Personal Homelab
server, self-hosted.
10+ containerised services running on a dedicated Linux Mint server, monitoring, automation, secrets management, DNS filtering, and more. Zero cloud costs, full control.
This page is the build record for the homelab. It covers why a builder self-hosts in the first place, exactly what runs on the box today, the reasoning behind the Docker/Vault/Ansible choices, and the full tech stack end to end.
Project overview
OverviewCloud rents you a service.
Self-hosting owns it.
01 · Why Self-Host
Cloud services charge per service, per seat, per API call. For a builder running multiple personal tools, automation pipelines, monitoring dashboards, DNS filtering, workflow engines, the costs compound fast. More importantly, cloud services mean vendor lock-in and data leaving your control.
The homelab solves this: a dedicated Linux Mint laptop running 24/7 as a local server, managed as code, with every service containerised and reproducible from scratch.
$ git clone homelab && ansible-playbook site.yml, the entire server
rebuilds from two commands. State lives in git, not in the OS.
What runs on it,
layer by layer.
02 · What Runs On It
Each service lives in its own /stacks/ directory with a dedicated
docker-compose.yml. Services are grouped by function, infrastructure
layer, monitoring layer, automation layer. Nginx Proxy Manager handles routing; AdGuard
Home handles DNS at the network level; Tailscale gives remote access without opening ports.
Infrastructure Layer
- Portainer, Docker container management UI, visual overview of all running stacks
- Nginx Proxy Manager, reverse proxy with SSL termination for local services
- Homepage, unified dashboard (port 3333) showing all services at a glance
- AdGuard Home, network-wide DNS filtering, local DNS resolver
- Tailscale, VPN mesh for secure remote access from my other devices
- HashiCorp Vault, secrets management; all credentials injected at runtime, none stored in files
Observability Layer
- Prometheus, metrics scraping from all services
- Grafana, dashboards for system health, service uptime, resource usage
- Uptime Kuma, service status monitoring with alerting
Automation Layer
- n8n, self-hosted workflow automation, integrations without API key exposure
- Ansible Semaphore, web UI for running Ansible playbooks; used for provisioning and updates
Three choices that
shaped the whole build.
03 · Build Decisions
Why Docker over bare-metal installs? Each service is isolated, versioned, and replaceable. Rolling back a broken upgrade means pulling the previous image. Full server restore from scratch uses the same compose files, the state lives in git, not in the OS.
Why HashiCorp Vault for a personal homelab? Because the habit of
zero plaintext secrets, everywhere, always, is worth building at home.
Credentials are injected at container startup via Vault agent. No .env
files with real secrets committed anywhere.
Why Ansible Semaphore? Ansible playbooks handle provisioning and service updates. Semaphore gives a UI to run them without needing to SSH in each time, and creates an audit trail of what ran when.
Full tech stack,
end to end.
04 · Stack
Hardware
Dedicated Linux Mint laptop as server · Windows 11 workstation (remote management via WSL2)
Containerisation
Docker · Docker Compose stacks · Portainer for management
Security
HashiCorp Vault · Nginx Proxy Manager (SSL) · AdGuard Home (DNS)
Observability
Prometheus · Grafana · Uptime Kuma
Automation
n8n workflows · Ansible Semaphore · Git-driven IaC
Access
Homepage dashboard · Tailscale VPN mesh · SSH key auth · Reverse proxy routing