My Homelab
A production-grade self-hosted infrastructure running on a repurposed HP EliteDesk. My personal playground for learning Linux, networking, security and virtualization — one service at a time.
The Mission
The goal: build a self-hosted infrastructure that would not look out of place in a small business — Proxmox virtualization, isolated networks, HTTPS everywhere, DNS-based routing, and a service catalog I can genuinely rely on.
The rule: no shortcuts. Every service is deployed in an LXC or VM, every domain lives behind the reverse proxy, and every firewall rule is documented. If it works only because I know the magic incantation, it doesn't count as done.
The payoff: hands-on experience with the exact stack I'd meet on day one of a SISR internship — and a working platform for the services my family and I actually use.
The Hardware
The whole rig runs on a single second-hand HP EliteDesk 705 G4 Mini — silent, low-power, and more than enough for a lab of this size.
CPU
AMD Ryzen 5 PRO 2400GE, 4 cores / 8 threads @ 3.2 GHz
RAM
8 GB DDR4 — tight but forces me to build efficient containers
Storage
256 GB NVMe SSD for the OS + LVM pool for containers
Network
1 Gbps Ethernet, bridged to a Livebox 7 on the LAN side
Hypervisor
Proxmox VE 8.x, LXC-first with Docker nested where needed
Power
~15 W idle. Cheaper than leaving a laptop plugged in
The Architecture
The Proxmox host bridges two networks: vmbr0 connects to the Livebox on the LAN
side (192.168.2.0/24), and vmbr1 is an internal-only bridge where
every service lives (192.168.1.0/24). iptables rules on the host
route traffic between them, giving me a lightweight but real segmentation.
Every domain (*.home.lan) resolves through Technitium DNS to
the Proxmox host, which forwards HTTP and HTTPS to Nginx Proxy Manager.
NPM then picks the right backend from the Host header. Adding a new service means one Proxy
Host entry — no DNS change, no firewall change, no downtime.
+------------------------------------------------------------+
¦ Devices on LAN (192.168.2.0/24) ¦
¦ ¦
¦ ¦
+------------------------------------------------------------+
¦
+----------?----------+
¦ Proxmox host ¦
¦ vmbr0 : .2.100 ¦
¦ iptables DNAT ¦
¦ vmbr1 : .1.1 ¦
+---------------------+
¦
+-----------------------+-----------------------+
¦ ¦ ¦
+------?------+ +------?------+ +------?------+
¦ Technitium ¦ ¦ NPM ¦ ¦ Jellyfin ¦
¦ .1.11:53 ¦ ¦ .1.12:443 ¦ ¦ .1.14:8096 ¦
¦ DNS server ¦ ¦ Reverse pxy ¦ ¦ Media serv. ¦
+-------------+ +-------------+ +-------------+
¦
+-- routes to any backend
based on Host header
What's Running Right Now
Every service below sits behind NPM, resolves through the wildcard DNS record, and serves HTTPS with a mkcert-issued certificate. All isolated in their own LXC container.
The single entry point. Terminates TLS and routes every request to the right backend.
Local DNS with wildcard resolution and network-wide ad blocking via OISD lists.
Media server for movies, series and music, streamed to every device on the LAN.
The hypervisor's own web console, proxied with Websockets on for the noVNC console.
The Write-Ups
Each major step of the lab has its own article — the reasoning, the config, and the mistakes I made getting there.
What's Next
The lab is a living project. Every new service is a chance to learn something. Currently queued up:
Wireguard VPN
Reach the lab from outside without opening ports on the Livebox. Split-tunnel config for phone and laptop.
Authentik SSO
Single sign-on in front of every dashboard. One password to rule them all, plus MFA for the admin routes.
Grafana + Prometheus
Move beyond up/down monitoring. Node exporter on every container, dashboards for CPU, memory, network.
PBS backups
Proxmox Backup Server on a secondary machine. Daily incremental backups of every LXC, off-site sync.
Immich
Self-hosted photo library to replace Google Photos on my phone. Automatic upload, face recognition, the whole thing.
Gitea + CI
Private code hosting for personal projects, with a runner for CI so I stop pushing broken commits.