~/infra
One VPS, one Traefik instance, reachable only from the home network or Tailscale, with real certs from OVH's DNS API — no PaaS, no managed Kubernetes. This very site is the exception: it ships straight to Vercel.
Every self-hosted project and home lab app on this page shares the same five pieces.
Public DNS resolves every *.maelbelliard.fr host, but none of it is forwarded to the public internet — the router only accepts these connections from the home network or the tailnet.
A private mesh VPN — together with the home LAN, the only two ways in. My laptop and phone reach the VPS over the tailnet when I'm out, or straight over Wi-Fi when I'm home — never through the public router.
One reverse proxy instance for the whole host. Routing is decided purely from each container's Docker labels — nothing to hand-edit per service.
Every host gets a real Let's Encrypt certificate issued through OVH's DNS API (DNS-01). No port-80 challenge needed, so names that are never reachable from the internet still get valid, trusted HTTPS.
Single host, one compose stack per project or app, every container attached to a shared external network so Traefik can reach it.
Everything in /services, routed through that same stack — restricted to me, not a public demo. Status pulled live from GitHub where a repo exists.
Open-source net worth tracker — self-hosted or as a desktop app for Windows/macOS/Linux — with real support for French tax-advantaged accounts (PEA, assurance-vie), real estate, and debts.
Vue · Nuxt UI · FastAPI · PostgreSQL · Docker · Tauri
A personal dashboard listing everything self-hosted here — search and filter by tag, backed by Postgres. No public repo, so no CI badge or stars to show.
Nuxt · Prisma · PostgreSQL
This site's own dev container lives here too — a hot-reloading preview behind the same Traefik + Tailscale gate. Not the page you're reading right now.
↓ how this site shipsThe rest of what runs on that same host, for personal use — everything in /docker, on the same Traefik + Tailscale + OVH setup.
This is the one exception to everything above — it doesn't stay on the VPS.
local / dev
A docker-compose service, source mounted as a volume for hot reload, routed by the same home Traefik instance as everything else — reachable only over Tailscale, at whoami.maelbelliard.fr. It's a live preview of work in progress, not the public site.
production
release checking… Pushing a tag like v1.0.0 triggers GitHub Actions: lint, typecheck, vercel build --prod, deploy, then a GitHub Release with a changelog generated from Conventional Commits. That's what's actually live at www.maelbelliard.fr.