Zero-Open-Port Ingress
All residential and edge services run with 0 inbound NAT router ports open. Only a hardened Oracle Cloud (OCI) Ampere A1 gateway accepts public HTTPS traffic.
ExCloudVault.com
Enterprise-grade self-hosted infrastructure guide. Learn how to architect, secure, and codify a zero-port hybrid cloud using OCI Cloud Ingress, Tailscale Mesh, Caddy Wildcard SSL, Apple Silicon, and Coolify PaaS.
Architectural Pillars
Section titled “Architectural Pillars”Tailscale WireGuard Mesh
Traffic between public cloud ingress proxies and residential hardware travels over an encrypted point-to-point WireGuard mesh with ACL access controls.
Apple Silicon PaaS Powerhouse
High-density, low-power self-hosting powered by Mac mini M2 running OrbStack, local Coolify PaaS, Docker Compose stacks, and automated GitHub self-hosted runners.
100% Codified Infrastructure
Every Caddy routing rule, firewall configuration, systemd service, and container stack is version-controlled and deployed via automated CI/CD GitOps pipelines.
What You’ll Learn
Section titled “What You’ll Learn”- Hardened Cloud Gateway Setup: Deploying an OCI Always Free ARM Ampere instance with custom Caddy builds, Cloudflare DNS-01 wildcard certificates, and HTTP/3 QUIC support.
- End-to-End Mesh Security: Bridging cloud reverse proxies to internal subnets using Tailscale with iptables/nftables packet filtering and UFW.
- Container Orchestration with Coolify: Managing production Docker workloads without vendor lock-in on energy-efficient Apple Silicon hardware.
- GitOps & Observability: Automatically validating Caddyfiles with automated CI tests, deploying via SSH GitHub Actions, and monitoring service health with Uptime Kuma and Gotify push alerts.