Homelab

I run a small pile of self-hosted services from a single machine in my house, tunnelled out to the internet through Cloudflare and a Caddy reverse proxy. Everything on one box.

Architecture

At the centre of it is a Proxmox server I built myself: a Gigabyte X570 board, an AMD Ryzen 9 3900X (12 cores, 24 threads, in case you're counting), 64GB of RAM, and a handful of NVMe and SSD drives in ZFS pools. Nothing exotic, just enough power to run everything below without breaking a sweat.

On top of that I run 16 LXC containers and 2 VMs. Most services live in Docker, each in its own container, so I can nuke and rebuild one without touching anything else. A few (Caddy, Hermes, CUPS) run natively, no Docker required.

Getting traffic in without opening a single port on my router is Cloudflare Tunnel's job. It runs in its own container (CT 126) and connects outward to Cloudflare, so there's no port forwarding and no dynamic DNS to fuss over. Cloudflare also handles DDoS protection and, for anything sensitive, the login wall.

Once traffic is inside, Caddy (CT 127) takes it from there: one config file, automatic Let's Encrypt certificates, routed to whichever backend needs to answer. So the path a request takes looks like this:

Cloudflare DNS → Cloudflare Tunnel (CT 126) → Caddy (CT 127) → backend service

The rest of the network is refreshingly boring. A FritzBox 7590 AX does router duty, and an old Raspberry Pi 3B runs Pi-hole for DNS and DHCP, blocking ads for every device in the house. All of it sits on a 192.168.144.0/23 subnet.

Curious how any of this is actually wired together? It's all in homelab-docker on GitHub.

Services

Here's what's actually running:

Last updated: 2026-07-17