Skip to main content
Featured Project

Self-Hosted Homeserver Infrastructure

Production-grade homeserver running 40+ containerized services with Cloudflare tunneling, plus a cloud edge node for off-site monitoring, alerting, and encrypted backups.

Docker Nginx Grafana Prometheus Cloudflare Tailscale Caddy restic Linux Jellyfin
Self-Hosted Homeserver Infrastructure screenshot

Self-Hosted Homeserver Infrastructure

A homeserver built from repurposed PC parts, running 40+ Docker containers for media management, monitoring, and experimentation with open-source tools. Zero hosting costs, complete control over data.

What It Does

Self-hosted alternative to commercial cloud services, running everything from media streaming to infrastructure monitoring. Built to learn DevOps, networking, and system administration through hands-on practice.

Services Running

Media Stack (7 containers)

  • Jellyfin - Personal Netflix (media streaming)
  • Sonarr/Radarr - Automated TV/movie management
  • Prowlarr - Indexer manager
  • Bazarr - Subtitle downloader
  • Jellyseerr - Request management
  • qBittorrent - Download client

Monitoring

  • All monitoring runs off-site on the edge node (see below), so it keeps working when home is down

Infrastructure (10+ containers)

  • Portainer - Docker GUI management
  • Nginx Proxy Manager - Reverse proxy with SSL
  • Immich - Photo backup (Google Photos alternative)
  • Filebrowser - Web file manager
  • ROMM - Retro gaming library
  • Automated backups - Encrypted with restic and sent off-site to the edge node
  • Various automation tools

Total: 40+ containers running 24/7

Network Setup

Cloudflare Tunnel - No open ports, secure remote access without VPN

  • Exposes services without port forwarding
  • Built-in DDoS protection
  • Hides home IP address
  • Free tier

DNS - Cloudflare for external, local DNS for internal routing

SSL - Automated certificates via Let’s Encrypt

Cloud Edge Node

A free-tier ARM VM in the cloud that watches and backs up the home server from outside, so monitoring and alerts keep working when home is down.

Access: Tailscale only, with no public ingress and no public SSH. Caddy serves every service behind one wildcard TLS certificate issued through the DNS-01 challenge.

Off-site monitoring:

  • Prometheus collects the home server’s metrics, and Grafana holds all the dashboards
  • Alertmanager and Uptime Kuma push alerts to my phone through ntfy
  • A dead-man’s switch (healthchecks.io) fires if everything goes silent

Backups in both directions:

  • Home pushes encrypted, versioned restic backups to an append-only REST server on the edge node, which never holds the key
  • The edge node backs itself up to home over Tailscale
  • Restores are tested, not theoretical

Also running: Forgejo pull mirrors of my GitHub repositories and Loki for logs.

Tech Stack

Containerization:

  • Docker & Docker Compose for all services
  • Portainer for visual management
  • Resource limits to prevent conflicts

Networking:

  • Nginx as reverse proxy
  • Cloudflare Tunnel for secure access
  • Custom DNS for local/external routing
  • Isolated Docker networks

Monitoring:

  • Prometheus and Alertmanager on the edge node
  • Grafana dashboards for CPU, RAM, disk, network
  • Uptime Kuma and ntfy for off-site health checks and push alerts
  • Container-level resource tracking

Hardware:

  • Repurposed PC components
  • Linux (Ubuntu Server/Debian)
  • Multiple drives for media storage

Why Build This?

Learning:

  • Real-world Docker orchestration
  • Network security and tunneling
  • Infrastructure monitoring
  • DNS configuration
  • Linux system administration

Cost Savings:

  • $0/month hosting (vs $15+/month for cloud services)
  • Replaced Netflix, Google Photos, Paid Game Services etc.
  • All data under my control

Privacy:

  • No third-party access to personal data
  • Complete ownership of services
  • Custom configuration for everything

Technical Highlights

Docker Compose Management:

# Organized by service type
media-stack/
monitoring-stack/
infrastructure/

Cloudflare Tunnel:

# Zero-trust access without opening ports
cloudflared tunnel --url http://localhost:80

Resource Monitoring:

  • Container-level CPU/RAM tracking
  • Network throughput graphs
  • Disk usage alerts
  • Service dependency mapping

Results

  • 99%+ uptime with automated restarts
  • 40+ services running on single machine
  • $0 monthly costs (electricity only)
  • Complete privacy - all data under my control; off-site copies are encrypted before they leave home
  • Hands-on experience with production tools

Skills Gained

  • Docker and container orchestration
  • Reverse proxy configuration (Nginx)
  • Network security (Cloudflare, SSL/TLS)
  • Linux system administration
  • Infrastructure monitoring (Grafana/Prometheus)
  • DNS management
  • Automation and scripting
  • Troubleshooting containerized applications

Future Plans

  • Migrate to Kubernetes for learning
  • Implement proper CI/CD for config updates
  • Set up VLANs for better network segmentation
  • Expand monitoring with custom metrics