[ OK ] Personal Project · Uptime since provisioning

Personal Homelab
server, self-hosted.

10+ containerised services running on a dedicated Linux Mint server — monitoring, automation, secrets management, DNS filtering, and more. Zero cloud costs, full control.

Docker Linux Mint HashiCorp Vault Ansible Prometheus n8n
$ ls documentation/
GitHub →
SYSTEM ARCHITECTURE — PERSONAL HOMELAB HOST: Linux Mint · Bare Metal NETWORKING Pi-hole DNS filtering Nginx Proxy Reverse proxy Tailscale VPN mesh SERVICES n8n Automation Prometheus + Grafana Observability HashiCorp Vault Secrets mgmt Portainer Docker UI Ansible Infra as code Each service runs in an isolated Docker Compose stack · Vault handles all secrets · Ansible provisions from scratch

This page is the build record for the homelab. It covers why a builder self-hosts in the first place, exactly what runs on the box today, the reasoning behind the Docker/Vault/Ansible choices, and the full tech stack end to end.

Save as PDF →

Project overview

Overview
10+ services · all healthy
0 plaintext secrets on disk
10+ Docker services running
0 plaintext secrets anywhere
IaC Git-driven, Ansible-provisioned
~$0/mo vs $50+/mo SaaS equivalent

Cloud rents you a service.
Self-hosting owns it.

01 · Why Self-Host

Cloud services charge per service, per seat, per API call. For a builder running multiple personal tools — automation pipelines, monitoring dashboards, DNS filtering, workflow engines — the costs compound fast. More importantly, cloud services mean vendor lock-in and data leaving your control.

The homelab solves this: a dedicated Linux Mint laptop running 24/7 as a local server, managed as code, with every service containerised and reproducible from scratch.

$ git clone homelab && ansible-playbook site.yml — the entire server rebuilds from two commands. State lives in git, not in the OS.

What runs on it,
layer by layer.

02 · What Runs On It

Each service lives in its own /stacks/ directory with a dedicated docker-compose.yml. Services are grouped by function — infrastructure layer, monitoring layer, automation layer. Nginx Proxy Manager handles routing; AdGuard Home handles DNS at the network level.

Infrastructure Layer

  • Portainer — Docker container management UI, visual overview of all running stacks
  • Nginx Proxy Manager — reverse proxy with SSL termination for local services
  • Homepage — unified dashboard (port 3333) showing all services at a glance
  • AdGuard Home — network-wide DNS filtering, local DNS resolver
  • HashiCorp Vault — secrets management; all credentials injected at runtime, none stored in files

Observability Layer

  • Prometheus — metrics scraping from all services
  • Grafana — dashboards for system health, service uptime, resource usage
  • Uptime Kuma — service status monitoring with alerting

Automation Layer

  • n8n — self-hosted workflow automation, integrations without API key exposure
  • Ansible Semaphore — web UI for running Ansible playbooks; used for provisioning and updates

Three choices that
shaped the whole build.

03 · Build Decisions

Why Docker over bare-metal installs? Each service is isolated, versioned, and replaceable. Rolling back a broken upgrade means pulling the previous image. Full server restore from scratch uses the same compose files — the state lives in git, not in the OS.

Why HashiCorp Vault for a personal homelab? Because the habit of zero plaintext secrets — everywhere, always — is worth building at home. Credentials are injected at container startup via Vault agent. No .env files with real secrets committed anywhere.

Why Ansible Semaphore? Ansible playbooks handle provisioning and service updates. Semaphore gives a UI to run them without needing to SSH in each time — and creates an audit trail of what ran when.

Full tech stack,
end to end.

04 · Stack

Hardware

Dedicated Linux Mint laptop as server · Windows 11 workstation (remote management via WSL2)

Containerisation

Docker · Docker Compose stacks · Portainer for management

Security

HashiCorp Vault · Nginx Proxy Manager (SSL) · AdGuard Home (DNS)

Observability

Prometheus · Grafana · Uptime Kuma

Automation

n8n workflows · Ansible Semaphore · Git-driven IaC

Access

Homepage dashboard · SSH key auth · Reverse proxy routing