Homelab From Scratch

Encrypted .env files committed beside the compose files that use them: per-machine keys, per-file recipient rules, the one backup that cannot live inside the lab, and the git-diff habit that catches every near-miss.

A repo layout that scales past 60 services without becoming a junk drawer: the infra/app split, four reusable service-file patterns, and naming conventions that do the remembering for you.

Domain-per-purpose, two wildcard records that mean you never touch DNS again, and scoped API tokens so no leaked credential can take the whole thing down.

Years of accumulated server cruft, three boxes that each grew their own personality, and the decision to tear it down and rebuild as one git repo. The architecture, the rules, and why.