The homelab.

Where I try out what I later apply at work. A small machine, closely monitored and documented end to end.

Homelab diagramThree paths that never mix. Visitors reach Cloudflare, which serves the website and the blog. I connect from outside through the WireGuard VPN, the only port open on the router. The Proxmox server only reaches out to the Internet to send a heartbeat to an external monitoring service.InternetHTTPSVisitorreads the site and blogCloudflarehosts the site and blogMe, away from homeWireGuard appExternal monitoringalerts if pings stopencrypted VPNheartbeatHome routerone open port: the VPNProxmox VEIntel NUC · LXC containersWireGuardAdGuard HomeNPMplusNextcloudUptime KumaCustom panelJellyfin
The homelab today: the site is served from Cloudflare, I get in over VPN, and the server only reaches out to raise alerts. See the full diagrams (in Spanish).

Hardware

Machine
Intel NUC: quiet, compact and low-power
CPU
Intel N150, 4 cores, with integrated graphics (Quick Sync for Jellyfin)
Memory
16 GB RAM
Internal disk
512 GB SSD for the system and containers
External disk
2 TB USB SSD for backups and cloud data
Hypervisor
Proxmox VE, with each service in its own LXC container
Power cut
Boots by itself when power returns and starts services in order

Services

Each one in its own container, with a daily backup and a write-up on the blog (in Spanish).

Network & access

Cloud & media

Monitoring & management

Security

  • A single open port on the router: the VPN. No admin interface is reachable from the Internet.
  • Proxmox firewall that only allows the home network for administration.
  • Second factor (TOTP) on Proxmox, Nextcloud and the custom dashboard.
  • Key-only SSH, no root password logins, and fail2ban wherever something is exposed.
  • Hardening measured with Lynis on the host and the containers.
  • Least privilege: the dashboard and maintenance access use custom roles.

Backups & recovery

  • Every container backed up nightly to the external SSD, keeping 7 daily, 4 weekly and 3 monthly copies.
  • Restores tested: a container comes back whole from last night’s backup.
  • Email alert if a backup fails and a heartbeat to an external service when it succeeds.
  • Logs flushed to disk every hour and a snapshot before every update.

Next up

An encrypted off-site copy to complete the 3-2-1 rule.

The full series on the blog (in Spanish): El homelab desde cero