Nine machines. One fully stateless Docker Swarm. Documented in public — including the parts that are still broken.
Seven interchangeable Swarm nodes that hold no data of their own, and two hosts outside the cluster that hold everything that has to survive — one runs the database, one holds the files. Any Swarm node can be wiped and rebuilt without losing anything.
Deploys are GitOps: Portainer pulls compose files straight from these repos, so a stack's definition and its deployment can't drift. Public ingress is a Cloudflare Tunnel dialing out — no open inbound ports anywhere on the network.
The full architecture, the build's actual history (including the detours that didn't work), and every technology and why it's there lives in zer0space-docs — public on purpose, and honest on purpose: what's running, what's built but not switched on yet, and what's still broken.
The short version, diagrammed
Cloudflare (DNS · Tunnel · Access MFA)
│ outbound-only — no open inbound ports
▼
┌────────────────────────────────────────────────┐
│ DOCKER SWARM — 3 managers + 4 workers │
│ stateless: no local volumes, nothing pinned │
│ for storage reasons │
└──────────┬──────────────────────┬───────────────┘
│ NFS │ PostgreSQL
▼ ▼
┌──────────────┐ ┌──────────────────┐
│ zs-store-01 │ │ zs-state-01 │
│ files │ │ database · UI │
└──────────────┘ └──────────────────┘
| ✅ Working | 7-node Swarm, 3 managers · all persistent files on central NFS · genuinely stateless application on PostgreSQL · GitOps deploys · nightly local backups with visible status |
| 🔄 Built, not switched on | Cloudflare Tunnel and the Access policy |
| VXLAN overlay to the late-joining workers — worked around, not fixed | |
| ❌ Missing | Offsite backups · a database backup · a rehearsed restore |
Details and reasoning: zer0space-docs/architecture.md · journey.md
| Repo | What it is |
|---|---|
| zer0space-docs | Public write-up of the whole cluster — architecture, build history, tech stack |
| zer0space-dashboard | Self-hosted homelab dashboard (Python · FastAPI) — service launcher, cluster status, backup overview, invite-only accounts, per-user encrypted credential vault |
| zer0space-crimson-backend | Deployment stack for Crimson Haven's backend (PostgreSQL, API, sync worker) |
| zer0space-crimson-client | Deployment stack for Crimson Haven's static frontend |
| zer0space-status | Uptime/status monitoring for the homelab — in progress |
zer0space-services, zer0space-clients, zer0space-ai, zer0space-cloud |
Private — Swarm stack definitions, node setup guides with real addressing, and projects still in planning |
Sige0's assistant, and the mascot standing behind all of it. She doesn't run any of the nine machines — she watches all of them, so somebody else doesn't have to: the seven interchangeable nodes, the two that actually hold state, a tunnel that only ever calls out, an overlay that quietly lied for a while.
The full story is in
zer0space-docs.
Everything here is documented as it actually is, not as it's supposed to be — including the gaps. That's the point of writing it down.
