A laptop is a surprisingly good operations centre. It has a real Unix underneath, it sleeps when you close it, and it is already with you. The work is understanding what runs on it and where the boundary is.
The layers, in plain English
Processes and ports. Everything running on your Mac is a process, and network services listen on numbered ports. localhost:3000 means "port 3000 on this machine only". The loopback address 127.0.0.1 is unreachable from outside — which is exactly why most of this system stays there.
launchd and services. A service is a process that should keep running. launchd is the macOS mechanism that starts them, restarts them on failure, and records when they did — it is the layer the rest of this site's operations depend on. Containers are optional here, not required.
OrbStack and containers. Some things — the VictoriaMetrics store, the Grafana room, a small Coolify stack — run best isolated in containers. OrbStack provides that on a Mac without the ceremony of Docker Desktop. Volumes persist container state across restarts.
The outside world. Two ways in: Tailscale, a private mesh network that makes your Mac reachable from your phone from anywhere, and SSH for terminal access. Both require your credentials. No public ports, no firewall holes.
The phone-to-system journey
This is the practical payoff: an alarm arrives on your phone, you open the board, you read the runbook, you fix or delegate the fix, and you confirm recovery — from anywhere.
When the boundary is wrong
The three mistakes I have seen most often in self-hosted setups: a dashboard bound to 0.0.0.0 instead of loopback, credentials visible in screenshots, and "it sleeps" treated as security. The boundary should be loopback plus your tailnet, with sleep as a bonus rather than a plan.
Laptop sleep, honestly
Sleep pauses everything — agents, containers, collection. That is a feature, not a bug, for a personal rig: it bounds the bill and the risk. If something must run continuously, it belongs on a small always-on host, not on the machine you close.
Where to go next
- Agent Ops for people who don't run infrastructure — what runs on this machine day to day
- The agent telemetry stack, explained from first principles — what the dashboards are made of