Homelab

I host my own services on a Proxmox server: Git forge and continuous integration, photos, password manager, email, home automation, monitoring, databases and game servers. Each one lives in its own container, and everything is created with a single command, for example “make deploy immich”.

In practice it runs a GitLab forge with its image registry and a CI runner, static sites each published on their own subdomain, MariaDB with phpMyAdmin, Vaultwarden for passwords, Immich for photos and videos, and Stalwart, a full mail server. On top of that come Radiance, my AI inference server (text, image, audio) on an AMD graphics card, Hermes, an agent connected to Telegram and Discord, an AMP panel for game servers and Home Assistant for home automation.

A versioned catalogue describes what each service needs: CPU, memory, disks, ports, secrets. The fleet itself is written nowhere. Every container created is tagged in Proxmox, then rediscovered on each run. Re-running a deployment breaks nothing: an existing container is found, never duplicated, and a missing secret stops everything before anything is created.

On the network side, Nginx is the only entry point. Services live on an internal network and are isolated from each other by the firewall, whose rules are generated automatically. Publishing a service takes one option: the subdomain, the TLS certificate, the port forwards and the firewall follow.

Data is kept apart from the system. What cannot be replaced goes on a backed-up volume, what can be downloaded again goes on one that is not, and the system disk can be thrown away and rebuilt. An unused container goes to sleep on its own and wakes up on the first request.

The repository is tested too: the host-side logic runs against a fake Proxmox, and every change goes through yamllint and ansible-lint.

• About twenty services in the catalogue, 27 Ansible roles, 17 playbooks
• Nginx as the single entry point: automatic TLS, fail2ban, country filtering
• Isolated internal network, firewall generated from the catalogue
• Scheduled backups, restores tested on an isolated copy, snapshot rollback
• Idle containers are put to sleep automatically
• AI inference server on GPU, models loaded on demand