When the number of service IP addresses in my home toolkit started growing, it became worth thinking about DNS. When accessing my services, I want to use a nice, human-friendly address in the browser, available only over an active VPN connection, backed by a fault-tolerant DNS layer, and secured with well-known Let's Encrypt TLS certificates without browser warnings.
A hands-on write-up of how I bootstrap and secure my personal infrastructure. Ansible, YubiKeys and a WireGuard mesh - the honest version, with the trade-offs left in.
The journey has been a bit uneven, and I've tried a few different approaches along the way. At this point, though, I feel I've landed on a setup that is not the cheapest, but works well enough to be genuinely useful. I use a handful of AI agents for different tasks, and, as an architect myself, I spend a surprising amount of time talking things through with an AI architect agent. In this article, I'll walk through the whole stack.