All projects

Personal project09/2026 – present

Home Lab on TrueNAS

Self-hosted services on a TrueNAS server at home — Home Assistant, a Minecraft server, DNS filtering, Vietnamese and English text-to-speech and a private film library — monitored and controlled from my website's admin console without the website ever connecting in: the NAS calls out.

Type
Personal project
Period
09/2026 – present
Built with
TrueNASZFSDockerPythonCaddyHome AssistantHomeKitHMACCloudflare

Secure remote control

  • An agent on the NAS pushes status every minute and long-polls for commands; every request is signed with HMAC-SHA256 over the timestamp, nonce, path and body.
  • The agent runs unprivileged in a read-only container with no capabilities. A separate root helper never touches the network and only runs a fixed allowlist of commands with regex-checked arguments, plus a kill switch.
  • 15 commands from the admin console, from Minecraft moderation to restarting an app; sensitive ones need a fresh MFA or passkey check, and every one is audited.
  • The console shows each app's containers and their health, disks with temperature and SMART, and datasets with quota and snapshots; a failing or hot disk and an unhealthy container send an email alert.

Text to speech

  • The engine behind tts.dangkhoabach.vn, in Vietnamese and English: VieNeu Nano and Kokoro answer within seconds, and VieNeu Turbo reads in 25 higher-quality Vietnamese voices from a background queue that shows how long is left.
  • A small gateway checks personal API tokens and guest tickets from the website and enforces daily quotas; the models are pinned and run offline.

Film library

  • The films of movies.dangkhoabach.vn stream from the NAS through Caddy. A gateway checks each personal link against the SHA-256 hashes the website sends, refreshed every minute, and refuses any other link.
  • Addresses that keep trying wrong links are banned by fail2ban.

Smart home

  • A custom Home Assistant integration (about 1,700 lines of Python) for a smart-home cloud API: switches, dimmers, curtains, locks, gates, sensors and scenes.
  • Signed webhooks through a tunnel that exposes only the webhook path, so state arrives within about a second.
  • Everything appears in Apple Home and Siri through the HomeKit bridge; doors and gates need a per-device opt-in before they can be controlled.

Game server

  • A pinned, whitelisted Minecraft server with scheduled backups and ZFS snapshots, and a Discord notifier for joins, deaths, lag and backup results.

Quality

  • 127 offline tests across the agent, helper, gateways and Home Assistant integration.