A few years ago, “home server” meant an old laptop running Plex. Now I have two Proxmox nodes, 35+ containers, a MikroTik router handling VLAN segmentation, and enough self-hosted services that I actually need documentation to keep track of it all.
This is how it is all put together, the hardware, the network architecture, and why I made the choices I did.
The Hardware
Nothing fancy here. I am not running enterprise gear or rack-mounted servers.
homelab01 is a Dell OptiPlex Micro with an Intel i5-8500T, 6 cores but I gave 12 to Proxmox with hyperthreading, 64GB of RAM, and a mix of local-LVM for containers and a ZFS pool called tank for stuff that needs redundancy. This is the workhorse, it runs VMs and most of the heavier containers.
homelab02 is another OptiPlex Micro, but smaller, 4 cores, 32GB RAM. It handles lighter workloads, Pi-hole for DNS, the *arr stack for media, monitoring stack, and NPM Plus for reverse proxy.
Both sit on my desk, connected to a MikroTik hAP ax³ router. There is also a Buffalo TeraStation NAS, 4x 2TB WD Red in RAID10, for backups and media storage.
Total power draw? Maybe 60-70 watts. My electric bill did not explode.
Why Proxmox?
I could have just installed Docker on a Linux box and called it a day. But Proxmox gives me a few things Docker alone does not:
Snapshots and backups. Before I make changes to a container, I snapshot it. If something breaks, I roll back. This has saved me more times than I would like to admit.
LXC containers. They are lighter than VMs but more isolated than Docker containers. Each service gets its own IP, its own filesystem, and if one goes down, the others do not care.
Cluster management. Two nodes, one cluster. I can migrate containers between them if I need to do maintenance on one machine.
Resource limits. Each container has hard limits on CPU and RAM. Jellyfin cannot eat all the memory just because it decided to transcode four streams at once.
Network Architecture
This is where things get interesting. Everything runs through a MikroTik hAP ax³, and I have segmented the network into VLANs:
| VLAN | Name | Subnet |
|---|---|---|
| 10 | Home | 10.129.10.0/24 |
| 20 | Homelab | 10.129.20.0/24 |
| 30 | IoT | 10.129.30.0/24 |
| 40 | Guest | 10.129.40.0/24 |
| 50 | DMZ | 10.129.50.0/24 |
| 88 | Management | 10.129.88.0/24 |
Why bother with VLANs?
Security. My IoT devices, smart plugs, cameras, whatever, are on their own network. They can reach the internet and they can reach Home Assistant, but they cannot reach my laptop or my Proxmox servers. If some cheap smart plug gets compromised, an attacker hits a wall.
Isolation. Guest Wi-Fi gets internet access and nothing else. Friends who visit can browse the web, but they cannot accidentally, or intentionally, access my internal services.
Organization. When everything has its own subnet, troubleshooting becomes easier. If something on 10.129.30.x is misbehaving, I know it is an IoT device.
The firewall rules
The MikroTik handles inter-VLAN routing with a whitelist approach:
- Home, VLAN 10 can reach everything. It is my trusted network.
- Homelab, VLAN 20 can reach IoT, for services that need it, and the internet.
- IoT, VLAN 30 can only reach the internet and Home Assistant, specifically HomeKit ports 51827-51830. Everything else to Home or Homelab is blocked.
- Guest, VLAN 40 can only reach the internet. Period.
- DMZ, VLAN 50 can reach specific backend services on Homelab, like Immich or Jellyfin, but only the ports those services actually use.
This last bit is important. NPM Plus sits in the DMZ and proxies traffic to internal services. If someone compromises NPM, they can only reach the services I have explicitly allowed.
The Reverse Proxy
NPM Plus, or Nginx Proxy Manager Plus, is the only thing directly exposed to the internet. It handles SSL termination with Let is Encrypt certificates and forwards traffic to internal services.
I put it in the DMZ, VLAN 50, on purpose. Here is the flow:
Internet → MikroTik, port 80/443 → NPM Plus, DMZ → Backend services, HomelabThe firewall only allows NPM to reach specific IPs and ports. So even if NPM gets compromised, an attacker cannot just scan my entire network, they can only hit the services I have explicitly whitelisted.
Each public domain gets its own SSL cert from Let is Encrypt. NPM handles the cert renewal automatically. All I have to do is add a new proxy host, request a cert, and enable “Force HTTPS”.
Public services
Right now I am exposing about 15 services publicly:
photos.saulutions.ca→ Immich for photo managementmovies.saulutions.ca→ Jellyfin for streaminglibrary.saulutions.ca→ BookLore for ebooksauth.saulutions.ca→ PocketID for OIDC authenticationsaulutions.ca→ This website- And a bunch more…
Each one is a container on the Homelab VLAN, proxied through NPM.
What I am Running
Let us see. Deep breath.
Media stack: Jellyfin, Jellyseerr, Sonarr, Radarr, Bazarr, Prowlarr, FlareSolverr, Recyclarr, Deluge. This is the reason I built a homelab in the first place, to have my own Netflix.
Productivity: Immich, as a Google Photos replacement, Nextcloud in a VM, BookLore as a Goodreads alternative, Shelfmark for book downloads, and OpenCloud for file sync.
Infrastructure: Pi-hole for DNS blocking, NPM Plus for reverse proxy, Homepage as a dashboard, PocketID as an OIDC provider.
AI and experiments: OpenClaw, an AI assistant with tool access, an LLaMA embedding server, and various LLM related containers.
Monitoring: Prometheus, Grafana, Blackbox Exporter, and Healthchecks. I get alerts when things go down, and I have dashboards to see what is happening.
Other stuff: Remark42 for blog comments, Listmonk for newsletters, Wizarr for Jellyfin invite management, Tdarr for video transcoding, a Minecraft server.
That is 35+ containers across two nodes. Most are LXC containers, a couple are full VMs, Nextcloud and Windows, and a few run Docker inside LXC.
Monitoring and Alerting
I did not use to monitor anything. Then something would break and I would not notice for days.
Now there is a whole stack:
Prometheus scrapes metrics from everything, Proxmox nodes via PVE Exporter, services via Blackbox Exporter, and custom exporters for the NAS and MikroTik router.
Alertmanager sends me emails when things break. Service down for 30 minutes? Email. High CPU for 30 minutes? Email. Storage 85% full? Email.
Grafana visualizes it all. Dashboards for Proxmox infrastructure, service health, NAS status, and router metrics.
Healthchecks monitors cron jobs and scheduled tasks. If a backup job does not ping Healthchecks when it completes, I get an alert.
The best part? All of this is self-hosted. No external monitoring service needed.
What I Would Do Differently
Hindsight being 20/20 and all that:
I would start with VLANs from day one. Retrofitting network segmentation onto an existing setup is painful. Everything breaks when you move it to a new subnet.
I would document as I went. I have documentation now, but I wrote most of it months after setting things up. There were a lot of, “why did I configure it this way?” moments.
I would be more selective about what I self-host. Some services are more trouble than they are worth. Does my blog comments system need to be self-hosted? Probably not. But here we are.
Why Self-Host at All?
Fair question. Cloud services are convenient and someone else handles the patches.
But self-hosting gives me:
- Privacy. My photos, my documents, my data, it stays on my hardware.
- No subscription fees. I paid for the hardware once. The software is mostly open source.
- Learning. I know how this stuff works now. That is valuable.
- Control. When a cloud service decides to change their API or shut down, I am not affected.
Plus, there is something satisfying about running your own infrastructure. It is not for everyone, but if you are the type who enjoys tinkering, it is a fun rabbit hole.
Questions or want to set up something similar? Leave a comment below or get in touch.
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.