LWS Lab

Self-hosted ops for Lima Web Studios

slides.limawebstudios.com 2026-05-18 · Reveal.js

Press → to start · ? for help

Two purposes, one stack

🧪

Lab dogfood

Replace SaaS deps. Learn the failure modes by running them.

GitHub → Forgejo
Google Analytics → Plausible
Sentry → GlitchTip
1Password → Vaultwarden

🤖

Agent operations hub

MC + Paperclip orchestrate the agents on top of the substrate.

9 OpenClaw agents
Hermes (lws profile)
Claude Code (Mac mini)
5 utility agents

The 4-host fleet

flowchart LR subgraph Active["Active (2026-05-15)"] Mini["Mac mini M4
16 GB · 10W idle"] Studio["Mac Studio M3 Ultra
96 GB · 15W idle"] I7["lws-i7
32 GB · 2 TB · 35W"] end subgraph Queued["Queued"] Nas["lws-nas
TrueNAS + 12 TB"] I5A["lws-i5-a
tier-2 apps"] I5B["lws-i5-b
CI + staging"] I9["lws-i9 tower
+ GPU + 64 GB"] end style Active fill:#065f46,color:#fff style Queued fill:#374151,color:#fff

· 3 hosts live · 4 queued
· ~22 containerized apps across lws-i7
· Mac mini = orchestrator · Mac Studio = inference · i7 = prod hub

Who reaches the lab

Humans (1)

Rudy · admin · full access

Agents (~16)

Claude Code (Mac mini)
Hermes (lws profile)
9 OpenClaw: Max · Sau · Leo · Archi · Neto · Mark · JARVIS · Tito · Beto
5 utility agents

External webhooks (~48)

GitHub × 32
Vercel × 16
All land on hooks.lima.to (n8n)

🚧 Future

Family (2-5) · Plex / Immich
Clients (1-5) · status pages

Three access tiers

🌍 PUBLIC 3 apps

Internet via Cloudflare Tunnel

analytics · errors · hooks

🔒 TAILNET 17 apps

Tailnet + LAN via AdGuard

auth · git · n8n · mc · paperclip · kb · vault · …

🔐 HOST-LOCAL 3 services

Loopback only (or tailnet bind)

postgres :5432 · openclaw :18789 · MCP stdio

Every app belongs to exactly one tier · no app on two tiers

Auth model — three flavors

🔐

Authentik OIDC

4 wired · 8+ planned

git · errors · affine · vault

🔑

App sessions

per-app cookies

mc · paperclip · plausible · n8n · mail

🗝️

Keys & tokens

machine-to-machine

MC API_KEY · Forgejo PATs · GlitchTip DSNs · TG bots · TS tags

🔒 Discipline

DB stores bot_token_env: "TELEGRAM_JARVIS_BOT_TOKEN" — never the literal token.

Network topology

Three networks stacked.

flowchart TB Internet["🌐 Internet"] CFEdge["☁️ Cloudflare Tunnel"] Internet --> CFEdge subgraph LAN["🏠 LAN 192.168.1.0/24 + Tailnet 100.x"] Mini["Mac mini (.158)"] Studio["Mac Studio (.159)"] I7["lws-i7"] end CFEdge --> I7 subgraph I7Net["🐳 lws-net (Docker bridge)"] Caddy["Caddy (21 vhosts)"] Apps["18 apps + 4 backends
(postgres · redis · manticore · clickhouse)"] Caddy --> Apps end I7 --> I7Net Mini -.tailnet.-> Caddy Studio -.tailnet.-> Caddy

Power draw & monthly cost

Idle 24×7

~$40

182 W avg

Mixed (typical)

~$61

280 W avg

Heavy

~$99

450 W avg

Node	Idle	Typical	Peak
Mac mini M4	10 W	25 W	40 W
Mac Studio M3 Ultra	15 W	60 W	120 W
lws-i7 (32 GB · 22 containers)	35 W	50 W	80 W
lws-i9 (tower + GPU) 🚧	50 W	120 W	200 W
Total (7 hosts)	182 W	377 W	625 W

Massachusetts @ $0.30/kWh · estimates pending Kill-A-Watt measurement

Roadmap — 12 months

Q3 2026

next 3 months

▸ T7 SSD as TM target
▸ TrueNAS deploy → lws-nas live
▸ i5-b + i9 workloads
▸ 12 TB drive integration
▸ Authentik SSO to 8+ apps

Q4 2026

3-6 months

▸ TM target switch TC → NAS
▸ Offsite cold rotation
▸ Restic i7 → NAS
▸ Local LLM on i9 GPU
▸ MC dispatcher v0.3

Q1 2027

6-12 months

▸ Plex + Immich production
▸ Client status pages
▸ Ansible config-as-code
▸ Lab usage telemetry
▸ k3s vs compose decision

Security boundary

What stays out of the KB.

✅

Publishable in kb.lima.to

· App names + hostnames
· Internal port numbers
· Auth modes (no values)
· Architecture diagrams + playbooks
· DB schema (no data)

⛔

Vault or .env mode 600 only

· API keys, tokens, passwords, DSNs
· Cloudflare Tunnel UUIDs
· Telegram bot tokens + allowFrom IDs
· DB password values
· Tailscale auth keys + SSO secrets

Decision matrix: if leak blast-radius > "operational annoyance" → do NOT publish.

Dig deeper

tech/lab-architecture.md

CLI → MCP → apps data flow

tech/lab-apps.md

Per-app deep dive for all 22

playbooks/use-*

Plausible · GlitchTip · Forgejo wiring

docs.limawebstudios.com/lab

Same content, scrollable web view

docs.limawebstudios.com · slides.limawebstudios.com · 2026-05-18