypervisor cluster and storage.
- Build the home-side gateway VM and complete the tunnel.
- Identity tier — because nothing above it can be built first.
Progress against this list is what the status updates cover.
Full component inventory
Everything in the design, with an honest status against each. The three values mean specific things:
- Complete — deployed and verified on the running system, not inferred from a config file. This site has written at length about why that distinction matters.
- In progress — partially deployed, or proven on throwaway test hardware but not yet running anywhere permanent.
- Not started — designed and documented, nothing built.
Note how much sits in the third column. That gap is the point.
Public edge
| Component | Purpose | Status |
|---|---|---|
| Hardened SSH | Key-only remote access | Complete |
| nftables firewall | Packet filtering, survives reboot | Complete |
| Caddy | Reverse proxy, TLS termination | Complete |
| Let’s Encrypt via DNS challenge | Real certificates, including internal-only names | Complete |
| CrowdSec | Edge intrusion detection and blocking | Complete |
| Dynamic egress-IP tracking | Keeps tunnel rules following a changing home IP | Complete |
| Headscale | Mesh VPN coordination | Complete |
| ntfy | Push notifications for alerts | Complete |
| Uptime Kuma | External availability monitoring | Complete |
| WireGuard | VPN — server deployed, no peers enrolled | In progress |
| Rathole tunnel | Inbound relay to the home network | Not started |
| Standby gateway (EU) | Failover target | Not started |
| DNS failover automation | Health-checked cutover, ~90s recovery | Not started |
Core infrastructure
| Component | Purpose | Status |
|---|---|---|
| VM baseline automation | Common build for every VM — proven on test hardware only | In progress |
| Proxmox cluster | Two-node hypervisor with HA | Not started |
| Quorum witness | Third vote, breaks cluster ties | Not started |
| ZFS integrity tier | Checksummed storage for small, precious data | Not started |
| BTRFS bulk tier | Capacity storage for media and models | Not started |
| Unbound | Internal DNS, redundant pair | Not started |
| Home-side gateway VM | Terminates the tunnel inside the network | Not started |
Identity and secrets
| Component | Purpose | Status |
|---|---|---|
| Authentik | Single sign-on for every service | Not started |
| Vaultwarden | Shared and machine secrets | Not started |
Files and productivity
| Component | Purpose | Status |
|---|---|---|
| Nextcloud | File sync and sharing | Not started |
| Outline | Notes and internal wiki | Not started |
| Linkwarden | Bookmark archive | Not started |
| Snappymail | Webmail client | Not started |
| Paperless-ngx | Document scanning, OCR, archive | Not started |
| Firefly III | Personal finance | Not started |
| n8n | Workflow automation | Not started |
| FreshRSS | News reader | Not started |
| Component | Purpose | Status |
|---|---|---|
| Stalwart | Mail server | Not started |
| rspamd + ClamAV | Spam and malware filtering | Not started |
| Mail backup and archive pipeline | Long-term retention | Not started |
Media
| Component | Purpose | Status |
|---|---|---|
| Immich | Photo library with local ML | Not started |
| Jellyfin | Media streaming | Not started |
| Audiobookshelf | Audiobooks and podcasts | Not started |
| Curated photo sharing | Second, public-facing photo instance | Not started |
Communications
| Component | Purpose | Status |
|---|---|---|
| FreePBX / Asterisk | Phone system | Not started |
| SMS bridge | Messaging integration | Not started |
| LAN-only SMS alert gateway | Critical alerts that survive an internet outage | Not started |
| SMS query gateway | Conversational status queries | Not started |
Development
| Component | Purpose | Status |
|---|---|---|
| Forgejo | Git hosting | Not started |
| Woodpecker CI | Build automation on an isolated VLAN | Not started |
| Zot | Container registry | Not started |
| Dependency-Track | SBOM and vulnerability tracking | Not started |
| Syft + Grype | SBOM generation and scanning | Not started |
| devpi / Verdaccio | Package proxies | Not started |
AI
| Component | Purpose | Status |
|---|---|---|
| Ollama | Local language model runtime | Not started |
| Open WebUI | Chat interface | Not started |
| LLM gateway | Complexity-tiered routing, per-service keys | Not started |
| Voice pipeline | Local speech-to-text and text-to-speech | Not started |
| GPU tier | Card not yet selected | Not started |
Observability and security
| Component | Purpose | Status |
|---|---|---|
| Loki + Alloy | Log aggregation — proven on test hardware only | In progress |
| Wazuh | Security monitoring — proven on test hardware only | In progress |
| Prometheus | Metrics collection | Not started |
| Grafana | Dashboards and alerting | Not started |
| Blackbox exporter | Certificate expiry and endpoint checks | Not started |
| Disk and hardware health monitoring | Physical-layer alerting | Not started |
Operations
| Component | Purpose | Status |
|---|---|---|
| Ansible automation | Configuration management | In progress |
| Offsite backup chain | Encrypted, offsite copies | Not started |
| Restore procedures | Tested restores, not just backups | Not started |
| Maintenance playbook | Patching and routine operations | Not started |
Nine components complete. Five in progress. Forty-eight not started.
Every one of those forty-eight has a written runbook behind it. None of that counts for anything until it runs, which is the recurring theme here and the subject of the first post.