Self-Hosted Stack

Overview

This is the other kind of homelab — not the attack/defense cyber range (that’s AMVAT Labs), just the plain self-hosting itch: why pay for, or trust, a commercial cloud with something an open-source container can do just as well on hardware we already own. Everything below runs as its own Docker Compose service, sitting behind a single reverse proxy and a single login, built and maintained together with the same teammate behind AMVAT Labs.

Edge & identity

• Traefik — reverse proxy for every service below, handling routing and automatic TLS so nothing’s exposed raw.
• The handful of services that are genuinely public sit behind multiple layers of firewall, a configured WAF, automated IP blocking, and geo-blocking — so “publicly accessible” doesn’t mean “open to anyone, from anywhere, doing anything.”
• Authentik — single sign-on gating anything that shouldn’t be public, so there’s one login to secure instead of a dozen.
• A VPN for reaching internal-only assets remotely, secured with multiple MFA options — including FIDO hardware keys, not just a TOTP code — with user policies, group policies, and access control rules governing exactly who can reach what.
• Docker Socket Proxy — sits in front of anything that needs the Docker API, so a compromised container can’t just ask for the keys to the whole host.

Security & monitoring

• Vaultwarden — a self-hosted, Bitwarden-compatible password vault. The one thing you really don’t want handed to someone else’s cloud.
• Uptime Kuma — uptime monitoring for every service in the stack.
• Gotify — push notifications when Uptime Kuma (or anything else) has something to say.
• A custom watcher that polls the SSO provider’s sign-in audit log and pushes a Slack alert the moment a new login happens — because “who just logged in” shouldn’t require going and checking a dashboard.

Productivity & media

• Nextcloud — private file sync and storage.
• Navidrome — self-hosted music streaming, paired with Snagr so grabbing a track and having it show up in the library is a single click, not a download-then-move chore.
• Planka — a self-hosted Trello-style board for tracking the homelab’s own to-do list.

Automation

• n8n — workflow automation gluing several of these services together, including a custom AI-assisted resume/cover-letter pipeline that tailors application documents per job posting.
• Rclone — encrypted, scheduled off-site backups, so “self-hosted” doesn’t quietly turn into “single point of failure.”
• Custom error pages served through Traefik, because even a 502 should look like it belongs.