A self-hosted home server built on Proxmox VE, running a stack of privacy-focused and productivity services with a focus on security hardening, reliable remote access, and progressive improvement.
| Component | Spec |
|---|---|
| Device | HP 250 G7 Notebook |
| CPU | Intel Core i3-7020U (2 cores / 4 threads) |
| RAM | 8 GB DDR4 |
| Storage | ZFS RAID-Z1 pool |
| Hypervisor | Proxmox VE 9.1 |
The server runs a mix of LXC containers and KVM virtual machines under Proxmox VE.
| ID | Type | Role |
|---|---|---|
| CT 100 | LXC Container | Pi-hole (DNS / ad-blocking) + Cloudflare DDNS |
| CT 101 | LXC Container | Nginx Proxy Manager (reverse proxy + SSL) |
| VM 200 | KVM VM | Vaultwarden · Homarr · Uptime Kuma |
| VM 201 | KVM VM | Nextcloud (PostgreSQL + Redis) |
DNS-level ad and tracker blocking for the entire local network. Also handles local DNS records for internal services and acts as the DNS resolver for remote access via Tailscale split DNS.
Reverse proxy with wildcard SSL certificates (Let's Encrypt via Cloudflare DNS challenge). Handles HTTPS for all services — both publicly exposed and LAN-only.
Self-hosted Bitwarden-compatible password manager. Signups are disabled; access is restricted to existing accounts. Backup strategy: encrypted JSON export to offline USB storage.
Self-hosted dashboard for service links and status widgets. Internal access only.
Service monitoring and uptime tracking. LAN services are monitored by direct IP; public services by domain.
Self-hosted file sync and productivity platform, backed by PostgreSQL and Redis. Runs 3 CPU cores. Cron tasks run as www-data inside the container.
All services are accessible on the LAN via Pi-hole local DNS records. Internal-only services are not exposed through Cloudflare and have no public DNS records.
A small subset of services are publicly exposed through Cloudflare with DNS proxying enabled:
- Main domain (with HTTPS redirect)
- Nextcloud
All other services (Proxmox, Pi-hole, NPM, Vaultwarden, Homarr, Cockpit) are strictly LAN/VPN only.
Tailscale is installed directly on the Proxmox host, advertising the local subnet. This gives full LAN access to all services when remote, with Pi-hole DNS resolution via Tailscale split DNS.
A restricted tunnel user is configured on the Proxmox host for SOCKS5 forwarding via SSH. SSH is exposed on port 80 as a fallback to bypass institutional firewalls that block standard ports. Key-only authentication is enforced.
- SSH: Key-only authentication across all containers and the tunnel user; password auth disabled
- Secrets management: All credentials and API tokens stored in
.envfiles (chmod 600), not inline in compose files - 2FA (TOTP): Enabled on Proxmox, Nextcloud, Nginx Proxy Manager, and Homarr; Vaultwarden managed via Aegis on mobile
- Vaultwarden: Signups disabled; encrypted JSON backup to offline USB
- Fail2ban: Active on the Proxmox host for brute-force protection
- IPv6: Disabled at the router to prevent DNS bypass
- DNS access control: Internal-only services have no public DNS records; access is Pi-hole/Tailscale only
- Cloudflare: Only public-facing services are proxied; API token is scoped and rotated
| Category | Technology |
|---|---|
| Hypervisor | Proxmox VE 9.1 |
| Containerization | LXC + Docker (docker-compose) |
| Storage | ZFS RAID-Z1 |
| DNS | Pi-hole |
| Reverse Proxy | Nginx Proxy Manager |
| SSL | Let's Encrypt (Cloudflare DNS challenge) |
| Remote Access | Tailscale |
| DNS / CDN | Cloudflare |
| Password Manager | Vaultwarden (Bitwarden-compatible) |
| File Sync | Nextcloud + PostgreSQL + Redis |
| Monitoring | Uptime Kuma |
| Dashboard | Homarr |
| Security | Fail2ban, TOTP 2FA, SSH key auth |