Selfhosted

To become independent, you don't have to ask for independence. To become independent you have to be independent.

This is the story of how I am slowly becoming independent. Disclaimer: If you don't understand anything, that's fine. I created this documentation for myself.

My name is Francisco, in french it means "free person" . Some people in life want performance, some other want reliability. The only thing I care about is freedom. To do what I want, when I want and how I want to.

Server: Intel NUC 11, 16 GB RAM, 1 TB NVMe. Ubuntu Server. Connected via 1 Gbps symmetric FTTH (dynamic IP). The Razer Core X eGPU is used as a job session, not always-on: long continuous attach (including idle) has hard-hung the host. Power it for Whisper/TTS/ComfyUI work, then power it off and reboot; see GPU services / eGPU sessions and GPU setup.

NUC Tailscale (verified 2026-10-08): thebeachlab joined the GitHub tailnet thebeachlab.github, replacing its previous client login to Headscale at https://hs.beachlab.org. Its control server is now https://controlplane.tailscale.com, MagicDNS name nuc.tail520737.ts.net, and IPv4 address 100.91.63.61. tailscaled is enabled and active. The 192.168.1.0/24 subnet advertisement was removed with sudo tailscale set --advertise-routes=; the NUC now advertises no subnet routes. Access the NUC using its Tailscale address. Source: live NUC tailscale status --json, tailscale debug prefs, systemctl is-enabled tailscaled, and systemctl is-active tailscaled; Mac tailscale ping 100.91.63.61 and successful OpenSSH access to 100.91.63.61:622 with the existing host key.

RPi 5 (pibot1): Mounted in the G Mobile Lab (vehicle). Its recorded job is the Bluetti BLE bridge, I2C sensors (CO2, temp, humidity, pressure), GPS NEO-6M, IMU MPU-6050, and Starlink gRPC telemetry, with the path to the server written as Starlink + Tailscale. On 2026-09-12 the Pi's SSH endpoint timed out and the stored attitude was a repeated cache. The server ingest written after that left the Pi's power and connection state unverified. See Bluetti telemetry and pibot1.

NAS: Synology DS411slim, DSM 6.2.4-25556 Update 8. See NAS access and Tailscale compatibility for the verified configuration and the legacy kernel's package requirements. Named shares are on that page.

Liderflor VPS: A separate host from the NUC, the NAS and the Pi. Node.js and security maintenance record Flora OpenClaw there, plus a public WordPress site, API and shop. liderflorapi.beachlab.org is a fixed DNS record (Cloudflare DNS).

Remote access today: The NUC and the NAS are on the GitHub tailnet, as written above. When checked on 2026-10-08 the NUC client had left Headscale at https://hs.beachlab.org. Headscale still records that server running on the NUC on 2026-10-26, with client IDs 1 and 2 kept. OpenVPN's server unit was restarted the same day (security). The WireGuard page is the hub setup guide; the Pi's recorded path is Tailscale. Who still uses Headscale, OpenVPN or WireGuard is an open question below.

Previous servers (non-operational):

• Suitcase — 2015 Skylake i3-6100, 8 GB RAM, 500 GB SSD
• Sister — X79 Xeon E5-2670 v2 (10c/20t), 40 GB RAM, 1 TB NVMe

• Getting started
• Securing SSH access
• Backups
• Web server (Nginx)
• Hariburi currency rates
• Cloudflare DNS and NUC dynamic IP updates
• Passkey access (Authentik)
• Service administration
• Git server
• SFTP server
• Headscale (server on the NUC as of 2026-10-26; NUC client uses the GitHub tailnet)
• VPN Server (OpenVPN) (unit restarted 2026-10-26; daily use not recorded)
• WireGuard VPN (setup guide; no later check that it still runs)
• Server Safeguards (resource limits + alerts)
• Troubleshooting

• Small-space housing podcast

• Das Werklab voice receptionist (ES/EN/DE)

• Vaultwarden password manager

• Buchhaltung: repositorio propio privado

• Msgvault communications archive

• Taskwarrior and Nextcloud Tasks sync

• Transmission Daemon (NordVPN)

• Mumble voice server (setup guide; no later check that it is running)

• iOS Push Notifications (iGotify)

• Drop (protected URL downloads)

• Remote browser

• n8n automation (removed 2026-02-08)

• Auto USB copy

• Node.js / PM2

• OpenClaw TUI Quick Access (tmux)

• OpenClaw runtime maintenance (how Watson is updated; what the agent is for is not written here)

• Grafana (TimescaleDB dashboards)

• IoT (Mosquitto MQTT)
• MQTT Telemetry — server stats (alpha/stats)
• MQTT to TimescaleDB and PostgREST
• Bluetti Mobile Lab telemetry pipeline
• Raspberry Pi 5 (pibot1)

• PostgreSQL
  • TimescaleDB
  • Strapi CMS (install guide; sisterapi is not in the current database list)
  • PostgREST API
  • PostgREST JWT Gateway

• Personal knowledge: Strategy, sources and recovery
  • Obsidian
• Knowledge graphs and agent loops (experiments; LangGraph, Graphiti and Neo4j are not deployed on the NUC)
  • LangGraph
  • Graphiti
  • Neo4j Community and Browser
  • Graph tools
• GPU setup
• GPU Service Management (on-demand Whisper/RAG/TTS)
• Whisper Web (protected upload + diarization)
• eBook RAG (SFTP Inbox)
• Qwen3-TTS Voice Cloning (multilingual)
• ComfyUI (Stable Diffusion node editor)
• Hailo AI dataflow compiler

• Understanding DNS (WIP; not the current public DNS)
• OBS ninja (WebRTC) (WIP; public exposure removed 2026-02-08)
• STUN/TURN Server (WIP; public coturn exposure removed 2026-02-08)
• Minecraft server
• Nextcloud
• Mail server (Postfix) (Postfix disabled, recorded 2026-02-08; Dovecot and OpenDKIM never written up)
• openHAB (BTicino/OpenWebNet and Apple Home)

Unanswered in the repo:

• Whether the scheduled Namecheap ddclient retirement finished. Cloudflare DNS.
• Whether gitweb at git.beachlab.org is still served, and whether the NUC still listens on SSH port 22222 (verified admin access is port 622). Git, SSH.
• Which database uses PostGIS; the table lists behind the short database names; whether air and sisterapi exist. PostgreSQL.
• Who Headscale clients 1 and 2 are, and whether anyone still uses Headscale, OpenVPN or WireGuard day to day. Headscale, OpenVPN, WireGuard.
• Whether a house sensor replaced the Sitges Open-Meteo readings after 2026-09-12. Telemetry columns.
• Whether the vehicle Pi is online now. pibot1.
• Whether Mumble at walkie.beachlab.org is running. Mumble.
• What Deutsch Sprint is. Authentik.
• TiTiler's public hostname, and which maps it serves. Administration.
• What the Watson OpenClaw agent is for. Runtime maintenance.
• What /data/ on api.beachlab.org used to target, and what the pending /air/ setup is. Safeguards.
• Which NAS volumes exist besides the backup paths named in the docs, and whether those two backup paths are the same share. NAS.

The multilingual bookkeeping launch page has its own public service, email confirmation list and private encrypted backups. It is separate from the owner-only accounting application. See Mebuko deployment and privacy and the visual specification.