Homelab Overview & Architecture
Executive Summary
A fully automated, enterprise-grade personal cloud infrastructure hosted 100% free of charge on Oracle Cloud Infrastructure (OCI) Always Free Tier. It provides biometric passkey Single Sign-On (SSO), secure password management, personal finance and investment tracking, host administration, and automated offsite encrypted backups.
1. The Core Philosophy
When building this homelab, three non-negotiable principles guided every architectural decision:
- Zero Attack Surface (No Open Ports): The server has zero inbound ports open on the public internet. No port 80, no port 443, no open SSH port 22 on the firewall. All traffic reaches the server through an outbound encrypted tunnel managed by Cloudflare Zero Trust.
- Passwordless, Single-Touch Biometrics: Every administrative service is guarded by Authelia using WebAuthn. A single tap of a fingerprint reader, Face ID sensor, or hardware security key (YubiKey) verifies identity and satisfies multi-factor authentication (MFA) simultaneously.
- Zero Operating Cost: The entire infrastructure—compute, storage, reverse proxying, DNS, SSL/TLS certificates, tunnel ingress, and daily encrypted cloud backups—runs permanently within free-tier allowances without risking credit card charges.
2. High-Level Architecture
flowchart TD subgraph Users ["Client Devices"] Mobile["iPhone / Android (Passkey)"] Laptop["MacBook / Linux PC"] Public["Public Web Visitors"] end subgraph Cloudflare ["Cloudflare Edge Network"] CF_DNS["Cloudflare DNS (*.ganeshr.me)"] CF_Pages["Cloudflare Pages (CV Site: ganeshr.me)"] CF_Notes["Cloudflare Pages (Notes: notes.ganeshr.me)"] CF_Access["Cloudflare Zero Trust Access (GitHub SSO)"] CF_Tunnel["Cloudflare Zero Trust Tunnel"] end subgraph OracleHost ["Oracle Cloud Micro VM (144.21.49.153)"] cloudflared["cloudflared daemon (systemd)"] subgraph DockerNet ["Docker Internal Network"] Caddy["Caddy Reverse Proxy (:80)"] Authelia["Authelia SSO (:9091)"] Homepage["Homepage Dashboard (:3000)"] Wealthfolio["Wealthfolio (:8088)"] Vaultwarden["Vaultwarden Vault (:80)"] end Cockpit["Cockpit Web Console (:9090)"] SyncWorkers["Python Sync Workers (systemd timers)"] BackupCron["Daily Backup Pipeline (02:00 UTC)"] end subgraph ExternalServices ["External Backends & Cloud"] Trading212["Trading 212 Public APIs"] Chip["Chip Financial (Rekha ISA)"] GoogleDrive["Google Drive (AES-256 Backups)"] end Public -->|HTTPS| CF_Pages Mobile -->|HTTPS| CF_Tunnel Laptop -->|HTTPS| CF_Tunnel Laptop -->|HTTPS| CF_Access Mobile -->|HTTPS| CF_Access CF_Access -->|Authorized Session| CF_Notes CF_Tunnel -->|Encrypted Outbound Wire| cloudflared cloudflared -->|Plaintext Internal Loopback| Caddy Caddy -->|1. Forward Auth Check| Authelia Caddy -->|2. Route Traffic| Homepage Caddy -->|2. Route Traffic| Wealthfolio Caddy -->|2. Route Traffic| Vaultwarden Caddy -->|2. Route Traffic| Cockpit SyncWorkers -.->|Read/Write SQLite| Wealthfolio SyncWorkers -.->|Pull Portfolios| Trading212 BackupCron -->|Encrypted .7z Archive| GoogleDrive
3. Service Catalog & Domain Routing
All services are accessible through subdomains of ganeshr.me.
| Domain | Service | Authentication | Description | Documentation |
|---|---|---|---|---|
ganeshr.me | Cloudflare Pages | None (100% Public) | Professional CV & Portfolio website | Public static site |
hq.ganeshr.me | Homepage | Authelia Passkey | Main central portal & server status | 05 - Homepage & Cockpit Server Management |
auth.ganeshr.me | Authelia Portal | WebAuthn / Passkeys | SSO portal & authentication engine | 03 - Authelia & Biometric Passkey SSO |
wealth.ganeshr.me | Wealthfolio | Authelia Passkey | Net worth, portfolio, pension & real estate tracker | 06 - Wealthfolio & Financial Automation Pipelines |
vault.ganeshr.me | Vaultwarden | Bitwarden Master Key | Passwords, 2FA codes, notes & secrets vault | 04 - Vaultwarden Password & Secret Vault |
cockpit.ganeshr.me | Cockpit Console | Authelia + Linux PAM | Linux administration terminal & system management | 05 - Homepage & Cockpit Server Management |
notes.ganeshr.me | Quartz 4.0 | Cloudflare Zero Trust (GitHub SSO) | Personal knowledge base, digital garden & graph search | 09 - Digital Garden & Serverless Notes Portal |
4. Hardware & Resource Allocations
The host is an Oracle Cloud AMD Micro Instance running in London (uk-london-1). Because the instance has 1 GB of physical RAM, aggressive memory optimization is applied across the entire stack:
- Host Public IP:
144.21.49.153(instance-20250727-1959-vaultwarden) - Operating System: Ubuntu 24.04 LTS (Kernel
6.17.0-1020-oracle) - Physical RAM: 1,024 MB
- Swap Space: 2,048 MB swapfile at
/swapfile(prevents Linux Out-Of-Memory killer events) - Storage Allocation: 50 GB Boot Volume (ext4)
- Firewall Ingress: 0 open incoming ports on OCI Security Lists
Container Resource Limits (Docker Compose)
To guarantee stability, containers have explicit memory caps configured:
wealthfolio: 256 MB hard limit (64 MB reservation)authelia: ~45 MB typical usagevaultwarden: ~35 MB typical usagehomepage: ~70 MB typical usagecaddy: ~25 MB typical usage
5. Server Filesystem Layout
Understanding where files live on the server eliminates confusion during maintenance:
/
├── opt/
│ └── vaultwarden/ # Main Docker application stack
│ ├── docker-compose.yml # Container definitions & resource limits
│ ├── Caddyfile # Reverse proxy routing & forward-auth
│ ├── authelia/ # Authelia configuration & SQLite DB
│ ├── vw-data/ # Vaultwarden vault DB & RSA keys
│ ├── homepage-config/ # Homepage YAML dashboards & themes
│ ├── wealthfolio-data/ # Wealthfolio DB & encryption key
│ └── assets/ # Custom dashboard icons & wallpapers
├── etc/
│ ├── cloudflared/ # Cloudflare tunnel token & config
│ ├── cockpit/cockpit.conf # Cockpit origins & timeout settings
│ ├── cron.d/vaultwarden_backup # Daily 02:00 UTC backup schedule
│ └── systemd/system/ # Custom systemd timers & services
│ ├── trading212-sync.{service,timer}
│ └── chip-interest.{service,timer}
└── usr/local/bin/ # Production automation scripts
├── backup_stack.sh # Encrypted backup creation & cloud sync
├── sync_trading212.py # Trading 212 API synchronization
├── sync_chip_interest.py # Chip Cash ISA interest worker
├── import_landg.py # Legal & General pension parser
└── import_lic_loan.py # LIC Housing Finance loan parser6. Quick Operations Cheatsheet
Connect to the server from your terminal or Termius:
ssh -i ~/.ssh/oracle_vm.key ubuntu@144.21.49.153Common Commands
# Check status of all Docker services
cd /opt/vaultwarden && sudo docker compose ps
# View live Caddy proxy logs
sudo docker logs -f caddy
# View live Authelia authentication logs
sudo docker logs -f authelia
# Check automated financial sync timer status
systemctl list-timers | grep -E 'trading212|chip'
# Trigger an immediate manual backup
sudo /usr/local/bin/backup_stack.sh7. Homelab Documentation Map
Dive into each section for detailed explanations, configuration breakdowns, and troubleshooting runbooks:
- 01 - Cloudflare Zero Trust & Tunnel: How traffic safely reaches the server with no open ports.
- 02 - Caddy Reverse Proxy & Routing: Internal traffic control, forward authentication, and custom asset serving.
- 03 - Authelia & Biometric Passkey SSO: WebAuthn, biometric single-touch 2FA, and session management.
- 04 - Vaultwarden Password & Secret Vault: Self-hosted password security, zero-knowledge encryption, and Bitwarden imports.
- 05 - Homepage & Cockpit Server Management: Custom status dashboard and browser-based Linux administration.
- 06 - Wealthfolio & Financial Automation Pipelines: Automated sync engines for Trading 212, Chip, L&G pension, LIC loan, and Mumbai real estate.
- 07 - Automated Backup & Disaster Recovery: Daily AES-256 hot snapshots, Google Drive sync, and 15-minute rebuild guide.
- 08 - Oracle Cloud Free Tier & Infrastructure Optimization: Always Free quotas, RAM/swap management, and Ampere A1 ARM capacity hunter.