A home lab that runs itself

1. 01

   Everything is code

   If it isn’t in the repo, it isn’t part of the lab. Every change is a reviewed pull request that passes CI.

2. 02

   Updates take care of themselves

   Renovate bumps every pinned version; at 04:30 the node applies main behind a snapshot and rolls back if a health check fails.

3. 03

   Two copies, two places

   Service containers are backed up to the NAS every night, and the NAS’s irreplaceable data is pulled to the node.

4. 04

   Nothing is exposed

   No open ports at home. Private services go over Tailscale; anything public leaves through a single, isolated Cloudflare Tunnel — never a port forward.

5. 05

   Alerts, not dashboards

   Every service is probed; failures, failing disks and UPS events reach the phone within minutes.

Proxmox VE + LXC

one container per service, a snapshot before every update

Harbor

private registry, signed images (cosign), vulnerability scans

Prometheus · Grafana · ntfy

metrics, dashboards, alerts on the phone

AdGuard Home ×2

DNS plus ad and malware blocking for every device

Caddy + Tailscale

real certificates and the same names at home and away

Vaultwarden

passwords, reachable only over the tailnet

Renovate + GitHub Actions

every version pinned, then bumped and merged automatically

n8n + GLM

the automation that writes this site’s news

Uses →