Homelab Infrastructure
The self-hosted server stack that everything else here runs on.
Overview
Everything I build needs somewhere to run, and I decided that somewhere would be hardware I own. The homelab is the self-hosted platform underneath most of the other projects on this site: it hosts websites, network storage, home automation and whatever experiment I am running that month, with no cloud bills and no vendor lock-in. This portfolio is served from it. My car vision system archives its footage to it. My climate control system reports into it. When a project on this board says live, this is where it is live from.
The hardware
None of it started life as server gear. The rack lives in an old amplifier flight case, and the machines in it are repurposed from my PC building work, which has covered everything from budget rigs to a dual-socket X99 workstation. Off-the-shelf server hardware is overpriced for what a homelab needs, so I build and repurpose instead, and retired builds get a second life in the server stack.
The stack
Proxmox sits at the bottom and splits the hardware into virtual machines and LXC containers, so each service gets its own isolated environment and a broken experiment cannot take anything else down with it. TrueNAS provides the network storage, with the layout designed so a single drive failure is survivable rather than fatal. Application services run in Docker on top, with Nginx fronting the web-facing ones. The automation side is Home Assistant with ESPHome devices spread around the house, which is also where my smart climate project plugs in.
The network
The network is split into two planes that never mix. Public traffic, for this portfolio and the other sites the stack serves, comes in through Cloudflare to a single hardened Nginx entry point, and that entry point is the only thing exposed to the internet. Requests for hostnames it does not recognise get the connection closed with no response at all, so anyone scanning the raw IP learns nothing about what runs here. Rate limits sit in front of the applications, and the host firewall only accepts web traffic from Cloudflare's published address ranges. Everything private, the hypervisor, the storage, the dashboards, lives on a Tailscale mesh instead: zero-config access from any of my devices, anywhere, without a single forwarded port.
What it runs
Day to day the stack serves this portfolio, carries client work, stores and serves media, and runs the automation for the house. It is also the landing zone for the other builds: dashcam footage from the car vision system offloads onto TrueNAS, and the climate control dashboard is reachable from anywhere over the mesh. That is the real point of running a homelab. The next idea always has somewhere to go: a new experiment is a new VM or container, not a new monthly bill. It is never really finished, which is exactly how I want it.
The hardest problem
There is no single clever algorithm in this one. The hard part is that everything has to hold at once, indefinitely. Storage has to be laid out so a drive failure is an inconvenience rather than a data loss. Several public websites have to route cleanly off one connection without interfering with each other. And I need full admin access from anywhere without opening the house network to the internet. The design that answers all three is the strict split into two planes: public traffic enters only through Cloudflare into one hardened Nginx entry point, which drops anything it does not recognise, while the hypervisor, the storage and every dashboard live on the Tailscale mesh and are unreachable from outside. Keeping a stack this varied stable, patched and reachable, month after month, is the actual engineering.
Start a project
Want something built like this?
Everything on this page was designed, built and hosted by one person. Tell me what you need and I reply with scope, cost and timeline, usually within two working days.