project — infrastructure

free always-on cloud infra

a production-grade data plane running entirely on Oracle's free ARM tier — Docker, Postgres, monitoring, backups, and secure remote access. zero monthly cost.

what's running

compute

Oracle A1 ARM

4 OCPU / 24 GB RAM — free forever on Oracle Cloud's always-free tier.

database

Postgres 16 + pgvector

standard Postgres with vector search support. binds to localhost only — never public.

monitoring

Uptime Kuma

self-hosted uptime monitor at monitor.elevenbaselab.com.

networking

Cloudflare Tunnel

outbound-only tunnel — zero inbound ports open on the public IP.

access

Tailscale

WireGuard mesh for SSH. public SSH on port 22 restricted to the tailnet only.

backups

restic → Backblaze B2

nightly encrypted Postgres backups to B2. 7 daily + 4 weekly + 3 monthly snapshots.

runtime

Claude Code + tmux

persistent AI coding sessions reachable from any device over Tailscale. Remote Control active.

ai gateway

LiteLLM

provider-agnostic LLM proxy. routes Claude Code, Open WebUI, and OpenCode through one endpoint. OAuth passthrough preserves Pro auth.

observability

Langfuse

self-hosted LLM tracing. every session, token count, cost, and model logged. accessible on the Tailscale network.

chat ui

Open WebUI

local chat interface routing through LiteLLM. cross-session memory via ChromaDB. SSH port-forward for access.

data pipeline

Session import

delta-aware pipeline imports Claude Code JSONL and OpenCode SQLite into Postgres. self-heals DQ issues on every run.

self-learning

MCP Postgres

Claude queries its own session data mid-conversation. 105 sessions, 15k messages, session titles and tool traces stored.

design principles

01

reuse over build

every component is proven open source — official Docker images, published binaries, standard tools. the only custom code is thin glue: a compose file, a backup script, small configs.
02

zero inbound ports

nothing listens on the public IP. all service ports bind to 127.0.0.1. Cloudflare Tunnel dials outbound. SSH is Tailscale-only. the box is invisible to the public internet.
03

secrets never in git

all credentials live in .env files on the box, chmod 600, gitignored. passwords are generated on the box — never echoed or sent over the network in plaintext.
04

prove the negative externally

a service can bind 0.0.0.0 on the host and still pass an on-box check. every network change is verified with an external port scan from a remote machine — not just inspecting local bindings.

public hostname routing

hostname	routes to
elevenbaselab.com	Cloudflare Pages — this site
monitor.elevenbaselab.com	Cloudflare Tunnel → Uptime Kuma on Oracle
api.elevenbaselab.com	Cloudflare Worker → Oracle backends
models.elevenbaselab.com	Cloudflare Tunnel → Ollama on Mac Mini

build log

system update done
Tailscale install + join done
firewall + SSH hardening done
close public SSH done
Docker + Compose done
Postgres + Uptime Kuma done
Cloudflare Tunnel done
restic → B2 backups done
Claude Code + tmux done
LiteLLM + Langfuse done
Open WebUI done
AI session import pipeline done
MCP self-learning loop done
Cloud Mac data sync pending