Homelab

At a glance

• Outcome: A home server lab that runs self-hosted apps, private Git hosting, shared storage and monitoring on four dedicated machines.
• Status: Running at home. Results below come from Aug–Sep 2026 records, with follow-up through Sep 24, 2026. This is not a current availability or security assessment.
• Role: Owner and operator.
• Contribution: I run the lab and confirmed the logins and phone alerts by hand. AI agents helped write maintenance scripts and records.
• Validation: Isolated restores of a Forgejo archive and the applications VM passed their data checks; a media VM restore is partial. Sixteen Prometheus alert-rule tests pass, and a test failure-and-recovery alert pair reached a phone.
• Stack & libraries: Proxmox, Docker, NixOS, VLANs, DHCP, private DNS, Traefik, Authentik (OpenID Connect), Tailscale, Forgejo, TrueNAS (NFS), Grafana Alloy, Prometheus, Loki, Grafana, Gatus, ntfy, SQLite, MariaDB.
• Source: Private. Addresses, hostnames, camera details and client identities are withheld.
• Limitations: No uptime figure, recurring backup coverage or full disaster recovery is claimed.

The homelab is a set of machines at home that run my own services. Four are dedicated to it: virtualization hosts running Proxmox, which splits one physical computer into several virtual machines (VMs), and a network storage box. Five VMs each hold one job, so a fault or an upgrade in one leaves the rest running: infrastructure, applications, media, downloads and Forgejo, a self-hosted Git service. TrueNAS serves shared data and backup copies over NFS. Forgejo holds each host’s Docker Compose files and service configuration in Git. Moving the hosts to declarative configuration with Ansible or Nix has started but is not finished.

The infrastructure VM is the front door. Traefik sends each web address to the right service over HTTPS. A private DNS server resolves service names for devices at home and on Tailscale, a private network that reaches the lab from elsewhere. The router hands out addresses (DHCP), routes between VLANs and applies firewall policy. VLANs split one physical network into separate segments, so less trusted devices sit apart from the servers, and some traffic leaves only through its own VPN. Sign-in is chosen per app. Forgejo signs browser users in through Authentik, a central login service. Login, logout, repeat login, clone and push were each checked.

Alloy agents send each machine’s metrics and logs to Prometheus and Loki on the infrastructure VM. One audit found an agent running while its data never arrived. Docker rewrote the sender’s address, and the proxy’s admit rule rejected the requests. The missing-data alert looked at the fleet as a whole, so local data hid the gap. After the fix, fresh metrics and logs arrived, and six failure and drop counters stayed flat over about 83 seconds. Alerts now check each expected host and how fresh its data is. Sixteen rule tests cover missing hosts, stale data, failed collection and recovery.

Backups were tested by restoring them with no network connection. A Forgejo archive restored with a clean database check, nine intact Git repositories, a healthy service and working API login. An applications VM backup restored without production storage: four SQLite checks, a 32-table MariaDB restore, exact container images and isolated app starts passed. File contents, user sessions and a full cutover were outside that test. A media VM restore booted, but some health checks did not become ready. A local command-line tool takes dated snapshots and flags any difference from a reviewed baseline. Completing the media restore comes next. I also manage VPS hosting for personal and client websites.