daran@homeserver:~

ssh daran@homeserver

Everything on this site runs on hardware I own and operate. Not because a VPS is expensive — because operating your own production infrastructure teaches you things a deploy button never will.

daran@homeserver:~$ cat architecture.txt

                      internet
                          |
           cloudflare tunnel (zero open ports)
                          |
 +------------------------+-------------------------+
 |       home server · ubuntu · docker compose      |
 |                                                  |
 |  +---------+  +-----------+  +----------------+  |
 |  |   n8n   |  |   WAHA    |  |  pcm services  |  |
 |  | (orch.) |  |(whatsapp) |  | (session mgr + |  |
 |  |         |  |           |  |  status page)  |  |
 |  +----+----+  +-----------+  +----------------+  |
 |       |                                          |
 |  +----+-------+  +--------------+  +----------+  |
 |  |  softlife  |  | cctv-watcher |  |   ntfy   |  |
 |  |  pipeline  |  |   (paused)   |  |  alerts  |  |
 |  +----+-------+  +--------------+  +----------+  |
 +-------+------------------------------------------+
         | tailscale + ssh (cross-subnet)
 +-------+---------+      +----------------------+
 | windows machine |      |  external free tiers |
 | (softlife       |      |  supabase · sheets · |
 |  pharmacy app)  |      |  gemini · telegram   |
 +-----------------+      +----------------------+

Why self-host

Three reasons. First, cost: every system I run is on the machine's fixed power bill — GodFather runs at $0/month on free API tiers. Second, constraints breed better engineering: a low-spec box forced choices like WAHA's NOWEB engine (~40MB RAM, no Chromium) over browser-based WhatsApp libraries. Third, it's honest: "production" means something when a real pharmacy's daily workflow depends on your uptime, not a demo that lives in a slide deck.

Security posture

Zero port forwarding — all public ingress goes through Cloudflare Tunnel, so the router exposes nothing. Cross-subnet access to the pharmacy's Windows machine runs over Tailscale with Ed25519 SSH keys. Containers that face the internet run hardened: non-root users, dropped capabilities, read-only root filesystems where the workload allows it, API-key headers on every webhook.

Operations

n8n orchestrates the business logic of every system, so one dashboard shows every workflow execution and failure. ntfy pushes alerts to my phone when something needs attention. Workflows and configs are exported and versioned; the audit-critical systems (PCM proofs) write append-only JSONL logs. When the laptop sleeps, scheduled jobs are configured to catch up on wake rather than silently skip.