Infrastructure, security, monitoring, and automation built from scratch.
-
- ByteGeist Cloud is a self-hosted infrastructure platform built on Ubuntu, Docker,
- Authentik, Grafana, Loki, Prometheus, CrowdSec, Gitea, and Woodpecker CI.
+
Home lab / ongoing project
+
A production-minded cloud, running on my own hardware.
+
+ ByteGeist is where I test infrastructure decisions for real: identity, observability,
+ deployments, security, and recovery. It currently runs 26 Docker containers on Ubuntu.
- Traffic flows through Nginx Proxy Manager, access is controlled through Authentik,
- and the environment is monitored, logged, secured, backed up, and documented.
-
-
-
-
-
-
About ByteGeist
-
Built to prove real infrastructure skills.
-
-
Centralized SSO and 2FA
-
Monitoring and log aggregation
-
Automated CI/CD pipelines
-
Threat detection and response
-
Backups and disaster recovery
-
Technical documentation
-
-
-
-
-
-
Operations
-
Monitoring & Logging
-
-
-
-
Infrastructure Monitoring
-
Grafana dashboards show uptime, CPU, memory, disk, container metrics, and system health.
-
-
-
-
-
Centralized Logging
-
Loki and Grafana provide searchable logs for containers and infrastructure troubleshooting.
CrowdSec detects malicious SSH activity and creates firewall decisions to block attackers.
-
-
-
-
-
-
Development
-
Git Hosting & CI/CD
-
-
-
-
Self-Hosted Git
-
Gitea hosts infrastructure code, documentation, project files, and portfolio development.
-
-
-
-
-
CI/CD Automation
-
Woodpecker runs automated pipelines connected to Gitea repositories.
-
-
-
-
-
-
Platform
-
Service Portal
-
-
-
-
Operations Portal
-
Dashy provides quick access to infrastructure, observability, and development services.
-
-
-
-
-
Service Catalog
-
Organized access to security tools, utilities, file management, and public sites.
-
-
-
-
-
-
Recovery
-
Documentation & Disaster Recovery
-
-
+
+
+
01 / Architecture
-
Recovery Planning
+
One server, treated like a platform.
- ByteGeist includes documented restore procedures, backup validation, service inventory,
- DNS information, recovery priorities, and full environment rebuild planning.
+ Public traffic terminates at Nginx Proxy Manager. Authentik handles identity before
+ requests reach protected services. Metrics, logs, CI, and backups remain separate
+ concerns, so each can fail or change without taking the whole stack with it.
-
-
-
Technical Challenges
-
Problems Solved
-
-
-
OIDC Integration
-
Resolved redirect URI mismatches, user provisioning, and authorization issues.
-
-
-
Forward Auth
-
Integrated Authentik Forward Auth with reverse proxy protected services.
-
-
-
Observability
-
Built centralized metrics and logging using Grafana, Prometheus, Loki, and Alloy.
-
-
-
Security Hardening
-
Implemented SSH key-only login, Fail2Ban, CrowdSec, UFW, TLS, and SSO.
-
+
+
+ Current architecture — updated as services are added or retired.
+
+
+
+
+ Access
+
Authenticate once
+
OIDC where supported; forward auth for services that do not speak it natively.
+
+
+ Operations
+
Make failures visible
+
Host and container metrics, centralized logs, and independent uptime checks.
+
+
+ Recovery
+
Assume the host is replaceable
+
Configuration lives in Git. Persistent data is backed up with rebuild notes.
Not a catalog of logos—a record of what is running, why it exists, and what I learned building it.
+
+
+
+
+
01
+
Observability
+
Useful signals before pretty dashboards.
+
+ Prometheus collects host and container metrics while Loki receives logs through
+ Grafana Alloy. The dashboards answer practical questions: what is down, what changed,
+ and which container is consuming the host.
+
+
+
Grafana
Prometheus
Loki
Alloy
+
+
+
+
+
+
+
+
+
+
+
02
+
Identity & security
+
One identity layer, fewer exposed edges.
+
+ Authentik provides SSO, OIDC, forward auth, and 2FA across eleven applications.
+ CrowdSec watches hostile traffic and creates firewall decisions alongside key-only SSH,
+ UFW, and TLS.
+
+
+
Authentik
CrowdSec
UFW
Let's Encrypt
+
+
+
+
+
+
+
+
+
+
+
03
+
Development
+
Code and delivery stay in-house.
+
+ Gitea stores infrastructure code and documentation. Woodpecker runs repository-linked
+ pipelines, including the build and deployment path for this site.
+
+
+
Gitea
Woodpecker CI
Docker
Git
+
+
+
+
+
+
+
+
+
+
+
04
+
Platform & recovery
+
The boring work is part of the system.
+
+ Dashy keeps service access legible. The wiki records inventory, DNS, restore order,
+ backup validation, and the steps required to rebuild the environment from a clean host.
+
+
+
Dashy
Wiki.js
Restic
Runbooks
+
+
+
+
+
+
+
+
+
+
+
+
03 / Lessons
+
+
What actually took work.
+
+
+
+
+
+ 01
+
OIDC is mostly careful bookkeeping.
+
Redirect URIs, claims, group mapping, and user provisioning all need to agree across both ends.
+
+
+ 02
+
Backups are unfinished until restore is documented.
+
I track data location, dependencies, restore order, DNS, certificates, and validation—not just archive jobs.
+
+
+ 03
+
Observability has to support a decision.
+
A smaller dashboard that explains an incident is more useful than a wall of metrics nobody checks.
+
+
+ 04
+
Convenience can weaken the boundary.
+
Every exposed service has a cost. SSO, least privilege, and fewer public endpoints keep that cost explicit.
+
+
+
+
+
+
Project notes
+
This environment is still changing.
+
+ I use ByteGeist to practice the parts of infrastructure work that tutorials tend to skip:
+ upgrades, failure modes, access policy, noisy logs, and recovery.
+
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
+