A small estate run to a documented standard

Capability statement. Four hosts, fifty or more containers, configuration in version control instead of in a shell history, and one place where traffic enters. The estate is deliberately small because it is run rather than demonstrated.

What is actually run

Declarative configuration. NixOS is the base on the machines that matter, with the desktop and the terminal replicated across them so an environment can be rebuilt from a description. Proxmox runs the virtualised side — Ubuntu file server and a Home Assistant appliance alongside the desktop hosts. The point of the arrangement is repeatability: a machine is a configuration, not a pet.

Packaging. When a tool is missing or stale in nixpkgs, it gets a derivation rather than a manual install. The TUIOS package pins 0.10.1 over nixpkgs’ 0.7.0 with fetchurl and a verified hash, documents why the override exists, and states the condition for deleting it. A patch with an exit plan is maintenance; a patch without one is debt.

Container estate. Fifty or more containers run across the hosts — the file server and media services, the automation layer, the AI services, traffic for public ingress, and the tools used to build all of it. Each new service is given its own port, its own folder and a memory cap equal to its swap cap, so it cannot take the host’s swap.

Networking. Remote access is a private mesh rather than an exposed SSH port: Tailscale across the machines, SSH on every host, and a phone used as a terminal. Services bind to loopback; Caddy is the only public listener, terminating TLS at the edge host and proxying the sites that are allowed to be seen.

Storage and backups. Three tiers, each covering a different failure: local snapshots on the machine, a copy on another machine over the network, and an offsite copy in object storage. Retention is stated in the job (daily, weekly, monthly, annual) and a restore runbook sits next to the jobs, because a backup nobody has restored from is an assumption.

Observability and operations. Resource use is watched at the host level, because the runtime host is memory-bound and a new service can destabilise the ones people rely on. The agent fleet is observed as a fleet through TUIOS — sessions, state and approvals in one console — rather than by tailing logs on four machines.

Signage infrastructure. The display work is treated as a fleet to be managed: HDMI-CEC control for power, rotation, mirroring and multi-screen layout, so screens are driven by the platform rather than by a person with a remote control.

Evidence

Claim	Evidence	Artefact
Configuration is declarative and replicated	NixOS hosts with shared configuration; Proxmox for the virtualised side	Declarative configuration
Tooling is packaged rather than hand-installed	`pkgs/tuios.nix` pinning 0.10.1 with a documented removal condition	Nix package
Fifty or more containers are operated	Inventory by host and by purpose	Container inventory
Backups are three-tier with a restore runbook	Borg on two hosts, Kopia and Backrest on the edge host, offsite object storage	Backups
One public listener	Loopback-bound services behind Caddy at the edge	Network
Screens are managed as a fleet	HDMI-CEC control of power, rotation and layout	Signage infrastructure

Trade-offs and limits

Memory over hardware. The runtime host runs 15 GiB with little free and swap in use. The response was caps, fewer and smaller services, and moving heavy work to the gateway rather than buying another machine. Every new service is sized before it is deployed, and the ceiling for this site is one gigabyte and four containers.
Self-hosting is a choice with a cost. Monitoring, backups, ingress and the AI gateway are all operated here, which means the failure modes are also operated here. The mitigation is documentation and measurement, not optimism.
Rejected on purpose. A long list of tools was evaluated and refused — Airflow for RAM, self-hosted Langfuse for six containers it could not afford, LiteLLM because it would duplicate the existing gateway, and a pile of documentation platforms. “Alternatives considered” is kept because the reasoning is the senior artifact.
Not everything is automated. Some operations are still a documented command run by a person. The runbook exists precisely because the automations do not cover everything.

Drill-downs

Declarative multi-host configuration — level 3
A hand-written Nix package with an exit plan — level 3
Container inventory — level 3
Backups and restore runbook — level 3
Network layout and remote access — level 3
Signage infrastructure — screens as a managed fleet — level 3

Period and confidence

period: 2020–, anchored on the homelab year in the evidence notes. Confidence is running: this is the current estate, verified 2026-10-26.