Side project · case study

Self-Hosted Home Lab

NAS private cloud — no inbound ports, zero-trust at the edge, declarative and versioned in Git.

A family-facing private cloud on a NAS: photos, files, media, and monitoring — all self-hosted, HTTPS everywhere, and rebuildable from this repo.

View on GitHubPublic status pageBack home

Architecture

Homelab architectureInternet traffic reaches Cloudflare edge for DNS, WAF, TLS, and Access, then enters the homelab through a Cloudflare Tunnel to a reverse proxy that routes to self-hosted services. Pi-hole, Dockge, and monitoring run alongside on the NAS.InternetHTTPS onlyCloudflare (Edge)DNS · WAF / TLS · Access (OAuth / SSO)mTLS · service tokensCloudflare TunnelHomelab (NAS)cloudflaredtunnelReverse proxyNPM · HTTPSSelf-hosted servicesImmich · OpenCloud · ntfy · …Pi-holeDNS + LAN rewritesDockgestack managementMonitoringKuma · Beszel → ntfy
Outbound tunnel only — no ports opened on the home router.

Design decisions

  1. No inbound ports

    All external traffic enters via Cloudflare Tunnel. The home router exposes nothing; the origin never needs a public IP.

  2. One hostname everywhere

    Public DNS resolves to Cloudflare; Pi-hole local rewrites map the same names to internal IPs on the LAN. Same URLs, TLS, and auth — at home or away.

  3. Auth at the edge

    Cloudflare Access enforces SSO/OAuth for humans; service tokens and mTLS for machines. Origins additionally validate Cloudflare’s signed JWT / client cert.

  4. Layered monitoring

    Uptime Kuma (liveness), Beszel (resources), Better Stack (public path + deadman heartbeat) — all alerts converge on self-hosted ntfy.

  5. Secrets stay out of Git

    Every stack is compose-as-code with `.env.example` templates. Runtime secrets live only in ignored env files; config is reproducible, credentials are not.

Stack

  • ImmichPhoto / video library and phone backup
  • OpenCloudFile sync and collaboration
  • Plex / PlexampMedia (runs on the NAS; not in the repo)
  • Cloudflare TunnelOutbound-only ingress, Access, mTLS
  • Nginx Proxy ManagerTLS termination and per-host routing
  • Pi-holeDNS, ad blocking, LAN hostname rewrites
  • DockgeCompose stack manager
  • Uptime KumaContainer and HTTP liveness probes
  • BeszelCPU, RAM, disk, temperature metrics
  • ntfyPush alert sink for every monitoring layer

Depth lives in the Homelab Infrastructure README — this page is the portfolio view.