Home
This is a reference hub and showcase for how I run, secure, and document my homelab and daily Linux workflows as well as solutions for problems I have faced (see troubleshooting section).
In 2025 I built my first PC ever from the ground up. Normally I am not a big fan of desktop PCs because they tend to take up much space, but I wanted something that I can expand in the future. At first I was looking for some kind of tower case with lots of bays like the THERMALTAKE Level 10 GT. But again my taste is too exotic, so I settled for the Newway NW1. Then in august 2025 I changed my mind again and wanted a smaller case, because I bought an old used Chieftec case I could expand with lots of HDDs and optical drives. I googled for weird and uncommon cases with unique features and immediately fell in love with the first result: the Jonsbo D31 mesh with screen.
For now I am really happy with this case. The builtin screen is perfect for docking messengers or monitoring software or as a backup if my primary monitors aren't working. Currently I have it configured to display btop as a wallpaper (via a KDE plugin).
AMD Ryzen 5 5600G - 6x 3.90 GHz AM4
For the GPU I went with the ASUS Dual Radeon RX 7600 EVO OC Edition 8GB GDDR6 which seemed like a decent middle tier graphics card. It runs even Silent Hill 2 remake pretty well on higher details. As long as you play on Linux of course. On windows the performance was expectedly much worse. It runs smaller LLMs, though not well. For the future I'm planning on getting a GPU with decent vRAM (16GB upwards) to really get good use out of local models.
- Motherboard: ASUS TUF Gaming B550M-PLUS WiFi II
- RAM: Patriot Memory Viper Elite II DDR4 2x32GB
- PSU: Toughpower Gt
- CPU cooler: Thermalright Assassin X 120R Digital Black
- Rear fan: Thermalright TL-S12
- USB PCIe 5 slot expansion card with power delivery
- more powerful GPU for better LLM inference and maybe gaming with raytracing
- Top fans, maybe AIO cooler
- CPU with more powerful iGPU
I have two RPis: a Raspberry Pi 3 which is currently not in use and a Raspberry Pi 4b 4GB which I currently use as a BlackArch-based security and lab node. I'm always having trouble finding good use cases, since I can do most stuff with my NAS already. I tried using it as a retro gaming station, but I hardly used it. So for now I have configured it as a server to experiment. I have WiFi antenna with monitor mode plugged in so I can practice a bit of pentesting. It also runs a snowflake proxy.
Case is the awesome GeeekPi Argon One V2 with M.2 expansion and a 240GB NVMe SSD.
I currently run Proxmox on Lenovo ThinkCentre M715q hardware for more demanding services that would otherwise consume too many resources on the NAS.
- Lenovo ThinkCentre M715q (AMD PRO A10-9700E)
- 16GB DDR4 RAM
- 1x 512GB NVMe SSD
- 1x 240GB SATA SSD
Current role:
- Hosts memory-intensive services (for example OPNsense and OpenWebUI)
- Runs LXC and containerized workloads depending on use case
- Serves as part of the core homelab compute layer
I previously used Synology devices (DS218j and DS224+), but recently moved my main workload to the Ugreen DXP2800. Main reasons were better hardware value for the price and more flexibility for splitting workloads across HDD and NVMe storage.
Configured Memory & Storage:
- 8GB DDR5 RAM
- 1x 4TB HDD
- 1x 2TB HDD
- 1x 2TB NVMe SSD
Current role:
- Main NAS and service host for always-on workloads
- Storage backend for documents, photos, and media
- Docker/LXC-adjacent services with backup integration into the wider homelab stack
Lenovo ThinkPad T570 — Intel i7-7600U, 16 GB RAM, 512 GB NVMe, running CachyOS (BORE+LTO kernel) with LUKS2 full-disk encryption and AppArmor.
Pixel 8 with GrapheneOS.
Pixel Tablet with GrapheneOS. Tried to use it as a laptop replacement. Not really useful for that, since it's media tablet with limited RAM and GrapheneOS and smart launcher seem to eat a lot of RAM.
FRITZ!Box 7590 AX v2 from my ISP. Will upgrade to one with OpenWRT support once I can afford it.
Everything sits behind the Fritzbox on the LAN subnet, with Zoraxy as the single reverse-proxy/TLS entry point for anything I expose. The two Proxmox nodes carry almost everything in the hosted services table below — PVE1 (ThinkCentre M630e) leans toward data/infra and misc utility LXCs, PVE2 (ThinkCentre M715q) toward identity, databases, and user-facing apps (Open WebUI, automation, dashboards) — with the NAS picking up media and always-on storage-adjacent services. The Raspberry Pi sits a bit outside that, running its own Tor Snowflake proxy and WiFi pentest lab. Anything remote — gaming PC, laptop, phone, tablet — reaches back in over Tailscale instead of poking holes in the router.
Mapped with Scanopy, a self-hosted network-discovery daemon I run here — it's systemd-managed now with a weekly scheduled scan, keeping this diagram honest against what's actually live instead of my memory of what I set up months ago.
flowchart TB
WAN(["Internet"])
FRITZ["FRITZ!Box 7590 AX v2<br/>router · LAN + WiFi"]
ZORAXY["Zoraxy reverse proxy<br/>single TLS entry point"]
subgraph TS["Tailscale mesh (remote access)"]
direction LR
GAMINGPC["Gaming PC<br/>Ryzen 5 5600G / RX 7600"]
LAPTOP["ThinkPad T570<br/>CachyOS"]
PHONE["Pixel 8<br/>GrapheneOS"]
TABLET["Pixel Tablet<br/>GrapheneOS"]
end
subgraph PVE1G["PVE1 · ThinkCentre M630e"]
PVE1APPS["Homebox, Patchmon, PiAlert,<br/>ByteStash, iVentoy, ProtonMail Bridge,<br/>Speedtest Tracker, apt-cacher-ng,<br/>Tor Snowflake, Excalidraw, DrawDB<br/>+7 more LXCs"]
end
subgraph PVE2G["PVE2 · ThinkCentre M715q"]
PVE2APPS["ai-hub (AI stack), Zoraxy, Keycloak,<br/>Gitea, Baikal, Zabbix, Scanopy,<br/>PostgreSQL, MariaDB, MongoDB, LLDAP<br/>+13 more LXCs"]
WINVM["Windows Server 2022 VM"]
end
subgraph NASG["NAS · Ugreen DXP2800"]
NASAPPS["Jellyfin, Portainer, Kiwix,<br/>Home Assistant, IT-Tools, draw.io,<br/>Proxmox QDevice +3 more"]
end
subgraph RASPI["Raspberry Pi 4 · BlackArch"]
SNOWFLAKE["Tor Snowflake proxy<br/>Folding "]
end
WAN --> FRITZ --> ZORAXY
GAMINGPC -. "Tailscale" .-> ZORAXY
LAPTOP -. "Tailscale" .-> ZORAXY
PHONE -. "Tailscale" .-> ZORAXY
TABLET -. "Tailscale" .-> ZORAXY
ZORAXY --> PVE1G
ZORAXY --> PVE2G
ZORAXY --> NASG
FRITZ --- RASPI
classDef wan fill:#868E96,color:#fff,stroke:#495057
classDef proxy fill:#F76707,color:#fff,stroke:#D9480F
classDef node fill:#0CA678,color:#fff,stroke:#087F5B
classDef remote fill:#E64980,color:#fff,stroke:#A61E4D
classDef vm fill:#4C6EF5,color:#fff,stroke:#364FC7
class WAN,FRITZ wan
class ZORAXY proxy
class PVE1APPS,PVE2APPS,NASAPPS,SNOWFLAKE node
class GAMINGPC,LAPTOP,PHONE,TABLET remote
class WINVM vm
- 2in1 LightBar from 4smarts - Webcam and monitor lamp combined
- Cherry secure board 1.0 - haven't figured out how to configure the certificate for keylogger blocking, but I love the card reader
- The full peripheral/gadget inventory (~69 items) is tracked in my self-hosted Homebox instance, so this section stays intentionally short
This is a list of services I host at the moment:
| Status | Service | Type | Description | Host | Exposure |
|---|---|---|---|---|---|
| ✅ | APT-Cacher NG | 📦 | Caching proxy for APT package downloads | PVE1 | 🔒 |
| ❌ | Atom | 📦 | Archival program I set up specifically for genealogy documents. Not yet fully configured. | PVE1 | — |
| ✅ | Auth | 📦 | Authentication/SSO support | PVE2 | 🔒 |
| ✅ | Autocaliweb | 📦 | Calibre-Web fork for self-hosted ebook library management | PVE2 | 🔒 |
| ✅ | Baikal | 📦 | CalDAV/CardDAV server for calendar and contact synchronization. Replaces the old Synology WebDAV Calendar & Contacts setup. |
PVE2 | 🌐 |
| ✅ | BentoPDF | 📦 | Browser-based PDF toolkit | PVE2 | 🔒 |
| ❌ | Bon Importer | 📦 | Receipt (Bon) importer, own project. Hope to publish it soon! | PVE2 | — |
| ✅ | ByteStash | 📦 | Self-hosted code snippet manager | PVE1 | 🔒 |
| ✅ | ConvertX | 📦 | Self-hosted file format conversion tool | PVE2 | 🔒 |
| ✅ | Databasus | 🐳 | Database backup program. Though the DB LXCs get backed up daily to a dedicated HDD on the NAS, I prefer to also have them in a more accessible format. | NAS | 🔒 |
| ✅ | Domain Monitor | 📦 | Domain and SSL certificate monitoring | PVE1 | 🔒 |
| ✅ | DrawDB | 📦 | Database schema diagram designer | PVE1 | 🔒 |
| ✅ | Drawio | 🐳 | Diagramming and flowchart tool | NAS | 🔒 |
| ✅ | Excalidraw | 📦 | Collaborative whiteboard/sketching tool | PVE1 | 🔒 |
| ✅ | Gitea | 📦 | Lightweight Git service for self-hosted repositories. I like to mirror repos there that run the risk of being censored, like VPN and encryption protocols. |
PVE2 | 🌐 |
| ❌ | Gramps Web | 📦 | Genealogy record web app (currently stopped) | PVE2 | — |
| ✅ | Homarr | 📦 | Personal homelab dashboard. From all the dashboards I tried, this one is the easiest to configure, because it can be done interactively and not via some backend yaml. | PVE2 | 🌐 |
| ✅ | Home Assistant | 🐳 | Home automation platform. Currently only serving as a CalDav bridge for homarr, since I don't have the money for the hardware to build a true homelab. |
NAS | 🔒 |
| ✅ | Homebox | 📦 | Self-hosted home inventory and asset tracker. Tried and worked with snipeIT before, but that's overkill for individuals. Homebox is much more fitting here (and has a prettier UI). |
PVE1 | 🌐 |
| ✅ | IT-Tools | 🐳 | Collection of developer utilities | NAS | 🌐 |
| ✅ | iVentoy | 📦 | Network PXE boot deployment tool. | PVE1 | 🔒 |
| ✅ | Jellyfin | 🐳 | Free media system for streaming music, movies, and TV shows. I also have a plugin for ebooks installed, so I have all kinds of media in one app. |
NAS | 🌐 |
| ✅ | Karakeep | 📦 | Bookmark and link manager. Another favorite. The chaotic filing system in this app is much more effective than rigid hierarchies. Just throw links in there and retrieval is enabled through (AI-)tagging and full-text search. A browser extension and an Android app are also included. |
PVE2 | 🌐 |
| ✅ | Kiwix | 🐳 | Offline wiki/content reader | NAS | 🔒 |
| ❌ | Koillection | 📦 | Collection management tool (currently stopped) | PVE1 | — |
| ✅ | LinkStack | 📦 | Personal link-in-bio hub | PVE2 | 🔒 |
| ✅ | LLDAP | 📦 | Lightweight LDAP server for centralized user management. Not really in use yet. |
PVE2 | 🔒 |
| ✅ | LM Studio | 💻 | Local LLM inference, OpenAI-compatible API server. Headless systemd service on the gaming PC (shared model/config storage across both CachyOS installs), plus a small always-on model on ai-hub via the official llmster daemon. | PC + ai-hub | 🔒 |
| ✅ | MariaDB | 📦 | Relational database server | PVE2 | 🔒 |
| ✅ | Mini QR | 📦 | QR code generator | PVE1 | 🔒 |
| ✅ | MongoDB | 📦 | Document database | PVE2 | 🔒 |
| ✅ | OAuth2 Proxy | 📦 | Reverse-proxy authentication layer. Very useful for apps like snapotter and bentopdf where I dont want to use auth for convenience sake, but also don't want random persons to have access. | PVE2 | 🔒 |
| ✅ | Open Terminal | 🐳 | Terminal sandbox for OpenwebUI models. | PVE2/AI-Hub | 🔒 |
| ✅ | Open WebUI | 📦 | AI chat interface with local and remote LLMs. | PVE2 | 🌐 |
| ✅ | PatchMon | 📦 | Linux patch/update monitoring | PVE1 | 🔒 |
| ✅ | Pi.Alert | 📦 | Network device presence and intrusion alerting. Great for looking up IP addresses quickly without having to login to the router admin panel. | PVE1 | 🔒 |
| ✅ | Portainer | 🐳 | Docker management UI. I have a free business license with GitHub SSO support. It manages three environments: NAS (docker, host), AI-Hub (podman, various MCPs) and RPi4 (also podman). |
NAS | 🌐 |
| ✅ | PostgreSQL | 📦 | Relational database server. My main DB I point every compatible app to. |
PVE2 | 🔒 |
| ✅ | Protonmail Bridge | 📦 | Protonmail IMAP/SMTP bridge | PVE1 | 🔒 |
| ✅ | Proxmox QDevice | 🐳 | Quorum device for the Proxmox cluster | NAS | 🔒 |
| ✅ | PVE Scripts Local | 📦 | Community-scripts local development/testing environment. LOVE that thing! | PVE2 | 🔒 |
| ✅ | Rackula | 📦 | Server rack planning/visualization tool. Not yet in use, but it will be once I can afford a real rack. |
PVE1 | 🔒 |
| ✅ | Reactive Resume | 📦 | Open-source resume builder | PVE2 | 🌐 |
| ✅ | Scanopy | 📦 | Network discovery and inventory daemon | PVE2 | 🔒 |
| ✅ | Snapotter | 📦 | Image processing toolbox with 50+ tools. | PVE2 | 🔒 |
| ✅ | SnowShare | 📦 | File, text and link sharing service. I use it for file requests since Ugreens solution doesn't allow for no-expiration of file request links. |
PVE2 | 🔒 |
| ❌ | SparkyFitness | 📦 | Self-hosted fitness tracker (currently stopped) | PVE1 | — |
| ✅ | Speedtest Tracker | 📦 | Automated internet speed monitoring | PVE1 | 🔒 |
| ✅ | Sure | 📦 | Personal finance manager | PVE2 | 🔒 |
| ✅ | Tor Snowflake | 📦 | Donates bandwidth to help Tor users bypass censorship. Highly recommend to install the browser extension wherever possible. |
PVE1 | n.A. |
| ✅ | WindowsServer2022 | 🖥️ | Windows Server VM used for testing and learning purposes. | PVE2 | 🔒 |
| ✅ | Zabbix | 📦 | Infrastructure monitoring platform. Not yet setup, another huge rabbit-hole to go down into. |
PVE2 | 🔒 |
| ✅ | Zoraxy | 📦 | Reverse proxy with automatic SSL. Very nice UI, much faster and easier to learn than the alternatives I tested. |
PVE2 | 🔒 |
| Symbol | Meaning |
|---|---|
| ✅ | Currently in use and running |
| ❌ | Stopped / not in use |
| 🐳 | Docker container |
| 📦 | LXC container / system package |
| 💻 | Desktop application |
| 🖥️ | Virtual machine |
| NAS | Ugreen DXP2800 NAS |
| PC | Desktop/Gaming PC |
| PVE1 | Proxmox Node 1 (ThinkCentre M630e) |
| PVE2 | Proxmox Node 2 (ThinkCentre M715q) |
| Raspi | Raspberry Pi 4 |
| 🌐 | Publicly accessible |
| 🔒 | Private/locally accessible |
| n.A. | Not applicable |
The AI stack lives entirely on one LXC on PVE2. Open WebUI is the front door; behind it sits Hermes which uses Signal as its gateway/delivery channel. The Conduit Android app is the mobile client channel for Open WebUI. Anything the agent needs beyond raw chat — web search, code search, database access, container management, network discovery — comes through the mcpo bridge proxying multiple stdio and http MCP servers (e.g. protonmail-bridge, notion, patchmon, portainer, scanopy). MCPJungle, an MCP gateway fronting all my local MCP servers of self-hosted apps (baikal, dbhub, homarr, homebox, karakeep, patchmon, portainer, protonmail, proxmox, reactive-resume, sure) exposes different toolgroups for hermes and OWU.
Long-term memory across sessions is handled by Honcho's managed cloud offering. Inference comes from LM Studio — headless on the gaming PC for bigger models, plus a small always-on model on ai-hub via the official llmster daemon — with cloud models via xAI/Grok and OpenRouter routed through Hermes.
The diagram below is generated from the actual live service/port state on the box, not from what I remember configuring, so it stays accurate and up to date.
flowchart TB
subgraph CHANNELS["Channels"]
direction LR
BROWSER(["Browser"])
CONDUIT(["Conduit app<br/>Android"])
SIGNALAPP(["Signal<br/>Android"])
end
subgraph FRONTEND["Frontend"]
direction TB
OWU["Open WebUI"]
end
subgraph AGENTS["Agent layer"]
direction TB
HERMES["Hermes<br/>agent gateway"]
CRON["Hermes cron<br/>scheduled jobs"]
CLIAGENTS["CLI agents<br/>Claude Code · Grok · vibe"]
end
subgraph MCPL["MCP tool layer"]
direction LR
MCPO["mcpo bridge<br/>sequential-thinking · firecrawl · notion<br/>tavily · portainer · scanopy"]
JUNGLE["MCPJungle gateway<br/>baikal · dbhub · homarr · homebox · karakeep<br/>patchmon · portainer · protonmail · proxmox<br/>reactive-resume · sure"]
end
subgraph PROVIDERS["Model providers"]
direction LR
subgraph LM[" "]
direction LR
LMSPC["gaming PC<br/>large"]
LMSHUB["ai-hub<br/>small"]
end
XAI["xAI Grok<br/>cloud"]
OPENROUTER["OpenRouter<br/>cloud"]
NOUSPORTAL["Nous Portal<br/>cloud"]
MISC["Mistral, Ollama cloud & any other API key I can get my hands on :p"]
end
subgraph BACKING["Memory & supporting services"]
direction LR
HONCHO["Honcho<br/>managed cloud memory"]
REDIS["Redis<br/>cache/RAG"]
TTS["Piper TTS"]
CODESRV["code-server"]
end
CONDUIT --> OWU
SIGNALAPP -. "gateway channel" .-> HERMES
HERMES --> MCPL
HERMES --> PROVIDERS
OWU -. "memory filter" .-> HONCHO
HERMES -.-> BACKING
classDef channels fill:#E64980,color:#fff,stroke:#A61E4D
classDef frontend fill:#4C6EF5,color:#fff,stroke:#364FC7
classDef agent fill:#F76707,color:#fff,stroke:#D9480F
classDef mcp fill:#0CA678,color:#fff,stroke:#087F5B
classDef provider fill:#7048E8,color:#fff,stroke:#5F3DC4
classDef backing fill:#868E96,color:#fff,stroke:#495057
class BROWSER,CONDUIT,SIGNALAPP channels
class OWU frontend
class HERMES,CRON,CLIAGENTS agent
class MCPO,JUNGLE mcp
class LMSPC,LMSHUB,XAI,OPENROUTER,NOUSPORTAL,MISC provider
class HONCHO,REDIS,TTS,CODESRV backing