ITEN
$ cat homelab.md

My homelab

A server at home where I learn to design, secure and automate infrastructure the way a systems administrator would.

Goal

I work in IT support and I want to grow into a systems administrator role. The most concrete way I found is to build and run a real infrastructure: virtualization, networking, secure remote access, monitoring, backups and automation. Everything here is in daily use, not a demo.

Hardware

HypervisorProxmox VE
CPUAMD Opteron X3216
RAM~32 GB
Disks1 × 230 GB + 3 × 930 GB
StorageZFS RAIDZ1 on the three 930 GB disks

Architecture

Internet
   │
Cloudflare (DNS · Tunnel · Access with Google login)
   │
cloudflared LXC ──► internal services (dashboard, monitoring, password manager…)
   │
Proxmox VE ── ZFS RAIDZ1
   ├─ LXC: Pi-hole (DNS and ad-blocking)
   ├─ LXC: NAS (Samba on a ZFS dataset)
   ├─ LXC: game server
   ├─ LXC: dashboard and monitoring
   └─ Tailscale / WARP for private access

Stack

Virtualization and storage

  • Proxmox VE with LXC containers (Debian)
  • ZFS RAIDZ1 pool
  • NAS with Samba on a ZFS dataset

Network and access

  • Domain managed on Cloudflare
  • Cloudflare Tunnel: no open ports on the router
  • Cloudflare Access with Google login, also for SSH from the browser
  • Tailscale and WARP for private access
  • Pi-hole as local DNS

Self-hosted services

  • Dashboard for quick access to services
  • Password manager (Vaultwarden)
  • Game server for friends
  • Email on the domain and this site on Cloudflare Pages

Monitoring

  • Uptime Kuma for service availability
  • Prometheus and Grafana for Proxmox and container metrics

Security and backups

  • Services behind Cloudflare Access
  • Fail2ban
  • Backups with vzdump on the ZFS pool and an off-site copy on Cloudflare R2

Automation

  • Ansible for configuring and maintaining the containers

What I learned

I learned to think in layers: storage and virtualization first, then networking and DNS, then access, security and observability. Exposing services without opening ports, keeping backups off the machine and monitoring what runs are habits I bring to my day-to-day work too.

Next steps

Read-only public dashboard

Make the status of the services visible to others, without edit permissions.

More monitoring

Bring Grafana and Prometheus into Uptime Kuma and the dashboard, with protected access.

Credential management

Move all secrets into the password manager and keep them out of configuration files.

Let's talk

If you'd like to know more about the project, write to me at lorenzo.mustone@gmail.com or use the chat on this site.