HomeBrain

Your private local cloud, agent wired into everything.

Nextcloud, Home Assistant, Vaultwarden, and a local AI agent are four products. HomeBrain is the appliance that makes them one: a single password, a backup that restores the whole box, updates that will not brick you, and — on a GPU — an agent that operates it so you never need a shell.

No subscriptions. No cloud accounts. No one else's servers.

A browser wizard configures it. Nothing leaves the box.

_{Solarized Light, with a dark theme a click away. The dashboard loads nothing from the internet — no CDN, no web fonts, no analytics — so it renders identically on a box with the WAN unplugged.}

A GPU runs the agent. Without one, the same install is HomeCloud: files, home, vault. ARM or x86_64.

---

Why this, not four apps

• One secret, one recovery — dashboard, files, smart home, and backup encryption share a master password. A recovery phrase, shown once, resets the lot.
• An agent that acts — calendar, lights, files, email. Every token stays on your GPU.
• Backup that restores the composition — not four separate dumps. Scheduled, encrypted, off-site, one click from the dashboard.
• It runs itself — pinned versions, downgrades blocked, a factory reset back to the wizard. Health alerts while the box is up.

---

How you reach it

On the LAN, open http://<server-ip>. Nextcloud and Vault also speak HTTPS on local ports.

With a GPU, Telegram is the daily interface: no VPN, no extra app. Pair it after setup. A public tunnel is optional, if you want the web UIs from outside.

Without a GPU, a Pangolin tunnel is how you reach the browser from outside.

_{One domain in, three subdomains out — no port forwarding and no inbound firewall rule. The same screen moves the box to a Cloudflare Tunnel, or reverts every field to what the device shipped with.}

---

The agent's reach

Dim the living room. Fetch the latest invoice from Nextcloud. Each integration is one row: connect it, test it, revoke it. The agent talks to every service from there. More than one account per service is fine — two homes, two Nextcloud users, several mailboxes.

_{Below the integrations sits the other half: the messenger the agent answers on. Pairing is a code, not a port.}

---

The model is a setting

_{Download a model, switch to it, delete the ones you are not using. The previous model stays on disk, so switching back is instant. Weights are fetched once, from the dashboard — never at inference time.}

---

Where the backup goes

_{A schedule, a drive, and somewhere off-site — the whole backup story is one tab. Archives are encrypted before they leave the box, so the target never sees your data. New archives open with your master password or your recovery phrase. WebDAV, SFTP or S3 — or a second HomeBrain, which hands out a dedicated replica account for exactly this.}

---

Architecture

Nextcloud          Docker     Files, calendars, contacts
Home Assistant     Docker     Smart-home automation
Vaultwarden        Docker     Password manager (Bitwarden-compatible)
MariaDB            Docker     Nextcloud + Vault database
Pangolin Newt      Docker     Encrypted tunnel            optional
llama-server       systemd    Local LLM inference         GPU only
whisper-server     systemd    Speech-to-text              GPU only
OpenClaw           systemd    AI agent on Telegram        GPU only

Versions are pinned and updated from the dashboard in one click.

---

Hardware

Inference is Vulkan via Mesa RADV — no ROCm. Throughput and tuning: BENCHMARKS.md.

---

Install

# Ubuntu 24.04+ / Raspberry Pi OS 64-bit
curl -fsSL https://raw.githubusercontent.com/oalterg/HomeBrain/main/install | sudo bash
sudo /opt/homebrain/scripts/provision.sh

Open http://<server-ip>, log in, and initialize. Local network is the default. The wizard shows the generated master password and recovery phrase once. (Restoring from backup: enter the old master password to keep it, or the recovery phrase to decrypt and set a new one.)

provision.sh prepares the host and starts the manager. It prints a factory password once if you did not pass --factory-pass; that password opens the wizard and is stored in factory_config.txt (mode 600). On AMD GPU hardware a reboot is recommended so kernel parameters take effect; it is not required to open the wizard.

Tunnel credentials at provision time are stored on the box and selected in the wizard — they do not skip it. On an already-set-up box the same command repoints the live tunnel without wiping data. Flags and the Pangolin resource map: PANGOLIN.md.

---

Documentation

License

BSD-3-Clause — see LICENSE.