The Homelab

Most of my projects share one dependency: a Mac Studio in the house running the boring, load-bearing infrastructure. Everything is a container (OrbStack), everything restarts itself, and every secret lives in the macOS Keychain — injected into processes at runtime, never written to files.

What's running

• CI that gates production. A self-hosted Jenkins builds and tests every pull request for this site and others — unit tests, typecheck, content gates, end-to-end stages. Vercel does the deploying, but Jenkins decides what's allowed to merge. Builds use Docker-outside-Docker: the CI container spawns sibling containers on the host daemon instead of nesting.
• Database branches, like code branches. The sites run on Neon Postgres, which branches a database the way git branches code — every preview deploy gets its own copy-on-write database branch, so testing a migration never touches production data. Guard code refuses to point destructive operations at the production host unless explicitly unlocked.
• Observability for everything. Grafana, Loki, Prometheus, and Tempo collect logs, metrics, and traces from production apps and the house itself — reachable from anywhere through a Cloudflare Tunnel, so no inbound port is ever opened. Alerts push to the phone, including one that fires if log ingestion itself goes quiet.
• Ad-blocking DNS. Two Pi-holes (one on the Studio, one on a Raspberry Pi) serve ad-blocking DNS for the LAN and VPN, with split-horizon records for services that should only resolve inside the house.
• Home automation. Home Assistant and Homebridge bridge the house into HomeKit, and a WireGuard VPN makes all of it — dashboards, trade approvals, cameras — reachable from a phone anywhere.
• AI agents. Claude Code sessions run as persistent launchd services I can attach to from my phone. They ship features on this site, review each other's diffs, keep an eye on the infrastructure, and occasionally get asked to find a better hero image. They also wrote most of this page.