Self-hosted homelab
Cloudflare to a VPS, tunnelled to a home server over FRP: a dozen services behind nginx and single sign-on, with a kiosk dashboard and an internet logger that settles arguments about the ISP.
- 12+
- services in production
- 2
- machines, one tunnel
- 0
- inbound ports on the home network
- Linux
- Docker
- nginx
- FRP
- Tailscale
- Authelia
- ZFS
- React
- Python
The problem
I wanted my own files, finances, notes, tasks and health data on hardware I own — reachable on a phone over mobile data, on a residential connection with no static IP and no port forwarding worth trusting.
My role
Everything, and the documentation that lets me rebuild it from scratch.
What I built
- 01
Traffic lands on Cloudflare, hits nginx on a VPS, and is tunnelled over FRP to the home server; Tailscale is the private path for administration.
- 02
Every service is a container with its own vhost, TLS and backups; ZFS holds the data with snapshots.
- 03
One login in front of my own apps via Authelia, with per-service rules — and every unguarded proxy location explicitly blanks the identity headers, because without that a forged header is a public bypass the moment an app starts trusting it.
- 04
A React kiosk dashboard on the server's screen showing IoT data, calendars and system state.
- 05
A Python network monitor logging latency, loss and outages to SQLite, so 'why was the internet bad last night' has an actual answer.
Outcome
Nextcloud, finance, notes, tasks, health, IoT and the WhatsApp gateway all run here, and have survived OS reinstalls because the rebuild is written down.
The identity-header hole was found and closed with a deliberate test rather than after an incident.
Monitoring turned ISP complaints into a graph I can show the ISP.