About
theTinyLab is a homelab that behaves like a small business. It has its own certificate authority, its own DNS, its own identity provider, its own git forge and its own firewall pair — every piece of it free and open-source software, running on deliberately modest hardware.
It exists because the best way to learn infrastructure is to run real infrastructure: things that matter, that break, that need backups, monitoring and discipline.
The rules
- Free and open-source only. If a component can’t be run entirely on FOSS, it doesn’t ship. No license-key dependencies, no paid tiers.
- Everything as code. Configuration lives in git. Firewalls are managed through idempotent automation, cluster state is reconciled by GitOps, and hand-edited snowflakes are treated as bugs.
- One zone per trust domain. Network segments are separated by what they’re allowed to talk to, not by convenience. The public edge is not the LAN; the lab is not the family network it lives under.
- Assume failure. Redundant firewalls, replicated DNS, 3-2-1 backups — and restore drills that prove the backups mean something.
- Limited hardware, honest engineering. A handful of small machines force choices about what actually deserves to run.
What we publish here
This site is the lab’s technical face: what it hosts, what hardware it runs on, and the architecture that ties it together. It is written carefully — operational detail stays out. What you read here is what we’d happily show a stranger at a conference.
What never leaves the lab
Addresses, subnets, segment numbers, hostnames, software versions of internal services, credentials-shaped anything, and details of the production network the lab nests under. A leak-prevention check runs on every commit and every build of this site to keep it that way.
How this site is built
The site is generated by Hugo with a fully custom theme — no forked community theme underneath — and ships as pure static files: no JavaScript frameworks, no analytics, no external requests of any kind. Every commit passes the leak-prevention gate before it can build, and the whole stack runs locally in Docker on the machine that writes the content.
Hosting is GitHub Pages for now. Once the lab’s public edge — reverse proxy and web application firewall — is live, the plan is to serve this site directly from the lab.