Homelab
in plain words
A single-node Proxmox server on a repurposed ThinkPad, with no public exposure, tested backups and unattended power recovery.
under the hood
Stack
- Proxmox VE
- Single-node host running KVM VMs and unprivileged LXC containers on LVM-thin storage
- Tailscale
- The only remote access path, with 2FA and ACLs; no port forwarding or public services
- Linux firewalls
- Per-guest default-drop rules, version-controlled and defined before each guest is deployed
- restic
- Encrypted nightly backups to Backblaze B2 with monthly automated restore tests
- Uptime Kuma
- HTTP health checks and a 60-second push heartbeat as a dead-man's switch
- Docker
- Debian application VM running containerized services such as Mealie and Homebox
- AdGuard Home
- Household DNS
The longer version
A single-node Proxmox VE 9.2 homelab running on a repurposed Lenovo ThinkPad T480 (4 cores, 8 threads, 32 GB RAM, 512 GB NVMe). It hosts household infrastructure and Omen, an always-on quantitative research data system. The environment uses default-deny guest firewalls, zero public internet exposure, Tailscale-only remote access, automated monitoring, encrypted off-site backups with restore testing, and unattended recovery after power loss.
Infrastructure
Proxmox VE runs KVM VMs and unprivileged LXC containers on Debian 13 with LVM-thin storage. Core services include AdGuard Home for DNS, a Tailscale subnet router, ntfy, Uptime Kuma, Audiobookshelf, and a Debian/Docker application VM running services such as Mealie and Homebox. Guests follow controlled startup and shutdown ordering so networking and monitoring stay available during recovery and battery shutdown.
The ThinkPad’s batteries work as a built-in UPS. Charge thresholds, AC power recovery, lid behavior, virtualization and Wake-on-LAN are configured for continuous server operation. Host health is monitored through chrony, SMART/NVMe checks and hardware sensors.
Security and networking
There’s no port forwarding and no public service. Remote administration happens only through Tailscale with 2FA and ACL-controlled access. Proxmox provides per-guest default-drop firewalls with narrowly scoped allow rules. Databases and internal APIs stay isolated inside Docker networks.
Proxmox administrative accounts use TOTP 2FA, SSH is key-only with purpose-specific keys, containers are unprivileged, and guests receive unattended security updates. Firewall configurations are version-controlled and defined before guest deployment.
Monitoring, backup and recovery
Uptime Kuma runs HTTP health checks and watches Omen through a 60-second push heartbeat that acts as a dead-man’s switch. Backup execution is monitored independently.
Omen is backed up nightly with restic to Backblaze B2, including raw captures, PostgreSQL dumps and required configuration. Backups are encrypted with bucket-scoped credentials. Monthly automated restore tests validate repository integrity, database dumps and sampled file hashes; the latest documented test passed on October 21, 2026.
The system is designed to ride out short outages on battery, shut down cleanly during long ones, and restore every service automatically when AC power returns. Infrastructure specifications, runbooks and ADRs document rebuilding and disaster recovery. The remaining recovery gap is off-host full-VM image backups.