Infrastructure overview

Three hosts, connected by a shared Tailscale tailnet, named after Archer characters:

Host	Role	Where
Lana	Cloud VPS — runs every self-hosted app	Hetzner/DigitalOcean-class VPS, public IP
Krieger	Home GPU machine — local LLM inference, image generation	Home network, Windows
Pam	Synology NAS	Home network

Lana is the only host with a public IP and the only one directly reachable from the internet — and even then, only through a Cloudflare Tunnel, never via an exposed port. Krieger and Pam are both home-network-only, reachable from Lana (and from each other) purely over Tailscale.

Why this split

• Lana needs to be always-on and internet-facing, so it runs on a VPS rather than at home — no need to expose the home network directly, no dependency on home internet uptime for the things that need to stay up (git, docs, project tracking).
• Krieger does the GPU-heavy work (local LLM inference via Ollama, image generation via ComfyUI) that isn’t practical or affordable to run on a rented VPS. It’s normally asleep and gets woken on demand — see Krieger for how that works.
• Pam holds local storage/backups on the home network.

Where to go next

• Lana — the VPS and everything running on it
• Krieger — the GPU host and wake-on-demand setup
• Pam — the NAS
• Networking — Tailscale + Cloudflare Tunnel/Access/Pages/DNS, all in one place
• Services — the full list of what’s running on Lana and where