Skip to content

MyOS

MyOS is a complete, reproducible home-lab platform — a segmented home network and firewall (OPNsense), a small server fleet (AlmaLinux 9), central identity (FreeIPA + Authelia single sign-on), and a privacy-first edge/origin design that serves public websites from rented mini-servers while the encryption keys and real data never leave home.

It is built to be rebuildable from a clean install and followable by anyone. These docs are written so you can stand up the same system yourself — wherever you see a placeholder like ${domain} or ${ip.dmz}, you plug in your own values and the whole site adapts to them.

Make this site yours

Open Personalize and enter your own domain and network details once. Every command and config on the site then shows your values — and the copy button copies them too. Nothing leaves your browser. Leave it alone and the site reads with the myos.io reference values as worked examples.

Start here

Pick the door that matches what you're here to do — each one routes you into the right depth.

  • I'm new — what is this?

    Concepts, the threat model in plain language, and the shape of the system.

    → Understand

  • I just use the apps

    Sign in, find your apps, change your password, add an SSH key, connect the VPN.

    → Use

  • I run this lab (or I'm the agent)

    The fleet map, the Ansible workflow, day-2 tasks, decisions, and machine-readable reference.

    → Operate

  • I want to build my own

    Prerequisites, personalize your values, then the ordered, reproducible build path.

    → Build it yourself

The shape of it

  • The ISP is treated as an adversary. All outbound traffic (clients and servers) leaves through a VPN with a fail-closed kill-switch, so the ISP can't profile it.
  • Public sites are served from the edge, but decrypted only at home. Thin, multi-vendor edge servers do TLS-SNI passthrough over WireGuard to an origin server at home that terminates TLS — no rented-server vendor ever sees plaintext.
  • Everything is segmented. Default-deny trust zones (management, servers, the public-facing DMZ, workstations, IoT, guests) contain the blast radius of any one compromised device.
  • One identity, everywhere. FreeIPA (LDAP/Kerberos/CA) plus Authelia SSO give one login for apps, SSH, and your home directory.

Deeper reference — the full design rationale, the ordered runbooks, and the Ansible role docs — lives under Reference. The audience sections above link down into it rather than repeating it.