Homelab

A repurposed gaming PC runs Proxmox: a Docker Compose stack (Jellyfin, Nextcloud, a custom FastAPI aggregator, and more) behind Caddy. Alongside it, an always-on HP ProDesk 600 mini server carries the essential services (Vaultwarden, Glance, a trading bot) in LXC containers: compact, low-power, quiet, and still up when the big box isn’t. Everything reachable only over a Tailscale mesh, with encrypted daily backups to S3. The diagram is live: click any node to see what it does and why.

View the repo →

seb@sebstack: ~/homelab $ docker compose ps
Homelab architecture diagramhomelabself-hosted stack on Proxmox — private mesh access, encrypted off-site backupsnetworkhypervisorcomputeservicesbackupPhoneLaptopTailscale mesh VPNWireGuard · no inbound ports exposedHTTPSRepurposed gaming PC · Ryzen 7 5800X · 32 GB RAMProxmox VE · hypervisorUbuntu VM · Docker ComposeCaddy — reverse proxyterminates TLS · certs issued by TailscaleAggregatorFastAPI · feedsNextcloudfiles · MariaDBJellyfinmediaUptime KumamonitoringPortainercontainer mgmtWatchtowerauto-updatesisolated bridge network · secrets via env varsHP ProDesk 600 · always-on mini servertailnetLXC host · essential servicesGlancedashboardVaultwardenpasswordsTrading botLXC · isolatedAWS · off-site backupdaily backupAmazon S3SSE-S3 · least-privilege IAMlifecycleExpire after 30 daysrolling retention · versionedrestore procedure documented
Click a component to inspect it.

Design decisions

Snapshot, then experiment

Proxmox buys VM/LXC isolation and snapshot-before-you-break-it, so experiments are low-stakes.

No public surface

Tailscale instead of port-forwarding: zero ports exposed, tailnet-only access.

Backups that survive the host

Daily Vaultwarden snapshots to S3 under a no-delete IAM user, so a compromised host can't wipe them.

Built, not bolted on

A custom FastAPI aggregator feeds widgets into Glance: the one piece of original code here.