The Stack

Bare-metal hypervisor running on two nodes (bc-001 and bc-003). Hosts all VMs and LXC containers. The entire homelab runs on top of Proxmox. It's what makes running 20+ isolated services on a handful of mini PCs feasible.

Most services run as Docker containers managed through Portainer. Portainer gives a web UI for managing stacks, containers, and images across multiple Docker hosts without needing to SSH in for routine tasks.

Fronts every service with HTTPS and clean domain names. Instead of remembering IP addresses and ports, every service gets a hostname like mealie.domain.com with an automatically renewed SSL certificate. NPM is the gateway for all externally-reachable services.

Handles internal DNS resolution so services are reachable by hostname on the LAN. Split-horizon setup means mealie.domain.com resolves to the internal IP at home and the NPM-proxied address via Tailscale. DNS-over-HTTPS for all client devices is a side benefit.

Mesh VPN that makes the homelab reachable from anywhere without port forwarding. Every device (laptop, phone, tablet) joins the tailnet and can reach home services directly. Subnet routing exposes the entire home network to tailnet devices. No open ports on the router for anything reverse-proxied or tunneled through this stack.

Exposes a handful of services to the internet without opening a single port on the router. Used for services that sit outside NPM's reverse-proxy layer, like the Plausible analytics instance. Free tier, no dynamic DNS to babysit, and nothing listening on WAN.

Self-hosted Bitwarden-compatible password manager. The full Bitwarden ecosystem (browser extensions, mobile apps, desktop client) pointed at a local server. About 10MB of RAM. All credentials stay on the network.

Bidirectional file sync between server, laptop, and phone. No cloud intermediary. Used for syncing the Obsidian vault, project files, and anything that needs to be on every device. Runs silently in the background, has never lost a file, has been running over a year without touching it.

OCR-indexed document archive. Scan something once, search for it forever. Auto-tagging, inbox folders, and email integration handle the filing automatically. Physical paper has been essentially irrelevant since setting this up.

Self-hosted Google Photos alternative with mobile apps, face recognition, and album organization. Phones back up automatically over Wi-Fi. The alternative to paying Google or Apple for storage that keeps growing every year.

Self-hosted recipe manager with meal planning and shopping lists. Import recipes from any URL, organize by tag or category, and generate a weekly shopping list from the meal plan. Used daily. Replaced a browser bookmarks folder that was completely unmanageable.

Self-hosted vehicle maintenance log: oil changes, service history, mileage, upcoming work. Replaces the "when did I last actually do this" guessing game and the shoebox of receipts. Low-traffic, low-maintenance itself, exactly what a personal-records app should be.

Self-hosted workflow automation, the self-hosted answer to Zapier/IFTTT: visual workflows that connect services via webhooks and APIs instead of one-off scripts for every integration. Worth knowing if you run this yourself: n8n's own database holds the credentials for whatever it automates, so back up and secure its data with the same care you'd give a password manager, not like a disposable container.

Self-hosted media server for movies, TV shows, and music. Streams to every device in the house. The apps are solid, hardware transcoding works well on Intel iGPU, and it's a fully functional Plex/Netflix alternative with no subscription.

A faithful recreation of the 1990s Weather Channel local forecast display, running on real NWS data for my actual location. Not remotely necessary. A second piece bridges it into a fake "channel" in Jellyfin's Live TV guide, so it just shows up next to everything else instead of living on its own tab. The kind of project that exists purely because it's fun to have working, and it is.

The daily driver. Everything else in this homelab is connected to it one way or another -- a single page of live-status widgets and bookmarks instead of a mental map of ports and hostnames. It's the first tab I open, not a nice-to-have I set up once and forgot about.

Monitors every service and sends alerts when something goes down. Simple setup, clean dashboard, good notification options (Telegram, email, webhooks). Runs on a small external cloud instance rather than in the homelab itself: the point of an uptime monitor is that it survives the thing it's watching going dark, including the whole house losing power. The first thing to check when something feels wrong.

Self-hosted push notification server. Everything else in this stack that needs to reach my phone -- a failed backup job, a monitoring alert, a stale-something check -- pushes through this instead of email, which I don't check nearly fast enough for anything time-sensitive. Auth is required by default (no anonymous publish), which matters more than it sounds like the first time you realize an open ntfy instance means anyone can push notifications to your phone.

System metrics dashboards. Prometheus scrapes CPU, memory, disk, and network stats from all nodes. Grafana turns that into dashboards. More setup than Uptime Kuma, but gives actual historical data when you need to understand why something slowed down at 3am.

Security information and event management. Agents on every node ship logs to a central Wazuh server, which correlates events and alerts on suspicious activity. More infrastructure than most homelabs need, but useful for learning what real security monitoring looks like in practice.

Runs large language models locally. Hosted in an LXC container, CPU-only (no GPU passthrough). Useful for experimentation, coding assistance without sending code to external APIs, and understanding what local AI actually looks like in practice: noticeably slower than the cloud, but private.

Proxmox handles VM and LXC snapshots. A manual snapshot before any major change has saved hours of recovery work more than once. One scheduled nightly vzdump job runs today (the Mealie container, 7-day/4-week/3-month retention); everything else gets a manual snapshot before touching it rather than a standing nightly job. Broader scheduled coverage is on the list, not yet built out.

Encrypted, deduplicated offsite backups shipped to S3-compatible object storage on a nightly schedule, with a weekly structural integrity check and a periodic real restore-and-checksum test (not just "the job said success"). The only layer of the backup strategy that survives the house burning down. Replaced Duplicati on this stack: same job, different tool.