🛠️ Infrastructure

Everything here runs on Linux, with SELinux enforcing the whole time. That's what actually stops a container from reaching a file or device it hasn't been explicitly given, even if something inside it tries to. The GPU driver lives at this layer too, the piece that makes hardware video transcoding possible at all.

Every app on this page runs in its own container, its own filesystem and process space, nothing shared unless it's explicit. qBittorrent and Prowlarr share network access with Gluetun directly rather than connecting to it, so there's no path around the VPN for either of them. The GPU gets handed to Jellyfin the same deliberate way: one specific device, nothing else.

The single front door for every web address on this domain. Cloudflare passes a request along, and Caddy decides where it actually goes based on which address it came in on—the info site, Jellyfin, Pelican Panel, Wings, or anything else here. Every web request on this server passes through it.

Every address on this domain passes through Cloudflare before reaching the server via Cloudflared Argo Tunnel. It keeps the server's actual home IP private—visitors only ever reach Cloudflare, never the server directly. Zero open inbound ports required on the home router.

Torrent downloads (qBittorrent), indexer requests (Prowlarr, FlareSolverr), and meta-searches (SearXNG) run behind an always-on WireGuard VPN tunnel with automated port forwarding. If that connection drops, traffic stops immediately rather than leaking onto the home connection.

A dedicated secondary ProtonVPN WireGuard tunnel configured exclusively for the Soulseek music stack (slskd). Features automated NAT-PMP port forwarding so Soulseek peers can connect directly, keeping P2P seeding prioritized and track downloads fast without sharing bandwidth or IP with the primary torrent stack.

Checks once a day for new versions of everything running on this server—including media containers, Pelican gaming daemons, and utility tools (SearXNG and Home Assistant)—and sends an instant Discord notification when an update is available. It never installs anything on its own; updates still happen deliberately by hand.

The server pairs an ultra-fast NVMe SSD with an 8TB high-capacity HDD array. Container runtimes, databases, application configs, and game server jars execute on the NVMe for instant responsiveness and low latency, while bulk media libraries, game world saves, and system backups persist safely on the HDD array. On-demand media is streamed directly via high-speed TorBox debrid caching, keeping disk usage lean.