Infrastructure
Homelab
This homelab is a fully self-hosted infrastructure project built to replace commercial SaaS tools with services I own, control, and can extend. It runs across a local Proxmox host, and a dedicated PC — all unified into a single logical environment through Docker, a shared overlay network, and a Tailscale mesh. Every service is defined as code, versioned in Git, and managed declaratively through Docker Compose stacks.
The goal was simple: eliminate reliance on third-party dashboards, ad blockers, automation platforms, and monitoring tools by building a personal cloud that is faster, private-by-default, and infinitely customizable.
Architecture Highlights
- Reverse Proxy & HTTPS — A custom-built Caddy image with the Cloudflare DNS plugin issues and renews wildcard TLS certificates automatically via the DNS-01 challenge. Every service is reachable at a clean service URL with valid HTTPS, whether it’s local or on a remote Tailscale node.
- Zero-Trust Networking — Services span multiple physical hosts but are stitched together into one flat network using Tailscale. Remote nodes are addressable by their Tailscale IPs, and Caddy proxies to them seamlessly.
- Network-Wide Privacy — AdGuard Home runs as a DNS filter Upstream resolution uses encrypted DNS (DoH to Cloudflare, DoT to Quad9) with DNSSEC validation enabled.
- Automation Platform — n8n runs with a dedicated PostgreSQL backend, powering workflow automations that connect webhooks, RSS feeds, notifications, and third-party APIs.
- Observability — Dozzle provides real-time log streaming, Beszel handles system-level metrics, and Watchtower monitors and auto-updates containers with email notifications on changes.
- Central Dashboard — Dashy provides a single pane of glass for launching and monitoring every service, while Dockge offers a web UI for editing and redeploying stacks without touching the CLI. Services Running DNS filtering (AdGuard Home), reverse proxy (Caddy), automation (n8n), audiobook streaming (Audiobookshelf), push notifications (ntfy), log viewer (Dozzle), monitoring (Beszel), dashboard (Dashy), stack manager (Dockge), container updater (Watchtower), and a custom RSS aggregation service backed by PostgreSQL.
What This Project Demonstrates
- Infrastructure-as-code discipline — every service is versioned, reproducible, and deployable from a fresh host in minutes.
- Security-first design — encrypted DNS, DNSSEC, wildcard TLS, private networking, and no exposed ports beyond what’s absolutely necessary.
- High-availability thinking — redundant DNS, automated failover paths, and container-level auto-recovery.
- Full-stack ownership — from bare-metal virtualization on Proxmox through container orchestration, reverse proxying, DNS, and end-user dashboards.