Homelab

Self-hosted infrastructure as code — ~50 Docker services, Prometheus + Grafana power-monitoring, defense-in-depth security, fully reproducible.

---

TL;DR

• Defense-in-depth security — UFW + Suricata IDS + fail2ban + VPN killswitch + zero open ports.
• Power-aware monitoring — Prometheus + Grafana + Scaphandre measure real wattage and cost.
• Event-driven alerting — ~20 ntfy callers push SSH, sudo, IDS hits to phone in seconds.

---

By the numbers

~50 services

0 inbound ports

90 d metric retention

22.7k UFW drops / 7d

Sourced from docs/metrics.md — every figure links back to the command or dashboard that produced it.

---

Stack

Reverse proxy & access

Media

Photos & files

Local AI

Network & DNS

Security

Observability

Container management

Full per-service catalogue: docker/README.md

---

Showcase

_{Homepage — themed dashboards · live tiles · *arr stack}

_{Grafana — power, energy, cost, capacity}

Tooling demos

deploy.sh — idempotent rsync with conditional reloads

ntfy — event-driven push alerts to phone

---

Repo layout

.
├── docker/              # Compose stack (~50 services) + .env.example
├── homepage/            # Dashboard config (services + widgets)
├── scripts/             # deploy, healthcheck, backup/, security/, monitoring/, maintenance/, motd/, systemd/
├── security/            # UFW, fail2ban, SSH, hardening checklist
├── docs/                # Architecture, security model, threat model, runbook, DR, cost, decisions
└── .github/workflows/   # CI: shellcheck + yamllint + markdownlint + gitleaks + sanitize-check

---

Setup

git clone https://github.com/MrTorriz/homelab.git ~/homelab
cd ~/homelab

# 1. Configure
cp docker/.env.example docker/.env
$EDITOR docker/.env

# 2. Bring up the stack
docker network create homelab
cd docker && docker compose up -d

# 3. Apply security baseline
sudo bash ../security/ufw-baseline.sh
sudo bash ../security/install-fail2ban.sh

# 4. Deploy via the same flow on every change
../scripts/deploy.sh

Note: set LAN_IFACE in .env to match your NIC name. eth0 is a placeholder — modern Ubuntu typically uses enp* or ens* (check with ip -br link).

External access is opt-in — set up a Cloudflare Tunnel and point it at npm:443 (no router port-forwarding needed).

---

Documentation

• docs/architecture.md — How traffic, storage, and trust flow through the system
• docs/security.md — Defense-in-depth model + STRIDE analysis
• docs/observability.md — Three-layer model: metrics (Prometheus + Grafana + Scaphandre), events (~20 ntfy callers across 7 security + 13 operational sources), health (healthcheck cron) — dashboard screenshot
• docs/metrics.md — What the system actually catches (real numbers)
• docs/runbook.md — Incident playbooks: what to do at 03:00
• docs/disaster-recovery.md — RTO/RPO targets + zero-to-running restore
• docs/cost.md — What it actually costs to run, with receipts
• docs/hardware.md — Specs, storage layout, GPU role
• docs/decisions.md — Why these tools and not the alternatives

---

License

MIT — fork it, copy bits, learn from it.