
A private cloud and homelab architecture using Tailscale, Caddy, private DNS, browser-trusted TLS, nftables, and DOCKER-USER filtering to keep internal services reachable to trusted devices only.

A self-hosted DNS filtering setup built on Docker Engine with host networking for per-device query visibility, Tailscale peer routing for tailnet-wide filtering, and internal HTTPS through Nginx Proxy Manager backed by a private Root CA.