christopher@homelab:~_
bash - christopher@homelab

christopher@homelab:~$ whoami

christopher. I build and run a homelab at home

christopher@homelab:~$ cat mission.txt

christopher@homelab:~$ _

bare metal, always on 20+ services in Docker DNS · VPN · mail · monitoring
services … cpu … ram … disk …

# architecture

How traffic reaches the portfolio, the live terminal, and the Fabric SMP game server.

Visitors browser Cloudflare Pages static portfolio christopher-lab.pages.dev afraid.org URL forward → Pages CF Quick Tunnel WebSocket proxy terminal-gateway Homelab Caddy reverse proxy · TLS Docker services 20+ containers Tailscale mesh VPN AdGuard + Unbound recursive DNS terminal-gateway read-only shell Monitoring stack Maintenant · CrowdSec · OpenCanary · Kismet Apps · Mail · Trades · Visitors Stalwart · Roundcube · Wazuh · Restic Java players Minecraft client Bedrock players phone · console TCPShield DDoS proxy apex hides home IP playit.gg Java TCP relay SRV → tunnel playit.gg Bedrock UDP relay no TCPShield Fabric SMP Fabric server Java · Pterodactyl · :25565 Geyser Bedrock bridge · :19132 Cloudflare DNS dobasmp.net apex → TCPShield · SRV → playit Live status on portfolio Maintenant · GameDig player count · no public join info portfolio game server Java UDP HTTPS WSS TCP status.json LAN poll
static site path live terminal path TCPShield · Java Fabric SMP · playit homelab services

# how this site works

A quick case study on shipping a public portfolio when your ISP won't let inbound ports through.

Problem

I wanted a public portfolio that shows off the homelab (live status, a read-only terminal, the whole thing), but my ISP blocks inbound ports. I can't just point a domain at my house and call it a day.

Approach

I put the static site on Cloudflare Pages (free, fast, static hosting, no public origin on this box). My afraid.org subdomain forwards to Pages so I get a clean URL. For the live terminal, a Cloudflare quick tunnel on the homelab exposes a WebSocket to a read-only gateway with sensitive paths blocked and output redacted. Status syncs from Maintenant on a cron job.

Outcome

Public site with zero open inbound ports. Visitors get HTTPS, live monitoring, and a sandboxed shell peek at the stack. Deploys are a script on the homelab that pushes to Pages. When the box reboots, Docker brings everything back in about two minutes.

# the stack

Docker on the OptiPlex 5040, with Fabric SMP on the same host. Caddy terminates TLS for LAN services under dobasmp.net. Mail is self-hosted too.

Stalwart + Roundcube

Self-hosted email on the OptiPlex: Stalwart for IMAP/SMTP with Let's Encrypt, Roundcube for webmail over a Cloudflare Tunnel. Phone Mail on cellular reaches home through Tailscale (exit node). Outbound relay keeps deliverability sane on a residential line.

IMAPSMTPWebmailTailscale

AdGuard Home + Unbound

I use AdGuard Home with Unbound for network-wide blocking and recursive DNS. Queries go to the root servers, not some upstream resolver. LAN rewrites keep mail and apps on the OptiPlex when I'm home.

DNSPrivacyUnbound

Encrypted DNS

DoH, DoT, and DoQ endpoints so devices can resolve DNS privately. Works off-network too when I'm on the VPN.

DoHDoTDoQ

Tailscale

Tailscale mesh VPN with subnet routes, an exit node, and MagicDNS. I reach LAN services from anywhere without opening extra ports - including Mail on cellular when carriers block IMAP/SMTP.

WireGuardExit nodeMagicDNS

Visitor intel

Portfolio presence logging: every hit on christopher.isageek.net records IP, geo, device, and referer into a local SQLite dashboard. Public ingest; dashboard is password-protected.

AnalyticsPrivacy-localIPs

Caddy

Caddy as reverse proxy and TLS. Let's Encrypt certs via DNS-01, so every service gets a clean HTTPS URL. Local status page at proxy.dobasmp.net lists configured hosts.

Reverse proxyLet's Encrypt

Maintenant

Maintenant handles HTTP/TCP checks, host and container metrics, container logs, TLS expiry, and a status page.

MaintenantCrowdSec

Homepage

LAN startpage for AdGuard, Maintenant, Mail, Trades, Wazuh, CrowdSec, OpenCanary, Kismet, Minecraft, Visitors, and the rest.

DashboardLAN

Wazuh

Single-node SIEM (indexer + manager + dashboard) with host agent and phone alerts for high-severity events. Capped so it shares the box with Minecraft.

SIEMAgentAlerts

CrowdSec

Collaborative IDS: reads Caddy access logs and SSH auth, detects scanners and brute-force, and the host firewall bouncer drops bad IPs automatically. Alerts and decisions live in the CrowdSec Console (app.crowdsec.net); CLI cscli still available on the box.

IDSFirewallSSHCaddy

OpenCanary

LAN honeypot (SSH, RDP, MySQL, Redis, FTP, Telnet, VNC, NAS login). Hits send ntfy alerts with source IP and service.

HoneypotntfyDeception

Kismet WIDS

Dedicated USB Wi-Fi radio in monitor mode on the OptiPlex (Ethernet stays the uplink). Kismet passively watches nearby APs, clients, probes, and 802.11 alerts. The console is LAN/Tailscale only — not on this site and not tunneled.

WIDS802.11LAN

Restic backups

Nightly encrypted snapshots to the USB stick: stack configs, AdGuard, cron, and compose files. Retention: 7 daily, 4 weekly, 2 monthly. Disaster recovery for configs — not a full mirror of every uploaded file.

ResticUSBCron

Fabric SMP

A modded Fabric server with Geyser for Bedrock cross-play. Java players hit TCPShield first so the home IP stays out of DNS, then playit tunnels TCP to the box. Bedrock goes through playit only. Maintenant and this site show online status and player count - no join info posted here.

FabricGeyserTCPShieldplayit

# explore the stack

Read-only shell into /opt/stacks over a Cloudflare Tunnel. You can't edit anything. Sensitive paths are blocked and output gets redacted.

ssh - christopher@homelab (read-only) waiting…

# live status

Pulled live from Maintenant and the homelab host. Updates every minute.

checking…
Connecting to monitoring…

# reliability

What happens when the box reboots, how status stays fresh, and what I actually monitor.

live metrics

  • Host uptime…
  • Last deploy…
  • Last incident…
  • Status synced…

runbook

  • On reboot: systemd starts Docker; autostart brings up DNS, proxy, CrowdSec, mail, and the rest. USB mounts via fstab for Restic. Caddy picks up certs; tunnels reconnect.
  • Status sync: fetch_status.py runs every minute via cron. It pulls Maintenant endpoint checks, host CPU/RAM/disk, deploy timestamp, and incident log into status.json, then deploys if the hash changed.
  • Monitoring: Maintenant watches HTTP/TCP endpoints, container health, host metrics, and live logs in one UI. I get alerts when something stays down.

backups

  • Restic (nightly): encrypted repo on the USB stick at /mnt/backup-usb/restic - compose files, Caddyfile, AdGuard config, cron. Password in /opt/stacks/.restic.pass (root only).
  • Configs: same paths are in the Restic job; I also keep timestamped .bak files before edits.
  • AdGuard: periodic export of DNS rewrites and settings so I can rebuild filtering after a wipe.
  • Recovery test: full stack has come back from reboot in ~2 minutes. I treat that as the baseline DR drill.

# security model

How I limit blast radius on a box that is partly public-facing.

No inbound ports

Portfolio stays on Cloudflare Pages with outbound tunnels for the live terminal. UI services stay on tunnels or Tailscale — nothing admin-facing is published on the WAN.

Edge accessZero open ports

Read-only terminal

Path jail to /opt/stacks only. Blocked dotfiles, keys, env files, and databases. Output redacted. Commands audit-logged.

Least privilegeRedaction

Container hardening

Terminal gateway runs read-only rootfs, non-root user, cap_drop: ALL, and no-new-privileges. Secrets stay outside deploy paths.

Dockercap_drop

TLS everywhere

Caddy terminates HTTPS with Let's Encrypt via DNS-01. HSTS on proxied services. Encrypted DNS (DoH/DoT/DoQ) for clients that support it.

DNS-01DoH

Honeypot / deception

OpenCanary listens on unused LAN ports that are not published to the internet. Probes raise ntfy alerts with source IP and service.

OpenCanaryntfy

Wireless IDS

Kismet on a USB adapter in monitor mode. It sees SSIDs, probe requests, and layer-2 wireless alerts in the room. It does not join Wi-Fi, does not decrypt sessions, and the UI is not published on the WAN.

KismetMonitor mode

# the hardware

One recycled desktop today. Three phases to a fully local, VLAN-segmented homelab with zero cloud AI bills.

running now

  • HostDell OptiPlex 5040
  • CPUi7-6700 @ 3.4 GHz
  • Memory32 GB DDR3
  • Storage476 GB SATA SSD
  • OSUbuntu · Docker
  • NetworkTailscale · playit.gg

phase 1 · consolidate

  • Compute5040 · NVMe upgrade next
  • OSProxmox or Ubuntu + Docker
  • StackAdGuard · Caddy · Tailscale
  • AIQwen 2.5 Coder 7B (Ollama)

phase 2 · cameras

  • GPURTX 3050/4060 LP
  • CamerasReolink PoE + Frigate
  • NetworkTP-Link PoE+ · VLANs
  • AIQwen 2.5 Coder 14B (VRAM)

phase 3

  • ComputeATX · 64 GB DDR5
  • Rack19" + 1500VA UPS
  • GPU2× RTX 3090 · 48 GB
  • AIQwen 32B / DeepSeek-R1

Goal: VLAN segmentation + zero-utility-cost local AI coding (Aider / Continue.dev in VS Code)

# about

I run a homelab at home: DNS, VPN, reverse proxy, monitoring, and Docker. I built this portfolio site and the automation around it myself.

Building toward systems administration. The lab is where I practice what I do at work: monitoring, DNS, Linux, documentation, and recovery.

LinkedIn → configs on GitHub → try the terminal