cat homelab.md
Homelab
Nobody pays me for this one. I run it because operating a system teaches you things that reading about it does not, and because I would rather my photos and passwords live on hardware I can see.
It runs on Unraid, with every service deployed as a Portainer-managed compose stack. The rule I hold myself to is the same one I would hold at work: everything is reproducible from a git repository. No snowflake containers, no configuration that exists only in my head or only on that box.
What runs
- ingress
- nginx · cloudflared tunnels · internal domain
- scm / ci
- GitLab CE
- platform
- Appwrite · self-hosted backend · multi-container
- vision
- Frigate · Intel iGPU inference
- photos
- Immich · dedicated ML container · pgvector
- data
- Nextcloud · PostgreSQL · Valkey
- home
- Home Assistant
- secrets
- Bitwarden
- media
- Jellyfin
Getting traffic in
Forwarded ports land on nginx, which reverse-proxies everything onto an internal domain so services are addressable by name rather than by remembering which of them is on port 8971. Cloudflared tunnels carry a subset of services that need to be reachable from outside without widening what is exposed at the edge.
Deciding what belongs on which path took more thought than the proxying did. Anything holding credentials or personal data stays behind the internal domain, and only what genuinely needs outside access gets a tunnel.
Inference on the box
Two services here do real machine-learning work, and both run on hardware I already own rather than on somebody's API.
Frigate runs continuous object detection over camera feeds with the Intel iGPU passed through for decode and inference. Doing this on the CPU pins the machine permanently; handing it to the GPU makes always-on detection something the box can do while also serving everything else.
Immich runs a dedicated machine-learning container against PostgreSQL with pgvector and VectorChord, which is what makes searching a photo library by what is in the picture work. It is the same shape as a production retrieval stack, at house scale.
What it taught me
Running this is the reason I am comfortable owning infrastructure at work. Backups you have never restored are not backups. A service you cannot rebuild from a definition is a liability. Certificates expire on the least convenient day available. None of that is knowledge I got from documentation.