Home Lab • Infrastructure • Security
Infrastructure designed to be operated, not merely demonstrated.
My Home Lab is a segmented, monitored and backed-up single-node Proxmox platform. I use it to practise design, operations, security and recovery under realistic constraints.
The goal is not to collect services. Every component must answer a need, produce a useful signal, have a source of truth and be recoverable or removable cleanly.
Architecture
Clear boundaries and acknowledged dependencies
This view is intentionally functional: no internal addressing, port, credential or exploitable rule is published.
Separate usage
Administration, services, public exposure and IoT traffic remain in distinct functional zones.
Observe before acting
Metrics, logs, probes and alerts provide independent state before and after every change.
Prepare recovery
Backups, hashes, rollback and recovery order are defined before risky operations.
Operating model
Four capabilities connected to evidence
Technologies are means; the objective is to maintain a service that is understandable and reversible.
Architecture & segmentation
Limit implicit dependencies and the exposed surface.
Centralized publication, separate administration access and filtering across functional boundaries.
VLANVPNDNSReverse proxy
Useful observability
Detect actual failure without manufacturing false-green status.
66 targets, 27 probes, centralized logs, Grafana alerts and validated ntfy notifications.
PrometheusGrafanaLokiAlerting
Continuity & recovery
Know what to restore, in which order and with which evidence.
PBS, an offline USB copy, SHA-256 checks, a restore validator, RTO/RPO and runbooks.
PBSUSB offsiteDRRTO/RPO
Reproducibility & security
Reduce manual changes and retain a readable return path.
Canonical Compose, pinned images, local validation, change logs, checksums and minimal changes.
DockerGitHardeningRollback
Problem → method → outcome
Four end-to-end improvements
Every change retains its initial state, rollback path, validation and residual debt.
Make Docker reconstructible
- Problem
- Project parameters had to be compared with the actual runtime state.
- Method
- Inventory, declarative/runtime comparison, Compose normalization and validation without a global recreate.
- Outcome
- 44 running services, 42 registry images and two identified local builds.
Improve monitoring signal
- Problem
- Duplicate or misplaced probes could obscure the cause of an outage.
- Method
- Removed duplication, checked Error/NoData states and tested firing/resolved delivery to ntfy.
- Outcome
- 66/66 targets and 27/27 probes with no active alert and no hidden rule used to manufacture green status.
Move from backup to recovery planning
- Problem
- Existing backups alone did not demonstrate a recovery capability.
- Method
- PBS coverage, an offline USB copy, SHA-256 manifests, collision guards and isolated validation.
- Outcome
- Expected coverage confirmed, verification evidenced, the restore validator installed and rollback controlled.
Restore power continuity
- Problem
- UPS telemetry existed through the NAS, but an outage produced neither reliable notification nor PVE action.
- Method
- SNMP into Prometheus, persistent guard state, strict SSH, a constrained helper and simulated battery/mains tests.
- Outcome
- Critical/resolved notifications received, PVE preflight valid and orchestration enabled without triggering an actual shutdown.
DR & limits
Credibility also means stating what remains
Backups are monitored, but they are not confused with high availability or a fully proven recovery plan.
What is in place
- Daily backups for eligible workloads with coverage checks
- Monitored PBS verification with failures made visible
- Offline USB copy with SHA-256 manifests and read-only validation mounts
- Isolated restore validator with collision guards and controlled cleanup
- Documented recovery order for network, DNS and publishing dependencies
- Application and infrastructure rollback prepared before every change
Publicly acknowledged limits
- The platform relies on one Proxmox node and is not presented as highly available.
- The offline USB copy reduces risk, while physical rotation remains an operational discipline.
- A real automatic power shutdown is not claimed: only battery/mains scenarios without shutdown have been validated.
- DNS redundancy remains within the same hardware failure domain.
Physical platform
Real infrastructure, documented without overexposure
Go further
Review projects and detailed outcomes
The case studies cover context, method, outcome and demonstrated skills without publishing sensitive operational data.