Public by choice
The frontend is public. Backend health is deliberately reduced to a small, sanitized contract.
A small system,
deliberately drawn.
A map of how this website moves from a public request to private services, and where the boundaries are designed to hold.
Selected layer / edge
Cloudflare edge
DNS, TLS, CDN caching, and the public boundary. Static pages are served from Cloudflare Pages without requiring the homelab to be online.
Operating principlesDesigned boundaries
Private by default
Immich and homelab services stay on the private network; the dashboard does not become an application gateway.
Recoverable
Services are independently managed by systemd, with persistent data isolated from disposable containers.