About this site
BairdSystems.Com runs on hardware I manage myself. Here's what's under the hood and why each piece is there.
The short version
One Windows Server running Hyper-V hosts everything: a domain controller, a services VM and personal desktops. IIS answers every request over HTTPS, serves this public site directly, and sends anything private through a single sign-on gateway backed by Active Directo
One identity
Active Directory is the source of truth for every account. Keycloak provides the sign-in page (with two-factor for administrators) and oauth2-proxy guards each private app, so one username and password works everywhere.
Personal desktops
Windows 11 and Linux desktops on Hyper-V, each visible only to its owner. Open them in the browser (Apache Guacamole) or in the Remote Desktop app with multiple monitors through an RD Gateway, with no VPN needed.
Automatic HTTPS
Let's Encrypt certificates, proven through Cloudflare's DNS API and renewed automatically, for the website and for every remote desktop, so there are no certificate warnings anywhere.
Reverse proxy
IIS with URL Rewrite and Application Request Routing routes each subdomain to the right service, including WebSocket streams for the browser desktops, and rewrites headers so each app sees what it expects.
Media
Jellyfin and Plex serve the home video library. Jellyfin signs people in against the directory, so there is no separate media password to manage.
Admin panel
A small Python app to add people to the directory, choose which apps they can open, power desktops on and off, hand out personal VPN configs and review sign-in activity.
Monitoring & backups
Health checks every five minutes with phone alerts on any change, a status page for the home network, and nightly backups encrypted to a key that never lives on the server, with an off-site copy.
Remote access
A personal WireGuard VPN for each person, with a router firewall that limits everyone except administrators to their own desktop.
Dynamic DNS
The home connection's IP address can change. A small script checks every five minutes and updates Cloudflare so the site never goes dark.
Defense in depth
Private services listen only on the server itself or an isolated network; the only way in is through the proxy and the sign-in gateway, with account lockout, security headers and HSTS on every response.