# MyOS — myos.io infrastructure docs

> A reproducible, self-hosted home-lab platform: a segmented OPNsense network, an AlmaLinux 9
> server fleet, FreeIPA + Authelia identity, and a privacy-first edge/origin design that serves
> public sites from rented multi-vendor VPSes while TLS terminates at home. Built to be rebuilt
> from a clean install and followed by others. This file is a curated map for AI agents and tools;
> the human-facing site is organized by intent (Understand / Use / Operate / Build / Reference).

Notes: pages use `${placeholder}` tokens (e.g. `${domain}`, `${ip.dmz}`) substituted client-side
from `values.json` + reader localStorage — the raw Markdown shows the tokens. The authoritative,
non-placeholdered deep reference is the design doc and the ordered runbooks under Reference.

## Orientation

- [Home](https://myos.io/): what MyOS is + persona routers into each section.
- [Understand](https://myos.io/understand/): concepts, the threat model in plain language, the edge/origin + zones + identity shape, glossary.

## Operate (maintain & extend)

- [Operate](https://myos.io/operate/): the fleet & IP map, the Ansible workflow, day-2 tasks (add VM/service, exposure tiers, egress, secrets, updates, backups, certs, DNS, observability), and superadmin oversight (credential custody + kill switch). Superadmin framing on top; exact commands in collapsible blocks.

## Build (reproduce it)

- [Build it yourself](https://myos.io/build/): prerequisites, the ordered build path, and which values to personalize.
- [Personalize](https://myos.io/settings/): set your own domain/IPs (localStorage) so commands show your values.

## Reference (authoritative, deep)

- [Design & Decisions](https://myos.io/reference/design/): the full architecture + the *why* behind every locked decision (source of truth).
- [Runbooks index](https://myos.io/reference/runbooks/00-index/): the ordered, step-by-step build/operate guides (provision → firewall → VPN → identity → SSO → edge → extras).
- [Ansible role: origin_caddy](https://myos.io/reference/roles/origin_caddy/): the origin TLS terminator + edge WireGuard client.
- [Ansible role: bind_primary](https://myos.io/reference/roles/bind_primary/): the hidden authoritative DNS primary.
- [Ansible role: vps_edge](https://myos.io/reference/roles/vps_edge/): the public edge (SNI passthrough + DNS secondary).