Architecture
Internet
HTTPS 443
Raspberry Pi 5 · Docker
Proxy
Traefik · TLS auto
Portal
Nginx, this site
Accounts
Authentik, OIDC
Brain MCP
Python
Pantry MCP
Python, Grocy
Technical choices
One account for every service
Players sign in with Google or Discord, through a single OIDC identity provider. No local password to protect.
Admin never exposed
No admin interface is reachable from the Internet: they only answer on the private network.
HTTPS without thinking about it
A wildcard certificate renewed automatically through a DNS challenge: a new subdomain is served over HTTPS as soon as it is deployed.
One repository per service
Each service has its own repository, compose file and a README that is enough to bring it back into production from scratch.
What I took away
Authentication, above all. OIDC looks simple on paper, but between login flows, social providers and isolating services from each other, that is where I spent the most time, and learned the most.
Then, operational discipline: on a single machine, every service must be rebuildable from its repository and README, without relying on memory of what was done by hand. And a Raspberry Pi keeps you lean: ARM64 images, little memory, no superfluous service.
If I did it again, I would automate deployment earlier instead of keeping manual steps while the architecture settled.