{"data":{"items":[{"id":"be905a14-dfe6-4a08-88f0-8d5b27579b77","excerpt":"IT support by day, homelab by night. Built this with Google, YouTube, and r/homelab as my only teachers. Here's what 12 months looks like. — Lurked here for a while, learned a ton from posts like the one I'm hoping this becomes. Time to give back.\n\nQuick context: I'm IT support by trade. Not a developer, not a sysadmin","url":"https://www.reddit.com/r/homelab/comments/1tixf0h/it_support_by_day_homelab_by_night_built_this/","role":"pricing","weight":1.588125,"occurredAt":"2026-05-20T20:10:51.000Z","sourceKey":"reddit","sourceName":"Reddit","credibility":0.62,"venue":"homelab","intent":"pricing_complaint","painScore":0.65,"sentiment":-0.6,"confidence":0.9625,"matchedPatterns":["terrible","frustrating","free_tier"],"statement":"* **TMDB lookups were 503-ing** because Radarr preferred IPv6 and the upstream IPv6 path was broken.","title":"IT support by day, homelab by night. Built this with Google, YouTube, and r/homelab as my only teachers. Here's what 12 months looks like.","body":"Lurked here for a while, learned a ton from posts like the one I'm hoping this becomes. Time to give back.\n\nQuick context: I'm IT support by trade. Not a developer, not a sysadmin. Everything in this post I figured out by reading r/homelab, watching YouTube at midnight, and reading GitHub README files that occasionally assumed I knew things I absolutely did not know. If you're in the same boat, hopefully something here helps.\n\n# Hardware\n\n* **Host:** ASUS ROG board, Intel i7-11700KF (8c/16t), 32 GB DDR4, RTX 3080 10 GB\n* **OS:** Debian 13 Trixie, kernel 6.12\n* **Storage (all btrfs):**\n   * `/mnt/media`: 21 TB, media library + downloads\n   * `/mnt/vault`: 13 TB external USB drive, paperless docs + backups\n   * `/mnt/apps`: 1.9 TB RAID1, all Docker app data + compose files\n* **Networking:** Caddy as reverse proxy with a Cloudflare wildcard cert (LE prod via DNS-01), Authelia in front of every service for SSO\n* **GPU:** shared between Plex hardware transcode, Immich ML, and Ollama. Secure Boot off, nvidia-driver 550, NVIDIA container toolkit. Has worked surprisingly well.\n\n# Software (29 containers, grouped)\n\n* **Edge & access:** Caddy, Authelia, AdGuard Home\n* **Media servers:** Plex, Jellyfin, Overseerr, Tautulli\n* \\***arr stack:** Sonarr, Radarr, Prowlarr, Bazarr, SABnzbd. Dual Usenet providers, one primary + one failover.\n* **Productivity:** BookStack (wiki), Forgejo (self-hosted git), Paperless-ngx (document OCR), Actual Budget\n* **Photos & AI:** Immich (photos with ML on the GPU), Ollama (local LLM)\n* **Dashboards & ops:** Homepage, Uptime Kuma, CasaOS (kept it because the UI is honestly nice)\n* **IPTV:** Threadfin + an EPG service feeding Plex\n\nEverything sits behind Caddy with HTTPS via the wildcard cert. Authelia gates anything that shouldn't be wide open.\n\n# Stuff I broke and fixed (in case it helps the next person searching for these at 1 AM)\n\n* **AdGuard latency was 1800 ms** with default upstreams. Parallel mode with Cloudflare + Google + Quad9 dropped it to \\~10 ms.\n* **SABnzbd was pulling at 3 KB/s on a gigabit line.** I'd configured 50 connections to the provider and they were rate-limiting me into oblivion. Dropped to 20 connections, jumped to \\~9 MB/s. Less is more.\n* **Caddy to Plex was hanging on JS assets**, 8 second page loads, nothing in the logs. Forcing HTTP/1.1 transport in Caddy fixed it instantly. h2 to Plex is cursed.\n* **Overseerr to Radarr was 400-ing on tag creation.** Setting `tagRequests=false` in Overseerr was the fix.\n* **TMDB lookups were 503-ing** because Radarr preferred IPv6 and the upstream IPv6 path was broken. Disabled v6 via sysctls.\n* **Paperless was crash-looping** because I'd set `OCR_LANGUAGE=ara` and the Arabic pack isn't in the image. Just `eng` for now (annoying since I'd actually use the Arabic one).\n* **BookStack wouldn't start.** The linuxserver image uses `DB_USERNAME` / `DB_PASSWORD`, not the upstream's `DB_USER` / `DB_PASS`. Burned an hour on that one.\n* **Overseerr backlog had 262 orphaned movie requests** from a previous mess. Recovered them and re-pushed to Radarr. Don't `down -v` your stack with pending requests.\n\n# Known weirdness (in case anyone has hit these)\n\n* `immich-ml` reports unhealthy but works fine. Strict healthcheck, cosmetic.\n* Free IPTV EPG sources keep blocking my scraper. Inherent to free IPTV. Moving on.\n* Homepage widgets still need API keys + `docker.sock` group access. On the list.\n\n# Next up\n\n* Off-site backup for Immich + Paperless. The USB vault is a single disk, that's not enough.\n* Tiny mini-PC for a secondary AdGuard so DNS doesn't die when the host reboots.\n* Proper VLANs. IoT is currently too friendly with the trusted network.","offTopic":false},{"id":"6445321c-a27c-475e-8fca-2dec772ea2ec","excerpt":"Wednesday Dashboard Show & Tell — I've taken so much inspiration and found so much knowledge from others in this sub, that I wanted to share my current setup as well.\n\nMy homelab is almost entirely comprised of Dockerized apps running on a single Lenovo ThinkPad T15 laptop, with an i7-10510U and 48GB of RAM, running Fe","url":"https://www.reddit.com/r/selfhosted/comments/1ooz8rt/wednesday_dashboard_show_tell/","role":"demand","weight":1.2411149,"occurredAt":"2025-11-05T10:22:48.000Z","sourceKey":"reddit","sourceName":"Reddit","credibility":0.62,"venue":"selfhosted","intent":"alternative_search","painScore":0.2504936,"sentiment":0.61290324,"confidence":0.9925,"matchedPatterns":["i_hate","switching_from","praise"],"statement":"I could manage most all my Docker compose setups in here, but that's a whole other project, and would mean migrating away from my extremely bad shell scripts - Dockpeek: has mostly replaced my awful shell script that updates my Docker imag…","title":"Wednesday Dashboard Show & Tell","body":"I've taken so much inspiration and found so much knowledge from others in this sub, that I wanted to share my current setup as well.\n\nMy homelab is almost entirely comprised of Dockerized apps running on a single Lenovo ThinkPad T15 laptop, with an i7-10510U and 48GB of RAM, running Fedora Linux 43. Performance is pretty great, with all Docker apps using less than 10GB total RAM, and rarely using more than 10% total CPU. Temps are decent, too, with CPU coretemps around 60°C (unless I'm doing a big Immich import - not a bad way to cook an egg). The containers are managed by simple Docker Compose files, with some shell scripts to perform basic updates/restarts. Adding apps is pretty easy, especially with Traefik managing the networking/naming side of things.\n\n**Infrastructure:**\n\n- [Homepage](https://github.com/gethomepage/homepage): my homepage shown in this picture, with dynamic linking to my Dockerized apps\n- [Nebula VPN](https://github.com/slackhq/nebula/): the overlay VPN that connects everything together, and allows me to access everything remotely. And uh I swear this is not a shill post! but disclaimer, I work at [Defined Networking](https://www.defined.net/) which provides a managed Nebula, so this is an easy setup for me personally. Nebula's focus isn't really on homelabs, but it works great for networks of any size.\n- [Traefik](https://github.com/traefik/traefik) / [LetsEncrypt](https://letsencrypt.org/): everything's proxied thru Traefik and generates TLS certs with LE, using DNS verification via AWS Route53. All apps are tied to Traefik/LE using Docker compose labeling, which is great because I hate configuring Traefik and LetsEncrypt\n- [Backrest](https://github.com/garethgeorge/backrest): UI for restic backups - I have it snapshot every 2 hours, which is probably excessive, but it uses so little space overall that it's easy to have it run like this. Incredibly easy to perform restores... I've never done a _full_ restore, but I'm like 85% confident I could bootstrap a new infrastructure from BackRest without much fuss.\n- [Infisical](https://github.com/Infisical/infisical): used for SSH key management/connectivity to my homelab hosts. Someday I will also use this for secrets management...\n- [Pocket ID](https://github.com/pocket-id/pocket-id): auth I can add to non-authed apps. Exceptionally easy to setup, and works great with my YubiKey and phone biometrics\n- [Gitea](https://about.gitea.com/): contains, among other things, my main \"stacks\" repo with contains all the Docker compose files (secrets are gitignored and backed up by BackRest; someday I'll use Infisical for secrets management...).\n- [Beszel](https://github.com/henrygd/beszel)/[Ntfy](https://github.com/binwiederhier/ntfy)/[Mattermost](https://github.com/mattermost/mattermost): monitoring/alerting of infrastructure, or \"we have Grafana alerting at home\". Beszel has been a nice monitoring/alerting setup which publishes to both Ntfy (easy message routing and phone notifications) and Mattermost\n- [Kuma Uptime](https://github.com/louislam/uptime-kuma): monitoring/alerting of apps/websites I care about: also publishes to Ntfy/Mattermost\n- [Portainer](https://github.com/portainer/portainer): easy/quick at-a-glance view of my the Docker stacks. I could manage most all my Docker compose setups in here, but that's a whole other project, and would mean migrating away from my extremely bad shell scripts\n- [Dockpeek](https://github.com/dockpeek/dockpeek): has mostly replaced my awful shell script that updates my Docker images\n- [Speedtest Tracker](https://github.com/alexjustesen/speedtest-tracker): runs twice daily and outputs to Ntfy, mostly just fun to see how much more consistent my new internet is compared to my previous Comcast (lmao fuck Comcast)\n- [AdGuard](https://github.com/AdguardTeam/AdGuardHome): great DNS blocking. I used to use PiHole, but I like managing AdGuard a little more\n- [Syncthing](https://github.com/syncthing/syncthing): not shown, but vital to this setup: I have a Pepe Silvia web of Syncthing'd hosts, which handle backing up my Backrest backups\n- [VictoriaLogs](https://github.com/VictoriaMetrics/VictoriaLogs) / [VictoriaMetrics](https://github.com/VictoriaMetrics/VictoriaMetrics): logging and metrics, imo easier/better to manage than ES/Prometheus\n\n**Selfhosted Things I Use A Fair Amount:**\n\n- [SearXNG](https://github.com/searxng/searxng): has completely replaced all my searching on both PC and mobile\n- [Immich](https://github.com/immich-app/immich): I've completely migrated from Google Photos, having recently done an `immich-go` CLI import of my Google Takeout export\n- [Vaultwarden](https://github.com/dani-garcia/vaultwarden): has completely replaced my Bitwarden setup\n- [n8n](https://github.com/n8n-io/n8n): houses my automation workflows, two main ones are my daily weather and daily news, where n8n scrapes some data, summarizes data with local AI (I'm lazy so I just use Ollama on my Windows gaming PC), and sends the daily reports to my \"Good Morning\" Mattermost channel\n- [ownCloud Office](https://github.com/owncloud-docker/server)/[Collabora](https://github.com/CollaboraOnline/online): this was a bit of a pain to get set up, but less of a pain than other MS Office alternatives.\n- [Karakeep](https://github.com/karakeep-app/karakeep), formerly Hoarder: excellent link saver, with local AI summation (again, to my Ollama host)\n- [Zipline](https://github.com/diced/zipline): image hosting that I use mainly for the Homepage icons (for apps that are tougher to pull favicons from directly)\n- [IT Tools](https://github.com/CorentinTh/it-tools)/[networking-toolbox](https://github.com/Lissy93/networking-toolbox): two excellent 'toolbox' apps that I use daily\n- [Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF)/[Excalidraw](https://github.com/excalidraw/excalidraw): additional toolboxes I find occasional use for\n- [jsoncrack](https://github.com/AykutSarac/jsoncrack.com): great json visualizer, especially for deeply-nested data\n- [Grocy](https://github.com/grocy/grocy): we use this to catalog our chest freezer in the basement; it's sooo nice to know what we have down there at a glance\n- [Homebox](https://github.com/sysadminsmedia/homebox): where I document the things that I'd otherwise lose in our garage or basement storage\n- [Memos](https://github.com/usememos/memos)/[Beaver Habit Tracker](https://github.com/daya0576/beaverhabits): daily journal and habit tracking that has really assuaged my ADHD\n- [Invoke AI](https://github.com/invoke-ai/InvokeAI)/[Open WebUI](https://github.com/open-webui/open-webui): for messing around with local AI.\n- [changedetection.io](https://github.com/dgtlmoon/changedetection.io): great for easily keeping track of some blogs I care about, and tracking some news sites that I otherwise don't visit directly (eg HN/Slashdot)\n- [MeTube](https://github.com/alexta69/metube): IMO the cleanest/easiest YouTube downloader\n- [NocoDB](https://github.com/nocodb/nocodb): has mostly replaced the spreadsheets I was previously using as databases 😬\n- [OtterWiki](https://github.com/redimp/otterwiki): IMO the easiest wiki software. mostly I use it for internal docs about my homelab and hardware, intended to be accessible over the VPN. I also used it to write up this post!\n- [Element Web](https://github.com/element-hq/element-web): web-based Matrix client\n- [HortusFox](https://github.com/danielbrendel/hortusfox-web): inventory for plants! While I am generally unable to keep plants alive, my wife's green thumb means we do have quite a bit of greenery; this app makes that pretty easy/fun.\n- [Glass Keep](https://github.com/nikunjsingh93/react-glass-keep): nice little Google Keep replacement; it was super easy to import all my GKeep notes, too.\n- [Your Spotify](https://github.com/Yooooomi/your_spotify): listening stats for my Spotify account. Not particularly _useful_, but I always enjoy seeing my listening data\n- [Journiv](https://github.com/journiv/journiv-app): journaling app - I used to use Memos for journaling, but I really like the UX and journal-focus of Journiv and have veen using it of late\n- [Slink](https://github.com/andrii-kryvoviaz/slink): very slick \"we have imgur at home\".\n\n**Cool Stuff I Don't Use As Much But By George I've Got It:**\n\n- [Home Assistant](https://github.com/home-assistant): I'm still in the early stages of getting our smarthome stuff set up. Don't judge\n- [Proxmox](https://github.com/proxmox): I have a physical Proxmox host (just another Lenovo laptop, heh), I just don't do much with it yet\n- [HarborGuard](https://github.com/HarborGuard/HarborGuard): Docker image vulnerability scanning. Neat, but I didn't find the scans super actionable, so I don't really use it\n- [Seafile](https://github.com/haiwen/seafile): just got this after I saw others recommend it, not yet sure if it'll replace ownCloud for my filehosting\n- [Unleash](https://github.com/Unleash/unleash): feature-flagging app for your apps; I've only just started to play around with this on some test apps, but it's real neat.\n- [Kavita](https://github.com/Kareadita/Kavita): reading server; another one I've just started hosting that looks super easy to use\n- [Super Productivity](https://github.com/johannesjo/super-productivity): a todo app that I haven't leaned into yet much, but its feature set and focus on 'daily' work makes this intriguing as a Todoist replacement\n","offTopic":false},{"id":"dc9bdfd5-805a-42a1-ba52-093911624c46","excerpt":"From Quad9 to a fully self-hosted home lab on a Ugreen DXP480T+ — a two day build diary — # Long post, grab a coffee. I spent the last two days turning my Ugreen DXP480T+ into a proper self-hosted home lab and wanted to share the full journey for anyone thinking about doing the same. This is everything I built, the pro","url":"https://www.reddit.com/r/docker/comments/1tav9t1/from_quad9_to_a_fully_selfhosted_home_lab_on_a/","role":"pricing","weight":1.219624,"occurredAt":"2026-05-12T08:24:34.000Z","sourceKey":"reddit","sourceName":"Reddit","credibility":0.62,"venue":"docker","intent":"pricing_complaint","painScore":0.31381398,"sentiment":0.15384616,"confidence":0.928308,"matchedPatterns":["free_tier","workaround","manual_process"],"statement":"After trying various workarounds (binding to specific IPs, alternative ports), the cleanest solution was disabling dnsmasq entirely with and letting AdGuard Home own port 53 on .","title":"From Quad9 to a fully self-hosted home lab on a Ugreen DXP480T+ — a two day build diary","body":"# Long post, grab a coffee. I spent the last two days turning my Ugreen DXP480T+ into a proper self-hosted home lab and wanted to share the full journey for anyone thinking about doing the same. This is everything I built, the problems I hit, and how I solved them.\n\n# The starting point\n\nI had a decent setup already — ASUS ZenWiFi BQ16 router, Ugreen DXP480T+ NAS (running Docker), a headless MS-02 Ultra workstation on 10GbE, 8Gbps symmetrical broadband, and a second Ugreen DH2300 NAS for storage. I was using Quad9 as my DNS resolver and NordPass for passwords. Nothing was self-hosted beyond basic file storage.\n\n**Goal:** Move as much as possible onto the NAS, keep everything encrypted, and make it all accessible from anywhere via a proper VPN — not just RDP.\n\n# Step 1 — DNS: Quad9 → AdGuard Home (local)\n\nI started by evaluating AdGuard Private DNS cloud vs running AdGuard Home locally on the NAS. The cloud option was already paid for (lifetime sub) but local wins on privacy since DNS queries never leave your network.\n\n**The port 53 problem:** UGOS ships with dnsmasq listening on `127.0.0.1:53`. AdGuard Home in host network mode needs port 53. After trying various workarounds (binding to specific IPs, alternative ports), the cleanest solution was disabling dnsmasq entirely with `systemctl disable dnsmasq` and letting AdGuard Home own port 53 on `0.0.0.0`.\n\n**Result:** AdGuard Home running in Docker on the NAS, handling all DNS for the network via the BQ16 WAN DNS settings. Encrypted upstreams to Quad9 and AdGuard cloud over DNS-over-TLS. Currently blocking around 36% of all DNS queries across the network.\n\n**Blocklists running:**\n\n* AdGuard DNS filter (163k rules)\n* HaGeZi Pro++ (236k rules)\n* HaGeZi Ultimate (288k rules)\n* OISD Big (453k rules)\n* HaGeZi Windows/Office Tracking\n* URLHaus Malicious URLs\n\n# Step 2 — Tailscale for remote access\n\nReplaced RDP-over-local-network with proper zero-trust VPN. Tailscale runs as a Docker container on the NAS and:\n\n* Advertises the [`192.168.50.0/24`](http://192.168.50.0/24) subnet so remote devices can reach all LAN services\n* Acts as an exit node so family members travelling abroad can route all traffic through home\n* DNS is configured to use AdGuard Home, so ad blocking works on every device on the Tailnet\n\n**The DNS headache:** Getting Tailscale to correctly route DNS to AdGuard Home took a few iterations. The final working config:\n\n* Two nameservers in Tailscale admin: one unrestricted pointing to NAS LAN IP, one restricted to your internal domain\n* AdGuard Home listening on [`0.0.0.0:53`](http://0.0.0.0:53) (not just the LAN IP) so it's reachable via the Tailscale tunnel\n\nFree plan covers up to 100 devices — perfect for a family of 6 with 12 devices.\n\n# Step 3 — Nginx Proxy Manager + SSL\n\nThe BQ16 runs its own nginx on ports 80 and 443. Fix: disable the port 80/443 redirects in UGOS Control Panel → Device Connection → Portal Settings (uncheck \"Redirect port 80\" and \"Redirect port 443\"). This frees the standard ports for NPM.\n\n**Known NPM + Ionos DNS challenge bug:** When requesting Let's Encrypt certs via the Ionos DNS plugin, NPM throws an \"Internal Error\" / \"Invalid JSON\" in the UI but the certificate IS actually being issued in the background (takes \\~15 mins for DNS propagation). Workaround: ignore the UI error, wait 15 mins, check `docker logs nginx-proxy-manager --tail 10` for \"Successfully received certificate\", then add it as a standalone cert via Add Certificate → Let's Encrypt via DNS and assign it to the proxy host.\n\n**Result:** All internal services accessible via clean HTTPS URLs with valid Let's Encrypt certs — no port numbers, no warnings.\n\n# Step 4 — Vaultwarden (self-hosted Bitwarden)\n\nMigrated entirely from NordPass. Single Docker container, mounted to `/volume1/docker/vaultwarden/data`. Exposed via NPM with HTTPS.\n\n**NordPass export → Vaultwarden import:** NordPass CSV exports cleanly. In Vaultwarden go to Tools → Import Data → select NordPass CSV. Entire vault imported in under a minute.\n\n**Bitwarden browser extension** works identically to NordPass once you point it at your self-hosted server URL. Mobile app works the same. Over Tailscale it works from anywhere — the vault is cached locally so it's accessible even offline.\n\n# Step 5 — Immich (self-hosted Google Photos)\n\nMulti-container deployment via Docker Compose:\n\n* `immich-server`\n* `immich-machine-learning` (facial recognition, CLIP search)\n* `postgres` (using the Immich-specific postgres image with pgvector)\n* `redis`\n\nCurrently have \\~700GB used on a 3.7TB volume with plenty of room for a 1TB+ Google Photos migration.\n\nRunning at [`https://photos.yourdomain.com`](https://photos.yourdomain.com) via NPM.\n\n# Step 6 — Uptime Kuma (monitoring)\n\nLightweight monitoring for all services. Single container. Monitoring:\n\n* All internal HTTPS services (200 OK checks every 60 seconds, 3 retries before alerting)\n* AdGuard DNS (DNS record check against `192.168.x.x`)\n* Telegram alerts configured for instant notification if anything goes down\n\n**Tip:** For services accessed via internal DNS rewrites, use the direct IP:port in Uptime Kuma rather than the domain name, since the Kuma container resolves DNS differently inside Docker.\n\n# Step 7 — Landing page\n\nSimple static HTML served by an nginx:alpine container on port 8080, proxied via NPM. One bookmark on every device covers all services. Dark themed, loads instantly, no JavaScript framework needed.\n\n# Full service list\n\n|Service|Tech|Purpose|\n|:-|:-|:-|\n|AdGuard Home|Docker|DNS filtering, ad blocking|\n|Tailscale|Docker|Zero-trust VPN, exit node|\n|Nginx Proxy Manager|Docker|Reverse proxy, SSL termination|\n|Vaultwarden|Docker|Password manager|\n|Immich|Docker Compose|Photo library|\n|Uptime Kuma|Docker|Service monitoring|\n|Homepage|nginx:alpine|Landing page|\n\n# Hardware\n\n* **NAS:** Ugreen DXP480T+ (primary, all Docker workloads)\n* **NAS:** Ugreen DH2300 (secondary, backup target — NAS-to-NAS replication planned)\n* **Router:** ASUS ZenWiFi BQ16 (10GbE WAN, DNS pointed at NAS)\n* **Workstation:** MS-02 Ultra running LM Studio + Ollama (headless, 10GbE)\n* **Network:** multi-gigabit symmetrical fibre — no bottlenecks anywhere\n\n# Key lessons learned\n\n**dnsmasq vs AdGuard Home:** Don't try to work around it with port workarounds. Just disable dnsmasq and let AdGuard Home own port 53.\n\n**Tailscale DNS:** The phone/remote device DNS issue is almost always \"AdGuard Home isn't listening on the right interface.\" Binding to [`0.0.0.0:53`](http://0.0.0.0:53) instead of a specific LAN IP fixes it.\n\n**NPM + Ionos DNS challenge:** The Internal Error is a UI bug. The cert is still issued. Just wait and check the logs.\n\n**IPv6 on Windows:** If a Windows machine isn't using your custom DNS despite setting it manually, it's because IPv6 DNS takes priority. Disable IPv6 on the adapter with `Disable-NetAdapterBinding -ComponentID ms_tcpip6`.\n\n**Port conflicts on Ugreen NAS:** UGOS uses ports 80, 443, 9443, 9999, 5443. Free up 80/443 for NPM via Control Panel. Everything else can stay as-is.\n\nHappy to answer questions on any part of this. The Ugreen DXP480T+ handles all of this with barely a blip on CPU/RAM — it's genuinely well-specced for a home lab NAS.","offTopic":false},{"id":"10f2677d-04bb-4759-9c68-5494675286a6","excerpt":"The Self-hosted tools and apps that I rely on — Here is my self-hosted setup; below is a list of the hardware and apps I use daily. Overall, my setup has been rock solid and runs like a well-oiled machine; it's a very light touch, and I try to keep things simple.\n\n## The hardware\n\nServer, Proxmox VE:\n\n* Supermicro X14S","url":"https://www.reddit.com/r/selfhosted/comments/1voh007/the_selfhosted_tools_and_apps_that_i_rely_on/","role":"pricing","weight":1.1978279,"occurredAt":"2026-08-14T19:29:08.000Z","sourceKey":"reddit","sourceName":"Reddit","credibility":0.62,"venue":"selfhosted","intent":"pricing_complaint","painScore":0.37945637,"sentiment":-0.5714286,"confidence":0.86833334,"matchedPatterns":["free_tier","praise"],"statement":"The Self-hosted tools and apps that I rely on.","title":"The Self-hosted tools and apps that I rely on","body":"Here is my self-hosted setup; below is a list of the hardware and apps I use daily. Overall, my setup has been rock solid and runs like a well-oiled machine; it's a very light touch, and I try to keep things simple.\n\n## The hardware\n\nServer, Proxmox VE:\n\n* Supermicro X14SBM-TP4F, Xeon 6-6521P, 256GB DDR5\n* Boot: 2x 1TB NVMe mirror\n* VM storage: 4x 8TB WD_BLACK SN850X, RAIDZ1\n* Media: 10x 18TB WD Red Pro, RAIDZ2 plus a hot spare\n* LSI 9305-16i in IT mode, ICY DOCK 4-bay M.2 cage over MCIO\n* GPUs: Tesla T4 16GB and RTX 2000 Ada 16GB, both passed through to one VM\n* Dual 10GbE bonded, CX4712 4U chassis\n* Media pool goes out over NFS to whichever VMs need it\n\nVMs:\n\n* Plex\n* 4x Ubuntu container VMs, 1 has 2x GPUs passed through\n* dev VM for development work\n* PBS for backups\n\nQNAP TS-435XeU, 1U, 4x 10TB Seagate, backup target only. Nothing runs on it. It presents a 20.7TB thin iSCSI LUN that PBS uses as its datastore, and PBS syncs from there out to B2.\n\nNetwork:\n\n* UniFi UCG-Fiber gateway\n* UniFi USW-Pro-XG-24-PoE switch\n* Three VLANs: wifi/external, internal services, lab\n\n## Media\n\n* Plex - All things media ~160TB\n* Sonarr / Radarr / Prowlarr / Bazarr - TV, movies, indexers, subtitles\n* qBittorrent behind Gluetun - Proton VPN over WireGuard for the whole stack\n* Unpackerr - extracts the archives the arrs cannot\n* Tautulli - Plex stats and watch history\n* Pulsarr - Plex watchlist straight into Sonarr and Radarr\n* FlareSolverr - solves the Cloudflare interstitials my indexers keep hitting\n* Pinchflat - YouTube channels pulled down as a library served via Plex\n* Labelarr - pushes TMDB keywords into Plex as searchable labels\n* PixelProbe - scans the library for corrupt files so I find out before users or I am disappointed by a broken file\n\n## Photos, documents, notes\n\n* Immich - replaced Google Photos; ML runs on the GPU VM\n* immich-drop - no-login upload page so family can dump photos into my Immich without an account\n* Paperless-ngx with paperless-gpt - scanned paper, LLM does the titles and tags\n* Karakeep - bookmarks, auto-tagged\n* Trilium - notes, and where most of my automation writes its output\n* MicroBin - pastebin and quick file drop\n* Syncthing - versioned file sync to my NAS that then gets synced to B2\n\n## Audio and AI (the GPU VM, T4 plus RTX 2000 Ada)\n\n* Audicle - turns my reading list into a podcast feed with local TTS\n* MinusPod - strips ads out of podcasts before playback, Whisper transcription on the GPU\n* Ollama and Open WebUI - local models\n* claude-code-openai-wrapper - OpenAI-compatible endpoint in front of Claude Code\n* claude-trilium-sync - dumps Claude conversations into Trilium\n\n## Infrastructure and monitoring\n\n* Proxmox Backup Server - two datastores, one local over iSCSI, one S3-backed straight onto Backblaze B2\n* Pulse - single pane of glass for VMs and containers\n* Grafana, Loki, Alloy - every container and host ships logs here. This has been a game changer for debugging code and other network issues, especially paired with Grafana MCP\n* Uptime Kuma - is it up\n* Healthchecks - did the cron job actually run\n* Dozzle - container logs without opening Grafana\n* Portainer - container management\n* Watchtower - image updates\n* Nginx Proxy Manager - reverse proxy on each Docker host\n* Pi-hole x2, kept in sync with nebula-sync\n* Gitea - private git\n* Apache Guacamole - browser RDP and VNC into the lab VMs\n* Ansible - config management for all of it\n\n## Off box\n\n* Tailscale - remote access, zero ports forwarded\n* Cloudflare - DNS, Pages (for wedding site), Tunnel for the podcast feeds\n* Backblaze B2 - offsite target for PBS and syncthing\n* Proton VPN - arr stack and general use\n* Pushover - for notifications I care about\n* autowire - disposable WireGuard endpoints on AWS when I need to exit somewhere specific","offTopic":false},{"id":"ede05f2f-8e8e-49a9-8bbe-fd9261a0c829","excerpt":"E-Waste -> Network Operations Dashboard — I ~~am psychologically and emotionally incapable of~~ hate throwing things out, especially as I'm entering my weird techno-hippy middle age. Found this old Echo Show 5 I got for free years ago during my current move and figured I'd do something cool with it. And here it is: Far","url":"https://www.reddit.com/r/homelab/comments/1u7m2v8/ewaste_network_operations_dashboard/","role":"pain","weight":1.0931159,"occurredAt":"2026-06-16T18:37:10.000Z","sourceKey":"reddit","sourceName":"Reddit","credibility":0.62,"venue":"homelab","intent":"problem_report","painScore":0.49913043,"sentiment":-0.3478261,"confidence":0.7291667,"matchedPatterns":["manual_process"],"statement":"But at least Unifi A-Records finally allow wildcard characters, so you can just add a \\*.domain.com rule instead of making individual subdomains for every service or manually editing the DNSMasq database on your gateway.","title":"E-Waste -> Network Operations Dashboard","body":"I ~~am psychologically and emotionally incapable of~~ hate throwing things out, especially as I'm entering my weird techno-hippy middle age. Found this old Echo Show 5 I got for free years ago during my current move and figured I'd do something cool with it. And here it is: FarmMonitor v1.0\n\nThe device itself (Amazon Echo 5 (1nd Gen/\"Checkers\", 2019) is built to be completely disposable, and barely supported by Amazon anymore. It still gets security and occasional firmware updates (and probably will until 2027 or so), but it's otherwise completely useless and the Fire OS ecosystem was nothing to write home about to begin with. \n\nHardware specs are:\n\n|COMPONENT|SPEC|\n|:-|:-|\n|Display|5.5\" Touch @ 960 x 480|\n|SoC|MediaTek MT8163|\n|CPU|Quad-Core ARM Cotex-A53 @ \\~1.5Ghz|\n|GPU|lol (but actually Mali-T720 MP2)|\n|RAM|LOLOL (1 GB)|\n|Storage|8 GB eMMC|\n|Power|15W, barrel adapter, no USB power (\\~2 W idle, 3-4 W for dashboard, measured at outlet)|\n|Misc.|WiFi a/b/g/n/ac, bluetooth, 2MP camera, microphone, speakers, Micro-USB. Yes, MICRO-usb. In 2021. And it doesn't accept power through it.|\n\nSo it's got the compute of a Raspberry Pi 3, the RAM of a Windows XP PC, and no USB-C long after everyone had already switched to USB-C. And it was running a locked-down Fire OS, which is not ideal in the best of times. Oh, and they basically gave them away for free to anyone who had ever ordered anything on Amazon. Basically the thing left the factory as e-waste. But instead of letting it rot in a landfill like it deserved, I decided to find a use for it.\n\n**Difficulty 1: Fire OS**\n\nIt sucks. Less secure than Jeff Bezos' text messages, almost as reliable as Blue Origin, and locked down tighter than Amazon reviews about Amazon products. Oh, and it spies on you and tries very hard to escape your firewall rules. It had to go.\n\nStep one is [rooting/unlocking the bootloader with TWRP](https://xdaforums.com/t/unlock-root-twrp-unbrick-amazon-echo-show-5-1st-gen-2019-checkers.4762900/). Which would have been much easier except finding a working micro-usb cable in 2026 is not easy. I tested 20+ cables I had lying in a box before finding one. Once it was hooked up, though, ez-pz.\n\nStep two was putting something better on. My first go-to was PostmarketOS so I could run native Linux. Unfortunately, Postmarket is a bit of a mess right now and just would not work. Fair enough. So[ Lineage OS](https://xdaforums.com/t/rom-unofficial-11-checkers-lineageos-18-1-for-the-amazon-echo-show-5-2019.4763475/) it is. If you're unfamiliar with it, Lineage is a fork and spiritual successor to CyanogenMod. Basically \"What if Android, but without Google?\" 10 minutes later and I was running a stock android install.\n\n**Difficulty 2: The Hardware Sucks**\n\nIt was pretty dated 6 years ago, and it's basically useless for anything modern. And the display is too small and the wrong orientation for anything terminal-based. Having a live Grafana dashboard or one of the more involved dashboarding apps may well have killed it.\n\nMy solution was [Glance](https://github.com/glanceapp/glance/tree/main). It's just a static web page, it's easy to configure, information uploads on page reload, and it's about as minimal a dashboard as you can get. I thought about rolling my own but decided that would be incredibly stupid.\n\nI load the dashboard through [Fully Kiosk Browser](https://www.fully-kiosk.com/), because I want this thing to function largely as an appliance. Fully Kiosk has a really good free version, and the paid version is only $10 or so. It's sideloaded in (the site actually lets you download an APK, which is great if you don't want to load play services). That's pointed to my Glance deploy, with an automatic reload and cache clear every 30 seconds.\n\n  \n**Difficulty 3: Unifi Zone-Based Firewall Is Ass**\n\nIt's really not, but it kind of is sometimes. I have Pangolin running in local mode on a dedicated and isolated on its own VLAN as my reverse proxy. Everything has access to Pangolin, nothing has access to anything else (except my Superuser VLAN). The goal was to stop dealing with ZFB policies and just have a single choke point everything has to go through with FQDNs to get to anything else, and then use Pangolin's access policies to control traffic. In theory. \n\nExcept that that's not how Unifi wants to work, and I keep forgetting that. So for about four hours, I messed with my network config, traced individual packets, disassembled and reassembled my rack, and tried to figure out why the Show could ping Pangolin, but trying to navigate to it resulted in a black hole at the gateway. And it's because it doesn't return traffic through the proxy or count an inter-VLAN-hop path as establishing a connection for return traffic. \n\nTo get it to work, I had to do a stupid three-way firewall rule:  \nAllow Echo -> Pangolin, Allow Pangolin -> Services, Allow Services -> Echo, Block everything else. This throws me literally every time I try to do something similar, and it feels utterly stupid. And Unifi's observability sucks, so half the time it doesn't even show dropped traffic. But at least Unifi A-Records finally allow wildcard characters, so you can just add a \\*.domain.com rule instead of making individual subdomains for every service or manually editing the DNSMasq database on your gateway.\n\n**Conclusion**\n\nHonestly, this would have been a two hour project if it weren't for firewall shenanigans. And there it is. A mini NOC that lets me know exactly what I need and nothing else. The dashboard isn't finished fully yet -- I still need to add the rest of my servers and networking, but the shape is done. No extra nonsense, no line goes up art for the sake of filling space, no 500 shortcuts to services you will probably never touch. Just \"is the core infrastructure working? And if not, what broke?\"\n\nNext steps are a bit more ambitious. Since it has a microphone, and since I'm working on an AI-based sysadmin named \"Dave\" anyway, the plan is to work in the microphone and speaker to have it act as a full speech interface with my equipment so I can yell shit like \"DAVE WTF, GIT IS DOWN AGAIN. WHAT HAPPENED?\" and have my assistant go through the logs and trace the problem and tell me what went wrong. But I'm saving that for round two. In the meantime, just happy to have kept another device out of the landfill.","offTopic":true},{"id":"e62cd233-abd7-469d-bb2d-71682cfcc476","excerpt":"My 7-Node Proxmox Cluster \"Pfannkuchen\" – 300 Threads, 3.3TB RAM, and a Whole Lot of Learning — Hey everyone! 👋\n\nWanted to share my homelab setup that's grown over the past few years. I call it \"Pfannkuchen\" (German for pancakes – because why not?).\n\n---\n\n## Hardware Overview\n\n| Node | CPU | Threads | RAM | Storage Acc","url":"https://www.reddit.com/r/homelab/comments/1sryf0c/my_7node_proxmox_cluster_pfannkuchen_300_threads/","role":"pricing","weight":1.0425888,"occurredAt":"2026-04-21T19:41:35.000Z","sourceKey":"reddit","sourceName":"Reddit","credibility":0.62,"venue":"homelab","intent":"pricing_complaint","painScore":0.37333333,"sentiment":-0.33333334,"confidence":0.75916666,"matchedPatterns":["free_tier"],"statement":"--- ## Hardware Overview | Node | CPU | Threads | RAM | Storage Access | |------|-----|---------|-----|----------------| | Node 1 | 2x Intel Xeon Gold 6226 | 48 | 768 GB | Dell PowerStore 1000T SAN | | Node 2 | Intel i7-14700 | 28 | 96 GB…","title":"My 7-Node Proxmox Cluster \"Pfannkuchen\" – 300 Threads, 3.3TB RAM, and a Whole Lot of Learning","body":"Hey everyone! 👋\n\nWanted to share my homelab setup that's grown over the past few years. I call it \"Pfannkuchen\" (German for pancakes – because why not?).\n\n---\n\n## Hardware Overview\n\n| Node | CPU | Threads | RAM | Storage Access |\n|------|-----|---------|-----|----------------|\n| Node 1 | 2x Intel Xeon Gold 6226 | 48 | 768 GB | Dell PowerStore 1000T SAN |\n| Node 2 | Intel i7-14700 | 28 | 96 GB | Synology NAS (NFS) |\n| Node 3 | 2x Intel Xeon Gold 6226 | 48 | 768 GB | Dell PowerStore 1000T SAN |\n| Node 4 | 2x Intel Xeon Silver 4210R | 40 | 96 GB | Local |\n| Node 5 | 2x Intel Xeon Silver 4210R | 40 | 96 GB | Local |\n| Node 6 | 2x Intel Xeon Gold 6226 | 48 | 768 GB | Dell PowerStore 1000T SAN |\n| Node 7 | 2x Intel Xeon Gold 6226 | 48 | 768 GB | Dell PowerStore 1000T SAN, Synology NAS |\n| **Total** | | **300** | **3.3 TB** | |\n\n### Storage\n\n- **Dell PowerStore 1000T SAN:** 20 TB (connected to nodes 1, 3, 6, 7)\n- **Synology DS1815+:** 93 TB NFS shares for media libraries\n\n### Networking\n\n- Dedicated management subnet\n- Per-node VM subnets (10.X.1.0/24)\n- WireGuard site-to-site VPN to external VPS hub\n\n---\n\n## Node Roles\n\n| Node | Main Workloads |\n|------|---------------|\n| Node 1 | Monitoring (Grafana/Prometheus), Outline Wiki |\n| Node 2 | Tdarr (transcoding), SABnzbd, Arr-Apps (Sonarr/Radarr) |\n| Node 3 | Kubernetes cluster (1 control + 2 workers) |\n| Node 4 | Automation (n8n, Dockhand), Matrix, Immich |\n| Node 5 | Test Node  |\n| Node 6 | Emby Server – 512GB RAM dedicated |\n| Node 7 | Emby Server (second instance), Arr-Apps |\n\n---\n\n## Key Services\n\n- **Reverse Proxy:** Caddy on external VPS (handles all domains with HTTPS)\n- **VPN Hub:** WireGuard tunnel between VPS and all nodes\n- **Media Stack:** 2x Emby instances, Sonarr, Radarr, SABnzbd, Tdarr\n- **Photo Gallery:** Immich + Lychee\n- **Automation:** n8n workflows, custom Dockhand API\n- **Monitoring:** Grafana + Prometheus + InfluxDB\n- **Communication:** Self-hosted Matrix server\n- **Documentation:** Outline Wiki\n- **Git:** Forgejo (self-hosted) as source of truth for all compose files\n\n---\n\n## AI-Powered VM Auto-Deployment\n\nOne of my favorite projects: I built a custom API (\"Butler API\") that handles complete VM provisioning end-to-end:\n\n1. **API Request** → Specify node, IP, hostname, cores, memory, disk\n2. **ISO Builder** → Automatically creates bootable ISO with cloud-init config\n3. **VM Creation** → Proxmox VM is created and started\n4. **SSH Wait** → System waits for SSH to become available\n5. **Ansible Playbook** → Automatically configures the VM (Docker, services, backups)\n\nThe whole process takes about 10 minutes and is fully automated. No manual intervention needed – I just call the API and come back to a fully configured VM. It's like having a dedicated DevOps engineer on call 24/7! 🤖\n\nAll of this is orchestrated through my self-hosted AI assistant that manages the entire workflow.\n\n---\n\n## Backup Strategy\n\n- **Daily VM Backups:** Borgmatic to Hetzner StorageBox (7 daily, 4 weekly, 6 monthly retention)\n- **Proxmox Snapshots:** Proxmox Backup Server for VM-level backups\n- **Backup Monitoring:** Custom dashboard to track backup health across all nodes\n- **All backups encrypted** and offsite\n\n---\n\n## What I Learned\n\n1. **Git as source of truth** for all Docker compose files changed everything – no more config drift\n2. **VMs over LXC** for better portability and snapshot capabilities\n3. **External reverse proxy** on a VPS beats fighting with home NAT and dynamic DNS\n4. **Backup monitoring** is just as important as the backups themselves\n5. **Segmented networking** from the start saves so much pain later\n6. **Enterprise hardware** (Xeon + ECC RAM) is worth it for 24/7 stability\n7. **Automation pays off** – the time invested in building the auto-deploy system has saved countless hours\n\n---\n\n## Challenges Ahead\n\n- Still optimizing resource allocation across nodes\n- Want to expand Kubernetes workloads\n- Better service discovery and documentation\n- Considering FRP for streaming instead of WireGuard\n","offTopic":true},{"id":"8803c6ab-bf2b-409a-8b09-b879833bb678","excerpt":"My CM3588 + Pi 5 setup running 25 containers at 10W — Been lurking here for over a year. Finally built something I'm proud enough to share.\n\n# The Hardware\n\n|Device|Specs|Role|\n|:-|:-|:-|\n|**CM3588-Plus**|RK3588, 32GB RAM, 64GB eMMC, 4× 2TB NVMe|NAS + all services|\n|**Raspberry Pi 5**|4GB, WiFi + Ethernet|Network gatew","url":"https://www.reddit.com/r/homelabindia/comments/1rh5k0o/my_cm3588_pi_5_setup_running_25_containers_at_10w/","role":"demand","weight":1.0189856,"occurredAt":"2026-02-28T15:33:00.000Z","sourceKey":"reddit","sourceName":"Reddit","credibility":0.62,"venue":"homelabindia","intent":"alternative_search","painScore":0.25113937,"sentiment":1,"confidence":0.81444615,"matchedPatterns":["alternative_to","free_tier"],"statement":"What's running on it **Publicly accessible (via VPS + WireGuard tunnel):** * **Immich** — replaced Google Photos, the ML-based search is genuinely good * **Nextcloud** — file sync, calendar, contacts * **Vaultwarden** — self-hosted Bitward…","title":"My CM3588 + Pi 5 setup running 25 containers at 10W","body":"Been lurking here for over a year. Finally built something I'm proud enough to share.\n\n# The Hardware\n\n|Device|Specs|Role|\n|:-|:-|:-|\n|**CM3588-Plus**|RK3588, 32GB RAM, 64GB eMMC, 4× 2TB NVMe|NAS + all services|\n|**Raspberry Pi 5**|4GB, WiFi + Ethernet|Network gateway, DNS, VPN|\n|**VPS**|Cheapest tier, just needs a public IP|Public ingress|\n|**BlackBlaze**|Cheapest tier, Offsite backup|Periodic encrypted backups|\n\n# Why the CM3588?\n\nI went back and forth between a mini PC, a used Dell SFF, and this. The CM3588 won because:\n\n* **\\~10W idle** — this thing runs 24/7 so power draw matters. My electricity bill barely noticed it\n* **4 NVMe slots built in** — no adapters needed for the SSDs. I'm running 4× 2TB in ZFS RAIDZ1 right now\n* **Expandable to stupid amounts of storage** — you can slap an NVMe-to-SATA adapter on the remaining slots and connect 5×4 HDDs. That's 200TB+ territory if you go with 10TB drives. I haven't done this yet but knowing the headroom is there is nice\n* **Hardware 8K decode** — the RK3588 has a built-in VPU. Jellyfin transcoding just works, no CPU sweating\n* **Built-in 2.5GbE** — no USB ethernet dongles, no PCIe NICs. Just plug in and saturate it\n* **32GB RAM** — plenty for \\~25 Docker containers running simultaneously\n* **Fanless / silent** — sits in my room, I forget it's there\n\nFor what you get, the price-to-performance is hard to beat. I picked mine up from [Amazon](https://amzn.in/d/00ulaBts) — they were noticeably cheaper than other sellers I found for this board, delivery took under a week even with imports, and the seller helped me out with NVMe compatibility questions before I ordered. Solid experience overall.\n\nCompared to an x86 mini PC at a similar price point, I'd be getting half the RAM, no NVMe slots, and 3–4× the idle power draw.\nThe only trade-off is ARM compatibility — but I travel a lot for work, and my setup lets me just plug in and go anywhere without changing anything. Everything I run is Docker-based, so it hasn't been an issue.\n\n# Why the Pi 5 as a gateway?\n\nI didn't want to expose a single port on my home router. The Pi sits between my home network and the lab — connects to the main router over WiFi and serves the lab over Ethernet on its own isolated subnet (10.0.0.0/24). It runs:\n\n* **Pi-hole** for DNS + ad blocking across the whole lab\n* **NetBird** (mesh VPN) for remote access without any port forwarding\n* **NAT/routing** so lab devices reach the internet through it\n\nThe entire lab is invisible to my home network. The Pi is the only device that touches both sides.\n\n```\nInternet\n  ↓\nCloudflare DNS\n  ↓\nVPS (HAProxy) ── WireGuard ──┐\n                              ↓\n                    Raspberry Pi 5\n                      ├─ Pi-hole\n                      ├─ Traefik \n                      └─ 10.0.0.1\n                              ↓\n                    CM3588 NAS (10.0.0.2)\n                      ├─ ZFS RAIDZ1 (4× 2TB, encrypted)\n                      ├─ OpenMediaVault 7\n                      ├─ LLDAP + Authelia + NetBird\n                      └─ ~25 Docker containers\n\n\n```\nWhat's running on it\n\n**Publicly accessible (via VPS + WireGuard tunnel):**\n\n* **Immich** — replaced Google Photos, the ML-based search is genuinely good\n* **Nextcloud** — file sync, calendar, contacts\n* **Vaultwarden** — self-hosted Bitwarden, works with all official clients\n* **SearXNG** — metasearch engine, been using it as my default\n* **Navidrome** — music streaming via Subsonic API\n* **Linkwarden** — bookmarks/read-it-later\n* **Dawarich** — tracking footprints\n\n**Internal only:**\n\n* **Jellyfin** \\+ full arr stack (Sonarr, Radarr, Lidarr, Prowlarr, Bazarr)\n* **qBittorrent** behind Gluetun VPN\n* **Jellyseerr** for media requests\n* **Uptime Kuma** — monitors everything\n* **Dozzle** — Docker log viewer, absolute lifesaver\n* **Code-Server** — VS Code in the browser, I manage the whole lab from it\n* **Planka** — kanban board\n* **OpenClaw** — Personal openclaw agent\n\n**Infrastructure:**\n\n* **Traefik** — reverse proxy with Docker auto-discovery\n* **Authelia + LLDAP** — SSO + 2FA for everything (\\~150MB total, lightweight alternative to Authentik)\n* **CrowdSec** — collaborative intrusion detection\n* **Gitea** — self-hosted git + CI/CD\n\n# The bits I'm happiest with\n\n* **ZFS encrypted at rest** — dataset-level encryption with auto-unlock. Protects against drive theft but I don't have to type a passphrase on every reboot\n* **Split DNS** — same `*.example.com` domains resolve locally via Pi-hole and publicly via Cloudflare. No hairpin NAT nonsense\n* **Full GitOps** — every config is in a git repo on Gitea. Push to main → Ansible deploys automatically. Secrets are SOPS-encrypted in the repo\n* **No ports on my router** — public traffic path is Cloudflare → VPS → WireGuard → Pi → CM3588. My home IP is never exposed\n* **Total power draw** — the whole thing (CM3588 + Pi 5) sips power compared to an equivalent x86 setup\n\nStill learning and iterating. Would love to hear what I could improve or what you'd do differently. Planning to do a pure components build down the line, so any suggestions are welcome.","offTopic":true},{"id":"9fad6cd0-8584-43ac-8a17-988aa858d6dc","excerpt":"My first homelab - The first 3 weeks — \n\n**Background**\n\nI work in IT, specifically cybersecurity, but before this I had very little Linux experience and hadn't really worked much with infrastructure.\n\nBoy, where do I start...\n\nI've always wanted a homelab, but there were two problems:\n\n1. Where would I put the hardwar","url":"https://www.reddit.com/r/homelab/comments/1uz3rxt/my_first_homelab_the_first_3_weeks/","role":"demand","weight":0.99100333,"occurredAt":"2026-07-17T15:57:58.000Z","sourceKey":"reddit","sourceName":"Reddit","credibility":0.62,"venue":"homelab","intent":"tool_discovery","painScore":0.18,"sentiment":0.4814815,"confidence":0.8398333,"matchedPatterns":["looking_for","free_tier","product:cloudflare"],"statement":"I started looking for a device that could handle transcoding, and found the desktop with the GTX 1060 at a good price so I got that.","title":"My first homelab - The first 3 weeks","body":"\n\n**Background**\n\nI work in IT, specifically cybersecurity, but before this I had very little Linux experience and hadn't really worked much with infrastructure.\n\nBoy, where do I start...\n\nI've always wanted a homelab, but there were two problems:\n\n1. Where would I put the hardware?\n2. What would I actually host?\n\nOne day we were cleaning out old equipment at the office, and I got the chance to take home some hardware that was going to be recycled. Not everything came from work, I've picked up a few things myself as well.\n\n# Hardware\n\n**Compute**\n\n* Dell OptiPlex 7010 Micro – i5-13500T, 32GB RAM\n* HP EliteBook 840 G11 – Ultra 7 155H, 16GB RAM\n* HP EliteBook 840 G11 – Ultra 5 125H, 16GB RAM\n* Random desktop – i5-8400, 32GB RAM, GTX 1060 6GB\n* Raspberry Pi Zero\n\n**Storage**\n\n* 3× Synology DS918+ (4×3TB RAID5)\n* 1× Synology DS923+ (4×4TB RAID5)\n\n**Network**\n\n* Deco XE75 Pro\n* UniFi USW Flex Mini\n\nThe rack also has a temperature controller that automatically spins up a fan if things start getting too warm.\n\n# Hypervisors\n\nThe Dell and both HP laptops run Proxmox VE.\n\nThe desktop is still running bare-metal Ubuntu because when I built it I never expected this to grow into... whatever this has become.\n\n# Services\n\n# Ubuntu Media Server (i5-8400 + GTX 1060)\n\nThe first thing I brought home was the Synology DS923+, so naturally the first project became Jellyfin.\n\nI started looking for a device that could handle transcoding, and found the desktop with the GTX 1060 at a good price so I got that.\n\nMy Linux ISOs are spread across all four NAS boxes using MergerFS.\n\nGetting everything running was honestly much easier than expected thanks to **YAMS**, which automates most of the ARR stack setup. Since then I've added Jellyfin plugins, tuned indexers and made sure everything ran smoothly for friends and family.\n\nThis server currently hosts:\n\n* Jellyfin\n* Full ARR stack\n* Audiobookshelf\n* Shelfmark\n* Seerr\n\nSince it was my only machine initially, a lot of other services lived here too before eventually being migrated into VMs.\n\n*Not affiliated in any way, but I've been using Quartermaster on iOS to manage a lot of this remotely and it's been fantastic.*\n\nBecause this server is bare metal, it's backed up using Veeam Agent for Linux instead of PBS.\n\n# HP EliteBook 840 G11 (Ultra 7)\n\nThe laptops have had their batteries removed.\n\nI don't need spicy pillows sitting inside my rack. 😅\n\n# LXC\n\n* AdGuard Home\n   * I use Tailscale on all my devices and have AdGuard configured as my DNS server.\n\n# VM 1 – Monitoring\n\n* Prometheus\n* Grafana\n* Uptime Kuma\n* Scrutiny\n\n# VM 2 – Backup\n\n* Proxmox Backup Server (PBS)\n\nThis simply backs up all my VMs to the newest Synology.\n\n# HP EliteBook 840 G11 (Ultra 5)\n\nThis VM hosts most of my \"useful\" self-hosted applications:\n\n* BookStack\n* Actual Budget\n* Second Actual instance for a friend\n* Mealie\n* ntfy\n* Fail2Ban\n* Traefik\n\nI've integrated ntfy with quite a few things:\n\n* Failed Proxmox backups\n* Uptime Kuma alerts\n* Synology notifications\n* Other service alerts\n\nFail2Ban is also integrated with Cloudflare so IPs that are scanning or repeatedly failing logins get blocked automatically.\n\n# Dell OptiPlex 7010 Micro\n\nCurrently this only runs:\n\n* Application Management Panel (AMP) for game servers\n\nI experimented with Docker for game servers but honestly found AMP much easier to manage.\n\n# Future plans\n\n* Home Assistant (already ordered a Home Assistant ZBT-2 and a pile of IKEA smart home gear)\n* Authentik (kind of embarrassing that IAM is literally my job and I still haven't played with it...)\n* Immich (still undecided. I don't take enough photos (nor care much about them) to know if it's worth the maintenance)\n* Hyper Backup replication with a friend's NAS so we each have an off-site backup\n\n# Biggest surprises\n\nThe two applications that have impressed me the most are:\n\n**Actual Budget:** I used Excel for budgeting before, but Actual is simple, fast, and works surprisingly well once connected to my bank and original setup was done.\n\n**BookStack:** Having proper documentation for the homelab has been very nice. Easy to set up a VM again or go over notes so I don't have to look for the same obscure documentation over and over.\n\nIn short, the journey so far has been amazing and it's really given me a lot of ideas and also confidence to be open to introducing Linux and or dockers at the workplace should the need ever arise.\n\nI'm always looking for new things to learn, so if you have suggestions for improvements or services I should try I'd love to hear them!","offTopic":false}],"breakdown":[{"sourceKey":"reddit","sourceName":"Reddit","count":8}],"total":8}}