Self-Hosted Infrastructure

  • Category: Infrastructure & DevOps
  • Status: Running 24/7, hosting production services
  • Stack: Proxmox VE · Ubuntu · Ansible · Semaphore · Tailscale · Cloudflare Tunnels · Docker

Overview
Everything I ship runs on infrastructure I built and operate myself: a Proxmox hypervisor on a 16-core Ryzen 9 machine, carved into virtual machines that each host one service. Hash-It-Out's production deployment lives here. Choosing this over the cloud was deliberate. Renting a managed platform teaches you an API; running your own teaches you virtualisation, networking, security, automation and what "production" actually costs.

Self-hosted infrastructure architecture diagram


Provisioning in a Minute
New machines come from a cloud-init Ubuntu template driven by my own provisioning scripts. A single command gets me an SSH-able, fully enrolled VM in about sixty seconds. Every VM is tagged into a management tier (dev, lab or critical) and that tier decides how it's treated: throwaway dev boxes can be destroyed freely, while critical machines get snapshots before any patching and stricter change control.

Zero-Trust Access
There are no SSH keys scattered across machines and no ports exposed to the internet. Administrative access runs over Tailscale with identity-based SSH, and a single policy file declares who may reach what, per person and per tag. Public-facing services are published through per-VM Cloudflare Tunnels, so even the production web apps hold no open inbound ports.

Automated Operations
Fleet maintenance is Ansible, orchestrated through Semaphore. Patching runs on a weekly schedule and respects the tier system: dev and lab machines update in bulk, while critical machines are snapshotted first and patched one at a time, halting on any failure. Backups ship VM images off-host to a separate machine, and the infrastructure configuration itself lives in a private git repository, so the setup is documented, reviewable and reproducible.

What It Hosts
Alongside Hash-It-Out, the fleet has hosted game servers, event websites for real-world users, and a rotating cast of experiments. Each one is isolated in its own VM, and each one is practice at running services properly rather than just writing them.