The services model.

The portfolio is being re-grounded on reusable services — single, provider-pluggable capabilities that surfaces compose instead of re-rolling. One messaging gate, one reporting pattern, one off-Cloudflare twin — wired once, called everywhere, swappable underneath.

This page is the substrate map: what a service is here, how a surface wires into one, the three that exist today, and why the model lowers upkeep rather than adding it.

What a “service” means here

A service is one capability behind a stable interface, with the how hidden from every caller. Three properties define it, and a thing isn't a service until it has all three:

• Composable — a surface calls it in one line and never owns the mechanism. Adding a consumer is free.
• Swappable — the provider behind it (which push transport, which storage region, which compute) changes by editing a registry line, not by touching a single caller.
• Observable — its health and output land in one place (status.gf.cx), so you can see whether it's working without reading its code.

Bolt-on per-surface = friction, drift, and surfaces that never get the treatment. Service-backed = the floor rises every time, and the upkeep is one fix instead of N.

The substrate, in one diagram

DNS is the worst place to be frozen — so the twin that keeps it resolving, registrar and all, off Cloudflare is the lynch-pin the rest of the stack hangs from.

The three services today

Kicked off by today's work — the R2 off-site mirror and the Linode cost monitor needed a push channel and a status home, and rather than hand-roll both, we extracted the services they revealed.

On naming: “backup-as-a-service” undersells it — a backup is a file you hope never to open. This is a live duplicate of the Cloudflare-resident portfolio: storage, DNS standby, and burst compute, each off-platform, each restorable cheaply. The service's job is to make the single-CF-account risk survivable.

The emerging fourth — private access

The durability twin keeps the portfolio's data alive where Cloudflare can't reach it. Tailscale is its access sibling: it keeps the new homelab box — the warm-tier Immich photo server — privately reachable off-platform too. A WireGuard mesh (a tailnet) gives our phones and laptops an encrypted path to the box from anywhere, with zero inbound holes in the router and nothing exposed to the public internet. tailscale serve already terminates real HTTPS for Immich at immich.porcupine-skate.ts.net — the off-Cloudflare access twin to the off-Cloudflare durability twin, same survivability logic applied to reach instead of storage.

It's the same provider-pluggable shape: private mesh access is a capability a surface reaches for, not a router config it hand-rolls. Today it serves one box; as the homelab grows, Tailnet Lock (peers co-sign new devices, so even a breached coordination server can't graft one on) and a subnet router (reach gear that can't run a client) extend the same access service — written up on the vault software page.

How a surface wires in

A surface that needs to report does not hand-roll a curl. It writes its status JSON + calls the gate. That's the whole contract:

Scheduling is just launchd pointing at the orchestrator — the off-site restic backup to rsync.net runs daily, the Linode monitor once (09:00 ET). Both publish a card and push a sentence. Swap the transport, change the cadence, add a fourth provider — no surface notices.

Why the model pays — the ROI

The argument for services is operational, not aesthetic. Managing capabilities gets cheaper as the portfolio grows, where bolt-ons get more expensive:

Pay as you go — the cost posture

The model has a money side, and it's deliberate: minimise standing cost, keep exit cheap. Almost every provider is metered, not committed — no regional floors, no seats, no always-on rent — and the single flat line we do keep (durable backup) is chosen on purpose, not defaulted into. An idle surface costs essentially nothing; the bill tracks what actually got used, not a forecast of it. Capacity is something you reach for when a request arrives, then release.

The noir move is the cleanest worked example. It used to sit on Wasabi, which bills a 1 TB regional floor plus a 90-day minimum storage duration — fixed rent for a near-empty shelf. It now lives on Bunny.net, metered to about $1/mo for what it serves, on its own domain entirely off the Cloudflare account and access-locked to a single home IP — the right posture for an 18+ surface whose blast radius shouldn't touch the rest of the portfolio. Same content, a fraction of the cost, a smaller threat surface.

The same discipline runs through the stack: R2 and Workers ride free tiers and bill per-request past them; Linode bursts from a baked image and is torn down after the job, turning an ~$80/day always-on rig into pennies per run; the deSEC DNS standby is free. rsync.net is the one deliberate exception — a flat 1 TB plan at $90/yr ($7.50/mo), billed the same whether restic parks ~19 GB (today) or nine hundred — accepted on purpose, because durability is the thing you don't meter, and it stays egress-free so restore and exit still cost nothing. It's the upkeep argument in dollars — keep the floor near-zero everywhere it can be, pay a flat line only where it buys survival, so adding a surface or sitting idle never shows up as a variable cost. Tailscale fits the same floor: the private-access mesh runs on its free tier, so reaching the homelab privately from anywhere adds $0/mo.

Where to look

• status.gf.cx — the reporting service, live: every job's status card + the contextual sentences
• home.gf.cx — the operating system these services run underneath
• assets.gf.cx — the UI primitives layer (cards, media) — services' visual sibling
• sandbox.gf.cx — where new service-backed surfaces are dogfooded first
• vault.gf.cx/tailscale — private-access layer: Serve (live), Lock + subnet router (next)
• kubrick.gf.cx — US video CDN: portfolio video on Bunny Stream behind a thin Worker proxy — one account, one $1/mo minimum, so each added video is marginally free