Home Server/Local AI agent/ alignment with open source CRM

Private Homelab, Local AI Engine & Confidential CRM: Hardware Sizing, Deployment & Privacy Bridge Project Summary I am looking for an experienced DevOps / Homelab specialist to advise on hardware procurement, design the network architecture, and deploy an all-in-one private home server paired with a local AI engine on an Apple Silicon Mac Mini. I am a non-technical client and have not purchased the server hardware yet. I require an engineer who will: Advise on Hardware Procurement: Provide an exact shopping list (server form factor, internal vs. external expansion, hard drive models, and Mac Mini memory requirements) based on my functional needs. Advise on Base OS & Architecture: Recommend the optimal operating system (e.g., Ubuntu Server LTS vs. unRAID vs. TrueNAS Scale) to allow simple, visual hard drive expansion without command-line complexity. Deploy Core Containers: Configure a containerized storage, media, archival, and ad-blocking stack. Deploy a Dedicated Local AI Engine: Set up an offline open-weights LLM on a Mac Mini connected directly to the storage server via a dedicated physical Ethernet cable. Implement a Confidential CRM & Selective Sync Bridge: Deploy Monica HQ, configure family relationship mapping, enable conversational AI tool-calling, and build an automated sync pipeline that mirrors basic dialer information to Google Contacts while keeping all private notes, interaction histories, and family trees strictly isolated on my private hardware. Core System Constraints & Architectural Rules Effortless Hard Drive Expansion: The server must allow me to slide in additional 3.5" SATA hard drives as media, photo backups, and security camera footage grow over time. Fixed, non-expandable internal storage is a non-starter. Wi-Fi 6 Only for Home Network (Hard Constraint): The server will connect to my home network strictly over Wi-Fi (no physical Ethernet cable running to my home router). Direct Point-to-Point Hardware Interconnect: The Storage Server and Mac Mini will be connected directly to each other via a physical Cat6 Ethernet patch cable on an isolated private subnet (10.10.10.0/30). All AI API calls, tool-calling queries, and database updates between the two machines must pass through this direct wired interface, bypassing the home Wi-Fi entirely. Zero Router Port Forwarding: Remote access from Android and desktop devices must be handled strictly via an encrypted mesh overlay network (Tailscale). Strict Contact Privacy Partitioning: Self-Hosted CRM (Monica HQ): Holds complete records (private notes, life milestones, birthdays, gifts, conversation logs, family links). Google Contacts Cloud: Receives only scrubbed, whitelisted fields (First Name, Last Name, Phone, Email, Company, Tags/Labels). Data Isolation: Notes, life events, conversation history, and relationship trees are strictly prohibited from passing through the API filter. Phased Implementation Plan Phase 0: Hardware Assessment & Procurement Plan (Pre-Purchase) Storage Server Sizing: Recommend the optimal server form factor: Small Form Factor (SFF) / Micro-Tower PC (e.g., refurbished Dell OptiPlex / HP EliteDesk) vs. Mini PC paired with a multi-bay USB-C Direct-Attached Storage (DAS) enclosure (e.g., Terramaster D4-320). Select an Intel processor supporting Intel QuickSync for hardware video transcoding. Recommend specific CMR NAS/Enterprise hard drives (e.g., Seagate IronWolf, WD Red Plus) and initial storage capacity. Mac Mini Memory Recommendation: Advise on the target Unified Memory capacity (24 GB vs. 32 GB) to run 7B to 14B models with multi-turn context windows and fast token generation. Deliverable: A finalized, hyperlinked procurement shopping list. Once reviewed, I will order the hardware. Phase 1: Storage Server Setup, OS Consultation & Core Homelab Services Operating System Consultation: Advise on and install the best base OS (e.g., Ubuntu Server LTS vs. unRAID vs. TrueNAS Scale) prioritizing ease of adding hard drives down the road for a non-IT owner. Storage Pooling & Mounts: Configure drive pooling (e.g., ZFS, unRAID array, or MergerFS + SnapRAID) with persistent Docker volume mappings across system reboots. Wireless Network Hardening: Configure static IP assignment on the server's Wi-Fi adapter. Permanently disable wireless power-saving modes (power_save = off) to prevent interface sleep and dropped connections. Deploy AdGuard Home or Pi-hole in Docker as the whole-home DNS ad-blocker. Configure upstream fallback public DNS (e.g., Cloudflare 1.1.1.1) so home internet continues to function if the container reboots. VPN & Central Dashboard: Deploy Tailscale with subnet routing for secure remote smartphone access. Deploy a unified dashboard (Glance or Homepage) displaying storage capacity, real-time CPU/RAM usage, and application shortcuts. Core Media & Archival Containers: Immich: Self-hosted photo and video backup with mobile background sync and machine-learning facial recognition enabled. Jellyfin: Personal media server configured with Intel QuickSync hardware transcoding pass-through (/dev/dri). Kiwix: Offline searchable English Wikipedia archive (ZIM format with full images). Home Assistant: Local smart home hub for Wi-Fi and local IoT devices. Phase 2: Local AI Engine (Mac Mini) & Direct Hardware Link Point-to-Point Hardware Configuration: Configure the direct physical Ethernet connection between the Mac Mini and Storage Server on an isolated private subnet (10.10.10.1 and 10.10.10.2). Verify that inter-machine network traffic routes exclusively over the copper cable with sub-millisecond latency. Inference Server Deployment: Advise on and deploy an Apple Silicon-optimized local inference server (Ollama, LM Studio CLI, or Apple MLX). Bind the inference server daemon to listen on the direct physical interface (10.10.10.1:11434). Model Selection & Benchmarking: Download and benchmark open-weights models (7B to 14B parameter range, such as Alibaba Qwen 2.5 / Qwen 3, DeepSeek, or Meta Llama 3.1) for structured JSON output and tool-calling reliability. Verify 100% offline local execution (zero data sent to external cloud APIs). Private Chat Interface: Deploy a web chat UI (Open WebUI or equivalent) accessible from desktop and mobile browsers over Tailscale. Phase 3: Confidential CRM (Monica HQ), Contact Privacy & AI Integration Monica HQ Deployment: Deploy containerized Monica CRM with a MariaDB database backend via Docker Compose. Configure native relationship mapping (parents, children, spouse, siblings, custom relations). Privacy-Preserving Sync Bridge: Build a containerized automation pipeline (via n8n or a lightweight Python daemon) linking Monica's REST API to the Google People API. Whitelisted Sync Fields: Push only First Name, Last Name, Phone, Email, Company, and Tags/Labels (e.g., City: London, Lang: French) to Google Contacts. Data Isolation: Guarantee that private notes, meeting logs, conversation history, and relationship trees are completely stripped and never transmitted to Google. Automate pushing birthdays and reminders from Monica into a dedicated Google Calendar ("Monica Milestones") via the Google Calendar API. AI Tool-Calling for Monica: Connect the Mac Mini's local AI to Monica’s REST API using function calling. Enable the AI to search contacts, add interaction notes, and log life events via conversational chat. Enforce an explicit user confirmation step before the AI commits updates or modifications to any contact card. AI Batch Family Tree Ingestion: Configure an AI prompt/workflow where raw, unstructured text dumps or family lists are parsed by the local AI into structured relational JSON, batch-creating entries and relationship links inside Monica. Automated Database Backups: Implement an automated weekly Docker backup script dumping MariaDB to an isolated storage directory, and verify native vCard/JSON export functionality. Security, Privacy & Working Protocol Supervised Remote Access: All software configuration will take place via supervised remote desktop sessions (AnyDesk). Mock Data Testing Only: The freelancer will build and test the entire system using a mock dataset of 3 dummy contacts provided by the client. Real personal contact lists will not be accessed. Credential Isolation: The client will paste all master passwords, Google Cloud OAuth credentials, and administrative keys directly during screen-share sessions. Maintenance Runbook: Deliver a simple, jargon-free 1- to 2-page Markdown maintenance cheat sheet covering: Startup and shutdown sequences. Container update commands (docker compose pull && docker compose up -d). Database backup and restore procedures. Basic Wi-Fi troubleshooting and reconnection checks. Screening Questions for Applicants When submitting your proposal, please provide brief answers to the following: Hardware Recommendation: Given that the server must run 24/7 over Wi-Fi, support Intel QuickSync transcoding, and allow me to easily add 3.5" hard drives over time, what hardware setup do you recommend I purchase? (e.g., A refurbished business tower like a Dell OptiPlex/HP EliteDesk vs. a Mini PC + multi-bay USB-C DAS enclosure?) Mac Mini Unified Memory: For running 7B–14B models with fast token generation and tool-calling context, what unified memory capacity (e.g., 24 GB vs. 32 GB) do you recommend I purchase for the Mac Mini? Base OS Recommendation: For a non-technical owner who wants simple hard drive expansion and maintenance, would you recommend Ubuntu Server LTS, unRAID, TrueNAS Scale, or something else? Why? Direct Interconnect Configuration: How will you configure the network interfaces so inter-machine AI traffic routes across the direct Ethernet cable while external traffic uses the Wi-Fi gateway? Sync Bridge Approach: What tool do you recommend for syncing basic contact fields from Monica to Google Contacts while keeping notes strictly isolated (n8n workflow vs. custom script)?