Skip to content

Understand MyOS

This section is for the curious newcomer. No commands — just what MyOS is, why it's built the way it is, and the shape of the whole thing. If you want to use the apps, jump to Use; if you want to build it, see Build it yourself.

What it is

MyOS is a self-hosted platform that runs on hardware you control. It bundles four things that usually live in separate worlds:

  1. A segmented home network — a firewall (OPNsense) that splits the network into trust zones, so a compromised phone or smart bulb can't reach your servers.
  2. A small server fleet — a handful of AlmaLinux 9 machines running your apps (files, media, git, search, notifications, dashboards…).
  3. Central identity — one account per person (FreeIPA + Authelia single sign-on) that works across the apps, SSH, and your home directory.
  4. A privacy-first public edge — the way your public websites reach the internet without handing your traffic, or your data, to companies positioned to monetize it.

The threat model, in plain language

Most "security" talk is about spies and nation-states. MyOS defends against something far more ordinary and pervasive: profiling for profit. The companies that carry your traffic — your ISP, and the VPS vendors who rent you servers — are positioned to log, sell, and build behavioral profiles from what passes through them. MyOS treats them as adversaries in exactly that narrow sense: not evil masterminds, just parties who will harvest your data by default unless the design denies them.

Two consequences drive almost every decision:

  • The ISP shouldn't see your traffic. So all outbound traffic — from your laptop and from your servers — leaves through a VPN, with a kill-switch that fails closed (if the VPN drops, traffic stops rather than leaking to the ISP).
  • The VPS vendor shouldn't see your data. So when you host a public website, the rented server only forwards encrypted bytes. The decryption happens at home.

The shape of it

                 the internet
                      │
        ┌─────────────┴─────────────┐
        │   edge servers (rented,    │   ← only see encrypted traffic;
        │   multi-vendor mini-VPS)   │     do dumb TLS-SNI passthrough
        └─────────────┬─────────────┘
                      │  WireGuard tunnel (home dials OUT)
                      │
        ┌─────────────┴─────────────┐
        │   home: origin server      │   ← terminates TLS here, where you
        │   (decrypts, checks SSO)   │     control the keys
        └─────────────┬─────────────┘
                      │
        ┌─────────────┴─────────────┐
        │  segmented internal zones  │   ← default-deny between zones
        │  (servers, workstations,   │
        │   DMZ, IoT, guests…)       │
        └────────────────────────────┘

Edge / origin — why public sites are split

A rented mini-server (an "edge") sits at a public IP and accepts connections, but it cannot read them: it matches only the destination name in the still-encrypted handshake and forwards the encrypted stream, over a private WireGuard tunnel, to the origin server at home. The origin holds the certificates and does the decryption. The home connection dials out to the edge, so your home IP is never exposed and nothing inbound is opened on your home line (except one locked-down admin VPN port). Run the edge across several vendors and no single one can even see which sites are busy.

Trust zones — why everything is segmented

A flat network means one hacked device can reach everything. MyOS uses default-deny zones — a device can only talk to what it's explicitly allowed to. The two highest-impact zones (the management plane that controls the infrastructure, and the public-facing DMZ) are kept furthest from the least-trusted devices (guests, IoT, anything that leaves the house).

One identity, everywhere

Instead of a separate password per app, there's one directory (FreeIPA) and one sign-on (Authelia). The same ${domain} account logs you into the web apps, SSH, and your network home directory. Admins are centrally managed; people can be added, grouped, or removed in one place.

Reproducible by design

Nothing here is hand-tuned snowflakes. The machines are cloned from one template and configured by Ansible (code), so the whole system can be destroyed and rebuilt from the repository. That same property is why you can reproduce it — the build steps are the same code that runs it.

A small glossary

Term What it means here
Edge A rented mini-server at a public IP that forwards encrypted traffic; sees no plaintext.
Origin The server at home that terminates TLS and reverse-proxies to the real apps.
Zone A network trust boundary (management, servers, DMZ, workstations, IoT, guest).
Tier 0/1/2 A service's exposure: public, public-with-login, or private (LAN/VPN only).
SSO Single sign-on — log in once (Authelia), reach every app you're allowed.
FreeIPA The identity core: directory + Kerberos + certificate authority + DNS.
Split-horizon DNS A name like jellyfin.${domain} that resolves only on your network/VPN.

Where to go next