Private AI. Real infrastructure.

Project Khanz began with a simple question: how much modern infrastructure could I build and understand using hardware I already owned?

Rather than relying only on cloud platforms, I wanted direct experience with the operating system, network, storage, services, containers and failures underneath an application. Two older laptops became a practical learning environment where I could deploy real services, observe how they interact, break configurations safely and repair them.

The final design separates infrastructure services from local AI workloads. This gives each machine a clear responsibility and makes the environment easier to understand, troubleshoot and extend.

The Toshiba Satellite is the environment's infrastructure node. It runs Ubuntu 24.04 LTS on modest hardware: an AMD E1-1200 processor, 1.5 GB of RAM and a 500 GB hard drive.

Instead of forcing every service into containers, the server uses a practical mixed model. Pi-hole, MotionEye, PostgreSQL, Samba, Fail2Ban, SSH and Tailscale run as native services, while Docker hosts Portainer and the UFS web analytics dashboard.

The node provides DNS filtering, storage access, camera monitoring, database services, container management and secure remote connectivity for the lab.

Hosting services is only half the work. The next responsibility is controlling how those services can be reached and understanding what is happening on the network.

The Toshiba node uses UFW with a default-deny incoming policy. Only required services are allowed, while Samba access is limited to the trusted LAN and Tailscale network. Fail2Ban watches for abusive behaviour, and Pi-hole provides DNS-level filtering and query visibility.

Security tools such as Nmap, arp-scan, tcpdump, Gobuster, Hydra, SQLMap and SecLists form a controlled learning toolkit for discovering systems and understanding common attack surfaces within an authorised lab.

The second node is dedicated to local AI experimentation. The HP 250 G8 runs Ubuntu 24.04 LTS on an Intel Celeron N4020, 4 GB of RAM and a 500 GB hard drive.

Docker Compose runs the AI stack. Open WebUI provides the browser interface, while Ollama handles local model execution. Both containers share the same Docker network, allowing the interface to communicate with the model service internally.

There is no dedicated GPU. That limitation became part of the engineering challenge: selecting lightweight workloads, understanding resource constraints and learning what practical local inference looks like on entry-level hardware.

The environment is designed as a small ecosystem rather than two unrelated machines. Client devices use the infrastructure node for local services and filtered DNS, while the AI node supplies private model access.

Tailscale extends secure access beyond the home network without exposing every service directly to the public internet. SSH provides administrative access, and clear hostnames make each node's purpose immediately understandable.

A system is only useful when it can be observed and maintained. Portainer provides a visual view of containers, MotionEye exposes camera monitoring, Pi-hole records DNS activity and systemd reports the state of native services.

Cron jobs and service managers automate recurring work and restart behaviour. Logs, port checks, process inspection and Docker commands form the everyday operational workflow.

This project developed practical experience across Linux administration, networking, SSH, DNS, firewalls, Docker, Docker Compose, databases, file sharing, monitoring, automation, troubleshooting and local AI deployment.

More importantly, it taught me to treat failures as evidence. An unavailable page can mean a missing route, a stopped container, an incorrect port, a firewall restriction or a service dependency. Troubleshooting became a process of forming hypotheses, checking the system and narrowing the cause.

The final blueprint represents the environment as it actually operates: clients use the private network, the Toshiba provides infrastructure services, and the HP node provides local AI. Tailscale and SSH support administration, while Docker is used selectively where containerisation adds value.

This architecture is intentionally small, but the underlying principles scale: clear node responsibilities, controlled access, observable services and documented dependencies.