Homelab

A Familiar Voice at the Front Door When someone presses the front doorbell, it can now greet a recognized visitor by name: “Welcome, Sam.” Inside the house, the Sonos speakers and HomePods announce, “Sam Carter is at the front door.” An unrecognized visitor receives no spoken greeting from the doorbell; the household receives a neutral announcement during the configured waking hours. The reference faces come from our family photo library, where Immich already maintains the names and photographs needed for enrollment. ...

Introduction Hermes is the agent I use when a conversation has to reach the infrastructure. I address @hermes:white.fm in an end-to-end encrypted Matrix room. Hermes reasons through the local model route in my cluster, then invokes a finite set of tools against services with their own operational boundaries. Three previous pieces describe the components in isolation: the local Ollama router, the encrypted Matrix notification hub, and the MCP server fleet. Hermes is where those systems meet. Matrix provides the private conversation, Ollama provides the default inference path, and Model Context Protocol (MCP) servers supply the functions through which an answer may become an action. ...

Introduction Three years ago I wrote about running a Matrix server with Docker Compose, where the interesting part was the federation-over-Cloudflare-tunnel arrangement and the observation that a Matrix homeserver makes a serviceable notification hub. That deployment has since moved into my RKE2 cluster, and the notification role has grown from a convenience into the primary reason the homeserver exists. Nearly every machine-generated message in my infrastructure now arrives in an end-to-end encrypted Matrix room. Feed digests from FreshRSS, Prometheus alerts, GitOps deployment results, Falco runtime detections, Authentik authentication events, media-library activity, uptime state changes, weather alerts, and notifications from the UniFi and Synology appliances all terminate in rooms whose contents the homeserver itself cannot read. Two AI agents also use encrypted Matrix rooms, each reserved for direct conversation with the agent. ...

A Reusable Access Layer I first built pages, a static-site host with an MCP upload tool. It was useful enough that I kept repeating the design. The cluster now has ten MCP servers: congress-mcp, freshrss-mcp, googlenews-mcp, gsc-mcp, jetlog-mcp, media-mcp, monica-mcp, nodebyte-mcp, pages, and the Kubernetes server. Each server fronts one self-hosted application. The similarity is intentional. They share the manifest layout, bearer-token boundary, hostname convention, and deployment path. Adding the tenth took about forty minutes, most of it spent writing the tool descriptions that decide whether a client can use the server sensibly. ...

Introduction Nine namespaces in my cluster send work to a local language model. The SDR research stack tags transcriptions, the politics dashboard summarises feeds, the congressional-trade tracker prepares daily summaries, and several agents submit work throughout the day. They all call one stable hostname on port 11434. Behind it are two very different Ollama deployments. The primary is an RTX 5090 in a desktop tower that I deliberately power down at intervals. The fallback is an NVIDIA GB10 Spark board, where CPU and GPU share memory and GPU allocations count against the pod’s memory limit. The repository also contains a CPU-only manifest, although the active Kustomization excludes it. The Spark is the backend that remains when the tower is dark. ...