Sean Ciranni
IT Analyst · homelab alias: bert · four years running
- LOCATION
- Denver, Colorado
- FLEET
- 7 Linux hosts · ~80 containers
- STACK
- Linux · Docker · k3s
- STORAGE
- 68 TB pooled · ZFS backup target
- MESH
- Tailscale (WireGuard)
- INGRESS
- Cloudflare Tunnel · 0 open ports
A self-hosted infrastructure portfolio with Linux at its core — a two-node Kubernetes cluster, a Mac Mini running Ubuntu as the always-on edge node, and a 68TB mergerfs pool serving a full media stack. Every service is containerized, monitored, and reachable only over a private Tailscale mesh or an outbound-only tunnel. No cloud dependency, no vendor lock-in, no inbound ports open at the router. Everything owned, operated, and maintained personally.
01Central Infrastructure Brainbertmacmini · always-on edge node
bertmacmini
A Mac Mini running Ubuntu 24.04 via community T2 kernel support — the always-on edge node, primary Docker host, media server, IDS sensor, and Cloudflare tunnel endpoint for the entire stack. Administered entirely headless: no BMC, no IPMI, no remote console.
- CPU
- Intel i5-8500B · 6 cores
- RAM
- 62 GB
- ROLE
- Edge · Docker · tunnel · media
- CONTAINERS
- 36 active services
Six 10TB-class drives in a DAS enclosure plus a 14TB external, pooled with mergerfs under an mfs create policy and a global free-space floor, so no single drive can fill. Presented to every service as one path.
02Workstations & Cluster Nodescross-platform · Tailscale mesh
ryzenbert
CachyOS (Arch-based, performance-tuned) · Hyprland Wayland compositor · ThinkPad P14s Gen 5 · daily driver and fleet control node.
microbert0
k3s control plane · Dell OptiPlex 7060 · i5-8500T · Ubuntu 24.04 · Kubernetes API and scheduler.
microbert1
k3s worker · Dell OptiPlex 7060 · i5-8500T · Ubuntu 24.04 · runs cluster workloads and holds the restic repository.
ATCbert
Windows 11 · MSI · i7-12700K · 64GB DDR5 · RX 9060 XT 16GB · main desktop.
Kali Pi 5
Kali Linux · Raspberry Pi 5 · 16GB · security tooling and hands-on practice node.
MBP M4 Pro
macOS · Apple Silicon M4 Pro · 24GB unified memory · zsh with a Homebrew-managed toolchain, used for local development and administering the fleet over the mesh.
MBA M1
macOS · Apple Silicon M1 · 8GB unified memory · same zsh and Homebrew setup kept deliberately lean, serving as the travel and second-screen client on the mesh.
School laptop
Windows · Dell Precision 5570 · NVIDIA A2000 · DDR5 · WGU coursework machine.
03researchbertDell Precision 7820 · live
Dual-socket workstation tower · ZFS backup target
Runs Ubuntu Server 24.04 as the fleet's ZFS backup store. The bulk pool is a mirrored vdev holding every host's restic repositories, snapshotted every 15 minutes with sanoid and scrubbed monthly, then replicated onward to a secondary SSD and pulled to a third node — a three-stage chain with dead-man's-switch monitoring. Also serves NFS for the Kubernetes cluster's distributed storage. Xeon Gold 6128 · 40GB DDR4.
04bertcomputedual-socket Xeon tower · live
Identity, observability, and productivity core
A server-class workhorse running Ubuntu 24.04 — dual Xeon E5-2630 v3 (16 cores / 32 threads), 125GB RAM. Runs roughly 40 Docker containers: Authentik SSO/OIDC fronting the lab's services, the Grafana + Prometheus + Loki observability stack, NIPAP for IP address management, Vaultwarden, Immich, Paperless-ngx, Mealie, code-server, and Joplin Server — every one Linux-native and reproducible from compose.
05Automationinfrastructure as code · Ansible
Ansible — the fleet as a version-controlled artifact
The inventory is the source of truth, held in Git and split deliberately: a managed group the automation may patch, and a control group — daily driver, Windows desktop, laptops — that is only ever updated by hand. That separation is structural rather than a comment, so a control node cannot be swept into a fleet-wide upgrade by accident. Playbooks cover patching, SSH hardening, firewall rules, and read-only reconnaissance; secrets live in SSH keys rather than a vault, and the wrapper scripts refuse to run against uncommitted changes.
labupdate
One command runs a coordinated, idempotent update across every managed host regardless of OS, detects which machines need a reboot, and renders a report. Control nodes are excluded by design, not by remembering to type --limit.
labrecon
Read-only sweep of the whole fleet — open ports, service status, node health, Tailscale state — rendered to Markdown and pushed straight into a Joplin note. Infrastructure documentation that rewrites itself instead of going stale.
lab-anomaly — anomaly detection
A CPU-only Python service on bertcompute that scores the fleet every 30 minutes and stays completely silent unless something is genuinely off. Three detectors: metric drift using robust median/MAD statistics rather than mean and standard deviation, because half the series are burst-heavy; log-shape anomalies in log10 space, catching both a host falling silent and a log storm; and an isolation forest over Suricata flow records, which asks whether a combination of bytes, ports, direction and protocol is unusual rather than any single value. Tuned against live data until the false-positive count reached zero, and self-tested against synthetic faults so that a quiet night is evidence rather than an assumption.
Scheduled operations
Roughly 35 systemd timers and cron jobs across the fleet, deliberately placed on always-on hardware rather than a laptop: a staggered backup chain with dead-man's-switch push monitoring, SMART health watchdogs, a routing guard that alerts if any host stops preferring its wired link, and container image-update watchers.
06Service Stackself-hosted · containerized · open source
Roughly 80 containers across five Linux hosts — each defined in version-controlled Docker Compose, reachable only over the private mesh or an outbound tunnel, and rebuildable from a single file.
Media
Jellyfin · Jellystat
Sonarr · Radarr · Lidarr
Bazarr · Prowlarr · Recyclarr
SABnzbd · qBittorrent behind Gluetun
Unpackerr · Flaresolverr
Seerr · Wizarr
Audiobookshelf · ErsatzTV
Security & Identity
Authentik SSO / OIDC
Vaultwarden
Suricata IDS
CrowdSec · Wazuh agents
AdGuard Home DNS · dual
lab-anomaly · detection
CyberChef
Productivity & Storage
Nextcloud
Immich · photos
Joplin Server
Paperless-ngx · Mealie
Syncthing
Stirling PDF
Backrest · restic backups
Platform & Ops
Grafana + Prometheus + Loki
Uptime Kuma → ntfy alerts
Homepage · Glance dashboards
Dozzle · Diun · Beszel
Scrutiny · Dockhand · cAdvisor
Gitea · code-server
ntfy · Apprise · NIPAP
07Open Source Stackthe whole point
Open source isn't a cost-saving measure here — it's the philosophy the lab is built around. Transparency, community ownership, and the freedom to self-host without asking permission. No vendor lock-in, no phone-home telemetry, no subscription to run software on your own hardware.
CachyOS
operating system
Arch-based rolling release tuned for performance — BORE-scheduler kernel, x86-64-v3 packages. Full control over every package, no defaults you didn't choose.
Ubuntu 24.04 LTS
operating system
The long-term-support backbone on every server and edge node, including the T2 Mac Mini via a community kernel. Predictable, boring, rock-solid Linux.
Kali Linux
security platform
Purpose-built penetration-testing distribution on the Raspberry Pi 5 node, used for hands-on security practice.
Hyprland
desktop environment
Wayland compositor on the daily driver. Tiling window management, custom rice, dotfiles kept under version control like everything else.
k3s / Kubernetes
orchestration
A lightweight two-node cluster with Longhorn distributed storage and MetalLB load balancing — real orchestration, learned by running it rather than reading about it.
Docker
containerization
Every service runs in a container. Reproducible, portable, rebuildable from compose files held in version control.
Ansible
configuration management
The fleet defined as code in a Git-backed inventory. Agentless, idempotent, and honest about which machines it is allowed to touch — patching, hardening and recon all run from the same source of truth.
Tailscale
networking
Zero-config WireGuard mesh connecting every node privately, with SSH authorised by network ACL rather than static keys. No exposed ports, no port forwarding.
ZFS · mergerfs
storage
Two filesystems for two jobs — ZFS with snapshots and scrubs where integrity matters, mergerfs where capacity and simple expansion matter.
Authentik
identity provider
Self-hosted SSO/OIDC fronting Vaultwarden, Grafana, and Gitea. One login, no third-party identity broker.
Suricata
network security
Open source IDS on the edge node, shipping structured JSON events into the log stack so alerting can parse fields rather than substring-match noise.
scikit-learn · pandas
analysis
The whole anomaly-detection stack runs on open source numerics, on CPU, on hardware already paid for. No API keys, no per-query cost, no data leaving the mesh.
Grafana
observability
Dashboards pulling from Prometheus and Loki, authored as idempotent scripts. Full visibility across every node.
Gitea
version control
Self-hosted git forge with a CI runner in the cluster. Repositories that don't live on someone else's servers by default.
Jellyfin
media server
Fully open media server. No tracking, no required account, no phone-home, no tier that unlocks features you already own the hardware for.
Nextcloud
cloud storage
A personal cloud that actually belongs to you, replacing proprietary storage with something self-hosted and backed up.
08Continuing Educationformal + self-directed
Western Governors University
B.S. Cybersecurity & Information Assurance
Pursuing a degree in cybersecurity and information assurance, alongside four years of hands-on practice across a live multi-node environment.
Certified Addiction Technician
Addiction counseling & support
A parallel path in addiction support and counseling — a personal commitment to community service that runs alongside the technical career.