Self-Hosted AI Infrastructure Platform

The platform follows a layered self-hosted AI architecture designed for security, scalability, and operational flexibility. External users access services through Cloudflare Tunnel, which securely connects to the private Ubuntu Server environment without exposing internal services directly to the internet.

This platform monitors itself: a live status dashboard at /infrastructure groups the production containers into applications, automation and AI services, and databases, and runs a health check on each one. Services on the shared Docker network get a real HTTP probe with a timeout (n8n, OCR, Ollama, speech-to-text, PDF rendering, TALA and NCCT Reports). Services on isolated networks, such as the blog and the databases, are checked through Docker's own health state, so the portfolio never needs a route into them. A 401 from an app behind Cloudflare Access counts as healthy, because it proves the app is answering. Latency is reported per check — no third-party monitoring service, just a Next.js API route checking the same containers it's sitting next to.

It's a deliberately small piece of infrastructure, but a concrete one: open the dashboard and see actual, current status rather than a static claim about uptime.

Instead of exposing internal applications directly through firewall ports, Cloudflare Tunnel creates an encrypted connection between the private infrastructure and external users.

This architecture reduces attack surface while allowing secure access to services such as n8n automation and portfolio applications.

Automation credentials follow the same least-privilege principle: the n8n daily-briefing workflow reaches the host through its own dedicated SSH key rather than a personal one, restricted with a forced command on the server side so that key can run exactly two whitelisted, read-only operations — nothing else, even if the credential itself were ever compromised.

Not every service runs in a container, and that's deliberate: the two highest-traffic production applications run as systemd-supervised bare processes directly on the host instead of Docker, trading container isolation for simpler logs, faster restarts, and one less layer between a source change and the running process — a call made per-service based on operational needs, not a blanket rule.

This isn't a lab environment for one demo — it's the production backbone for a portfolio of real, independently-running applications.

Every public hostname is routed through a single Cloudflare Tunnel config — no inbound firewall ports opened on the host at all.