YOUR DATA.
YOUR BOX. YOUR RULES.

Your files, calendar, contacts, photos and even video calls on your own domain. Sync with desktop & mobile apps, or use the web. CardDAV/CalDAV auto-discovery means your phone finds the address book and calendars with zero fiddling. Every email this lab sends comes from its own mailserver — no Google, no Microsoft in the loop.

vs Google Drive / Dropbox — no per-seat pricing and no model trained on your calendar; you trade their polish for a filesystem you actually own.

A drop-in Bitwarden server in a single Rust container. Point the official Bitwarden browser extension, desktop or mobile app at vault.fxmq.net and your passwords, passkeys and TOTP codes live in your own vault. Invites & verifications arrive from the lab's own mailserver — proof of life without a SaaS middleman.

vs a hosted password manager — the same Bitwarden apps, but the server comes in the deal and nothing is taken on faith.

Uptime Kuma runs heartbeat, HTTP(S) and port checks against the whole stack and paints it on a live dashboard. When something below dies, it doesn't stay dead silently — the dashboard is public so the status of every door here is on display, including the monitor's own opinion of itself.

vs a hosted uptime service — this one watches from inside your network, so it can also see the doors that aren't public.

The play corner of the lab. /play loads a full Minecraft 1.8.8 client (EaglercraftX) straight in the browser — no download, no login, no account. Java veterans on any version from 1.7.10 to latest drop in over port 25565 through the Via family. Behind it all, PufferPanel at /panel manages the servers (registration is closed; accounts are made by the operator on request).

vs Minecraft Realms — browser play means no subscription and no install for your friends; the panel runs the world.

Webmail (Roundcube) plus a full Postfix/Dovecot platform behind it: SMTP on 25/465/587 and IMAPS on 993. DKIM, SPF and DMARC are published; spoof protection means a mailbox can only ever send as itself. The TLS certificate is the very same Let's Encrypt cert as this website — web and mail share one trust anchor. Every service in this lab uses it to send you email: that's the whole point of owning a domain.

vs Gmail / Outlook — your headers on your own DKIM-signed domain, nothing scanned for ads; deliverability is now your job.

This one isn't for the public. tail.fxmq.net exists only inside the Tailscale network — it isn't in public DNS and Caddy answers 403 to everyone else, forged Host headers included. On the net it's the cockpit: / lists every door, /ttyd opens a real terminal on the host. If you can open it, you're supposed to be here.

www.fxmq.net keeps the lights low: / serves an empty index.html placeholder, /download is a read-only public drop folder served by Caddy's file browser (drop a file, share the link), and this page. The whole lab ships from one repo, so everything you see here is version-controlled.

talk.fxmq.net carries signaling only: it fronts the Talk High-Performance Backend (HPB) websocket and the coturn relay (TURN/STUN), the two things encrypted video calls need to find each other across NAT. The media itself flows peer-to-peer — this box introduces you, then steps aside. The door answers /signaling; everything else replies with a plain ok by design. It's the reason the cloud door's Talk app makes calls without Zoom or Meet in the middle.

vs Zoom / Meet — calls are peer-to-peer WebRTC; this box introduces you, then steps out of the media path.