Homelab Platform

The problem

I support enterprise systems for a living, and production is a bad classroom. I wanted somewhere failures were mine to cause and mine to fix — but a homelab only teaches you anything if you hold it to the standard you would hold work to.

The bar I set was that every web service runs behind HTTPS with no exceptions. That sounds modest until you notice roughly a third of self-hosted software ships with no TLS support whatsoever.

The approach

Six hosts on a single network segment running about 78 containers and 39 distinct services — media, documentation, automation, git hosting, dashboards, photo management, and the platform services holding it together.

A private certificate authority issues around 44 leaf certificates on one-year validity, renewed on an automated schedule. Running a CA teaches you quickly why certificate lifecycle is its own discipline: a renewal path requiring a human is a path that eventually fails at 2am.

Single sign-on covers fourteen services, split between reverse-proxy forward authentication for applications with no concept of SSO and proper OIDC for those that have one. The access policy defaults to deny.

Observability runs metrics into Grafana and logs into Loki, with 133 health endpoints across 12 groups — 42 of them watching certificate expiry specifically. A dead-man’s switch catches the case where the alerting itself has died.

Backups are encrypted, deduplicated snapshots to offsite object storage on a schedule, with a separate integrity-check job, because a backup you have never restored is a hypothesis rather than a backup.

What was actually hard

Migrating the entire platform to new hardware on a different operating system. Fifty-four services came up on the new host at cutover, keeping the same network identity and every existing route, so nothing downstream needed reconfiguring.

The lesson that generalised best was an anticlimax: cutover day was survivable because the configuration was already in version control and the monitoring already existed. Nothing about it was clever. It was the payoff for having been boring about documentation for a year.

The outcome

Every pattern I use in production software was tried here first — reverse-proxy routing, certificate automation, structured logging, alert design, backup verification, self-healing automation. Nothing in the platform is reachable from the public internet; remote access is zero-trust with no inbound ports opened.

It is a laboratory that happens to also run the household, which means the consequences of getting it wrong are immediate and domestic.