Private-first service stack

Services with purpose, not topology.

The family stack includes smart home, photos, media, passwords, AI, DNS privacy, monitoring, memory, and protected agent dashboards. This page now shows the safe public story without exposing private addresses, ports, internal paths, or command details.

Family services Private ops layer Operations bridge

Live health, public-safe

Health badges are refreshed from the private stack, but this page only displays safe labels. Private mesh addresses and peer details stay out of public HTML and JSON.

DNS privacy: loading… Private mesh: loading… Updated: loading…
Family services
Home Assistant
Live

Smart-home automation for lights, sensors, household routines, and family automations.

Smart homeFamily-ownedHTTPS
Open public route →
Immich
Live

Private family photo and video library. A Google Photos replacement owned by the Long family.

PhotosMemoriesHome lab
Open public route →
Jellyfin
Live

Family media library for movies, shows, music, and home entertainment.

MediaStreamingHome lab
Open public route →
Vaultwarden
Live

Self-hosted password vault with signups locked down and family credentials kept under family control.

PasswordsEncryptedLocked signups
Open public route →
Open WebUI
Live

Local AI workspace connected to the family model lab for private experiments and diagnostics.

AI workspaceLocal modelsPrivate-first
Open public route →
Uptime Kuma
Live

Monitoring and alerts for the family infrastructure so failures are noticed before they become family problems.

MonitoringAlertsPrivate ops
Open public route →
DNS Privacy
Loading

Network-wide ad and tracker blocking for family devices, with routing kept private.

DNSTracker blockingHome network
Memory Graph
Live

Knowledge graph memory for Aether and Zeph, used for durable recall and infrastructure continuity.

MemoryGraph recallPrivate
Private Mesh
Loading

Encrypted device-to-device access between approved family machines without exposing home ports.

TailnetApproved devicesNo public topology
Protected operations

Private operations are visible by category, not by secret.

The public site can point to the idea of observability and controlled power. Authentication, tailnet membership, request files, audit trails, action IDs, and private endpoints remain behind the wall.

Authenticated

Agentic Dashboard

Read-only session and agent observability. Fails closed when unauthenticated.

Open protected page →
Authenticated

Memory Workflow

Protected memory pipeline view for human-visible review and operational context.

Open protected page →
Tailnet only

Aether Command Center

Controlled-power request cards. Allowlisted actions, auth, CSRF, audit, and approval required. No public terminal.

Safe architecture summary
LayerAccessPurpose
Public family portalOpen webStory, service catalog, Hermes overview, Reiki page, and safe public links.
Authenticated dashboardsLogin requiredRead-only observability, metrics, memory workflow, and protected feeds.
Tailnet command planeApproved devices onlyControlled request cards for allowlisted operations with audit and approval gates.
Family service edgeHTTPS routesSelected family apps exposed deliberately while the home network stays private.
Encrypted backupsPrivate recovery pathOffsite disaster recovery with encrypted content and encrypted names.
Hardware, public-safe
Machine classRolePublic note
Home labCore app host and local model labFamily-owned server running the practical services.
VPS edgePublic portal, gateways, and protected surfacesInternet-facing edge without publishing private topology.
Family devicesApproved access clientsPrivate mesh devices can reach the locked operational layer.
Home Hermes Ops Reiki