CaveTown

Cavechicken, callsign SHEN

Ext;Gate outside.
The Lab at home.

I use Cavechicken online, and SHEN is shorthand from my initials. Ext;Gate is my rented server for services that need to stay available. The Lab runs on hardware at home, where I test ideas, automate work and learn how the pieces fit together.

See what runs where My GitHub

Online identityCavechicken

Operator initialsSHEN

ExternalEXT;GATE

InternalLAB

Worldline console 01

One timer. Three possible readings.

Power the console to open a one-minute change window. At zero, the meter scans the Alpha and Beta ranges and locks one reading. The singular 1.048596 result is possible, but rare.

Change-window timer
BACKUP READY. SET TIMER OR ACTIVATE MICROWAVE. Enter SS, MM:SS or HH:MM:SS. The buttons change five seconds; arrow keys and a focused mouse wheel also work.
Microwave standby. Current reading stable. Microwave active. Change window counting down.
Current worldline reading1.048596DIVERGENCE METER STABLE
Alpha attractor field: Ext;GateExt;Gate keeps mail, voice, games and sign-in services online.
Beta attractor field: the LabThe Lab is where I test storage, networks, identity and automation.
Steins Gate worldlineExt;Gate remains dependable while the Lab remains free to change.
ALPHA0.000000–0.999999BETA1.000000–1.999999STEINS GATEexactly 1.048596

Systems

What runs on Ext;Gate and in the Lab

This is the public overview. I leave versions, addresses and the internal layout out on purpose.

EXT;GATE Services that stay onlineRented serverExt;Gate hosts mail, TeamSpeak, rotating game servers, Passbolt and MAS for Matrix and Element sign-in. AdGuard handles external DNS, while Prometheus and Grafana show me how the server is doing.
LAB Compute, storage and recordsHardware at homeProxmox VE runs the virtual machines and containers, and TrueNAS provides dedicated storage. NetBox records the infrastructure, GitLab holds code and projects, and Paperless manages documents.
LAB Network, identity and monitoringInternal servicespfSense is the gateway and firewall, PowerDNS answers internal DNS and Traefik routes Lab services. Samba AD DC manages accounts, Authelia provides SSO, and Zabbix monitors the Lab.
SHARED CONTROL Secrets, automation and accessAcross both environmentsOpenBao manages secrets and PKI. Ansible and Terraform make changes repeatable, while separate WireGuard profiles keep different kinds of remote access apart.
IN DEVELOPMENT Private workflowsCurrent experimentI am preparing n8n for internal workflows and experiments with a private AI assistant. It is a Lab project, not a public service.

Current work

Things I am working on

The systems are useful to my family and friends, but they are also how I learn. When something goes wrong, I document the fix and make the next change easier to repeat.

External operations

Keeping Ext;Gate dependable

I update public services carefully, keep protected backups and test recovery. Abuse filtering reduces noise without replacing secure configuration.

Infrastructure lifecycle

Proxmox and NetBox workflows

I am connecting inventory, configuration and running systems so a workload can be planned, checked, deployed and later rebuilt without guesswork.

Identity and PKI

TrueNAS identity and certificates

I am bringing central accounts, storage permissions and internal certificates together while keeping access and ownership easy to understand.

Automation and experiments

Making the safe path the easy path

Automation handles repeatable work. DNS, monitoring, documents and smaller experiments give me room to try ideas without risking the services people use.

About me

Cavechicken SHEN

Cavechicken is the nickname I use online and with friends. SHEN comes from my initials. I started the Lab because I wanted more control over my services and data, and because running real systems teaches me more than reading about them alone.

Away from terminals, I enjoy hiking, playing guitar and bouldering.

GitHub Discord community hello@cavetown.de

01Keep the split clearExt;Gate is for availability. The Lab is for learning and private infrastructure. Connections between them are deliberate.

02Test the restoreSnapshots and backups are useful only when I can restore them. Recovery steps are documented and practised.

03Monitor what mattersMonitoring, SSO, MFA, internal certificates and limited automation accounts should make the systems easier to understand and safer to run.