## TL;DR - The scaffolding is done, so here is the honest inventory: the apps that moved in are few, and the list is short on purpose. - Two reasons decide what gets hosted: it serves a privacy purpose (the mail server, the git server), or it pays for its place. Everything else waits, because self-hosting everything is possible and expensive in the only currencies that matter: time and effort. - What did make it in: [Forgejo](https://forgejo.org) with runners, bringing repo ownership home, and [Open WebUI](https://github.com/open-webui/open-webui) plus Hermes keeping AI conversations and files at home - local [Ollama](https://ollama.com) embeddings, ZDR providers only for the rest. - The first self-devved app is in progress: something to run models on the cluster, and the natural trigger for the ApplicationSets dev/live model. - The plan on the horizon: pointing Hermes, my coding agent, at Forgejo to coordinate long-lived coding tasks - the estate becoming a place where software gets written, not just run. ## The inventory Time to open the doors and count the residents. I've been putting this post off, and the reason for the delay is the honest part: the list is short. After twenty-one posts of scaffolding - storage classes, identity, backups, GitOps, a network border drawn three ways - you'd expect a mansion full of tenants. The reality is a house with a few very deliberate residents. And I think that's the more useful story to tell. The homelab internet is full of self-hosting victory laps: forty apps on a dashboard, mostly opened twice and forgotten. The count feels like the achievement. It isn't. The achievement is that each thing that lives here *earns* its place, because every resident is one more thing to patch, back up, monitor, and eventually explain to myself at 2am. ## Why so few: two filters Two filters decide what gets hosted here, and most candidates fail both. The first filter is privacy purpose. The estate exists, at its core, so that the things that carry my life - mail, code, identity, files - live on hardware I control, under policies I set, encrypted the way I want, with retention I decide. [Stalwart](https://github.com/stalwartlabs/stalwart) got a post because mail is the crown jewel of that argument. Forgejo is in that same category: my repos, my metadata, my history. These aren't apps I *prefer* to self-host; they're apps that make the whole exercise coherent. If they don't run here, the estate is a hobby. If they do, it's a position. The second filter is the one nobody warns you about: the cost of getting a thing to work fully self-hosted is enormous and it's not negligeable, so be it. Every service that makes it in arrives with its own private tax - the SSO integration, the backup path, the monitoring, the storage class choice, the upgrade procedure, the question of what happens when it's down. The engineering is the fun part. The *ops* is the part that multiplies. Anyone setting out to self-host everything: brace yourself. It yields a lot, but the bill is paid in the one resource a homelab never mints more of, which is time. So the bar for entry is not "is this nice to have." It's "does this justify its operational rent." The result of the two filters, applied honestly: not much, if anything at all, beyond what the cluster needs for itself. And I've stopped feeling bad about that. ## What made it in Three residents, then, and they're instructive precisely because they're few. Forgejo, with runners now. Post 17 told the story of the GitOps loop and the small satisfaction of the cluster deploying from a forge that runs on the cluster. The runners are the second half of that sentence: CI executing at home too, so the loop - push, build, deploy - runs entirely on my metal, end to end. This is the "bring repo ownership home" project in its final form. Every repository that migrates off GitHub takes one more piece of my development history out of a platform that gates basic features like SSO behind a paywall, and the runners mean it's not just hosting the code anymore, it's building it. The recursion from post 17 has a sequel: the cluster deploys from Forgejo, Forgejo tests itself, and the whole development surface lives at home. Open WebUI, which earns its place by a different route: it's half of the answer to "how do AI touch this estate without touching my privacy." Together with Hermes, my coding agent, they're how I keep conversations and files at home. Open WebUI fronts a local Ollama for embeddings - that part is fully local, full stop. The heavier conversation models, for now, come through OpenRouter, with a discipline attached: proper zero-data-retention providers only, GLM as the workhorse, and privacy guardrails around what flows out at all. The shape matters more than the specifics: the sensitive layer (embeddings, storage, the interface) is mine; what crosses the border is model inference through providers contractually forbidden from keeping it, and even that only within rails I set. It is, in a strict sense, a want rather than a need - but it's a want held to the same standard as a need. That's why it matters in the inventory: it's proof the filters are *filters* and not a cage. When something genuinely earns its place as a want, it gets in. Most wants don't, and that's fine. And the third resident isn't one yet - it's the plan that's shaping the next chapter. Forgejo's API surface, once the runners are stable, is where Hermes comes in: my coding agent, pointed at my own forge, coordinating long-lived coding tasks on my own infrastructure. Code ownership at home, then compute-for-code at home, then the agent that lives in the same house. The estate stops being only a place where software is *run* and becomes a place where software gets *written*. ## The ApplicationSet-shaped hole One gap to name while I'm being honest about inventories: I haven't devved a serious app of my own on this cluster yet - though the first one is already in progress, and it's in character for the estate: something to run models on the cluster itself. Post 17 sketched the model - ApplicationSets generating a dev and a live Application from one template, commits flowing to dev, promotion to live when dev has earned it - and it's still a sketch, because nothing of mine has needed it yet. Forgejo, runners, and Open WebUI all landed the ordinary way: manifest in the repo, policy deciding how it syncs. That first app is exactly the sort of thing the model will get its post for: an inference workload wants a dev face to break safely and a live face to serve from, and with Hermes-on-Forgejo behind it, the loop closes - an agent that writes code all day eventually writes something worth deploying twice. ## What this closes The scaffolding arc is now fully cashed. Floor, door, keys, storage, identity, deployment model, border - and now the census, short as it is. The estate has residents chosen by filter rather than by accumulation, and the two filters - privacy purpose, operational rent - are the real thesis of every scaffolding post that came before: infrastructure is not the obstacle to workloads, it's what makes each workload affordable to keep.