Shell · Docker Compose · Raspberry Pi · restic
Lares
Boring, recoverable infrastructure for the home.
A small self-hosted stack — DNS, file sync, passwords, monitoring, backups — designed backwards from the assumption that the machine will eventually die.
Updated from public sources ·
Designed around the failure, not the service list
State is snapshotted through SQLite with locks held, checked with integrity_check, and promoted only once it verifies; a failed vault snapshot fails the job instead of shipping stale data. Images are pinned by digest, every administrative interface binds to localhost and is published only over Tailscale, and rebuilding from a blank disk is a scripted path rather than an afternoon of remembering.
Verified at the kernel, explicit about scope
The verification script checks behaviour rather than configuration: the cgroup’s memory.max rather than compose’s mem_limit, a genuinely filtered DNS answer rather than a running container, snapshot age rather than an existing timer. Tested on Raspberry Pi OS and on a blank Debian 13 host; the design generalises, the bootstrap script does not yet.