16 of 17 parts published

Building a Self-Hosted AI Development Platform

Forge is an old ASUS dual Xeon workstation — 32GB of RAM, two small SSDs, two 6TB drives — rebuilt into a documented, rebuildable home platform: Proxmox underneath, a ZFS mirror for the data that matters, a Docker host running twenty-odd services, self-hosted Git with CI, and publishing to the internet without a single open router port.

This series is the honest build log. It covers the decisions and their reasoning, but also the failures that shaped them: the local AI that was too slow to keep, the disk that filled to 97% while a metrics stack watched in silence, the DNS toggle that took every public service offline, and the services retired for having no job. Every post follows the same rule — goal, decisions, what broke, what it delivered.

Parts publish in build order. The roadmap below shows where the series has been and where it goes next.

1

Part 1: Why Build One?

Part 1 of the Forge series: turning an old dual Xeon workstation into a documented, rebuildable home platform for AI-assisted development, self-hosted Git, and automation

9

Part 9: Turning the Platform into a Repeatable Build

Part 9 of the Forge series: the /opt/platform layout, confessing drift in a gaps file, CI that validates the repo, Renovate proposing updates, and the allowlisted workflow that deploys a merged PR

11

Part 11: Music and Photos with Navidrome and Immich

Part 11 of the Forge series: the storage tiers earn their keep — Navidrome as the low-risk first media service, Immich for photos only after the backup posture deserved them, and a 44GB import done safely

12

Part 12: One Login with Authentik

Part 12 of the Forge series: a self-hosted identity provider for the platform — OIDC for the Immich apps, a worker with no Docker socket, break-glass accounts, and a restore proof before trust

13

Part 13: Running It Calmly

Part 13 of the Forge series: searchable container logs with Loki and Alloy, a report-only update watcher, one morning digest instead of twenty dashboards, and the capability that a crash loop taught me about

14

Part 14: When the Platform Leaves the Rack

Part 14 of the Forge series: the services that deliberately get no public hostname — DNS filtering, home automation, Mac backups over Samba, and a bridge into a decade-old Sonos system

15

Part 15: The Failover That Failed

Part 15 of the Forge series: a second network card, an active-backup bond, a test that cut the house off from DNS, a byte-for-byte rollback — and a problem that is still open

16

Part 16: Hardware You Only Think About Once

Part 16 of the Forge series: the firmware settings, kernel workarounds and disk checks that live below every Compose file — including a BIOS bug that flooded the logs once per second

17
Coming soon

Agent Access: Letting an Assistant Touch the Platform

Read-only tokens, a credential helper backed by a password manager, and the preflight check that must pass before anything automated is allowed near the host — how an AI assistant gets useful access to a homelab without getting dangerous access.

Back to all posts