Public services with real users, running from a spare room

Problem

“Runs on my home cluster” and “is a real public service” usually don’t sound like the same sentence. Getting there means solving the parts a cloud provider normally hides: exposing a service publicly without opening a port on the router, making outbound email actually land in an inbox, and keeping app state safe across pod restarts.

Approach

Both services run as stateless app pods backed by Postgres, so a rolling restart or a node failure never risks data: only the database needs to survive, and it’s backed up. Public ingress goes through a Cloudflare Tunnel, so there’s no port-forward and no exposed IP for either domain. Outbound email (booking confirmations, watchlist alerts) goes through Resend with SPF, DKIM and DMARC properly aligned on each sending domain: the difference between “email sent” and “email delivered.” The licence-plate pipeline is event-driven end to end: a camera webhook triggers enrichment against DVLA and DVSA, then a vision classifier decides what’s watchlist-worthy before anything reaches a human.

Outcome

A gym’s members book classes through it every day. The alert pipeline watches for real plates and pages a phone, not a dashboard nobody checks. Both run on hardware that also plays back TV in the next room, with an external dead-man’s-switch monitor watching from outside the network in case the whole house ever goes dark.