Homelab: self-hosted infrastructure as code

Problem / Context

Running personal infrastructure at home without turning it into a manual configuration zoo: two physical hosts (a Raspberry Pi 5 and a Ryzen 7 8845HS mini-PC) needed to host dozens of services (platform, networking, observability, automation, content, finance, media player, integration, smart home, utilities) in a versioned, reproducible way with real failover, not just “works on my machine”.

Architecture decisions

Per-service Compose fragments, not a monolithic compose per host. Each service lives under infra/<category>/<service>/ and is included per host via include:. This lets a service be declared once and selectively enabled wherever it makes sense, without duplicating definitions across hosts.

DNS HA with no single point of failure. Primary/replica Pi-hole behind a virtual IP shared via keepalived/VRRP; name resolution for the whole network survives one host going down. Nebula Sync keeps both instances’ config automatically in sync.

Dual-path routing, not one proxy for everything. Internal services use Traefik with an in-house CA (step-ca, ACME) issuing automatic TLS for *.homelab. Public services go out via Cloudflare Tunnel for *.thalespm.me, with no port exposed directly to the internet; going public is a per-service Docker label decision, with MFA via Cloudflare Access on administrative ones.

Layered backup, not just “rsync every now and then”. Consistent database snapshots (SQLite/Postgres, never a hot copy) orchestrated by a custom scheduler (Dagu), complemented by multi-host filesystem backup via Restic with GFS retention (daily/weekly/monthly).

Technical flow

1. 01

   Declaration

   Each service is a reusable Compose fragment under infra/<category>/<service>/, selectively included per host via include:, no monolithic compose duplicated per machine.

   • Docker Compose
   • IaC
2. 02

   Dual-path routing

   Internal traffic (*.homelab) goes through Traefik with an in-house CA (step-ca, ACME) issuing automatic TLS. Public traffic (*.thalespm.me) goes out via Cloudflare Tunnel, with no port exposed directly to the internet, each service opts into being public via a Docker label, with MFA (Cloudflare Access) on sensitive ones.

   • Traefik
   • step-ca
   • Cloudflare Tunnel
   • Cloudflare Access
3. 03

   DNS high availability

   Primary/replica Pi-hole behind a virtual IP shared via keepalived/VRRP; losing one host doesn't take down name resolution for the whole network. Config sync between instances automated via Nebula Sync.

   • Pi-hole
   • Keepalived
   • VRRP
   • Nebula Sync
4. 04

   Observability

   Metrics via Prometheus/VictoriaMetrics + Grafana, centralized logs via Grafana Alloy → Loki, alerting and uptime monitoring via Uptime Kuma, with a mandatory compliance checklist every time a service is added or removed.

   • Prometheus
   • VictoriaMetrics
   • Grafana
   • Loki
   • Uptime Kuma
5. 05

   Layered backup

   Consistent database snapshot (SQLite/Postgres, never a hot copy) orchestrated by a custom scheduler (Dagu), plus multi-host filesystem backup via Restic with daily/weekly/monthly (GFS) retention.

   • Dagu
   • Restic
   • GFS
6. 06

   Security and remote access

   CrowdSec analyzes logs in real time and blocks malicious IPs. Tailscale acts as a subnet router, exposing the entire local network without opening a single port.

   • CrowdSec
   • Tailscale

Stack

Result / real-world use

Infrastructure 100% declared as code, documented and operated solo, covering network design, high availability, observability, defense-in-depth security and backup/disaster recovery. It also powers real business automation: n8n workflows automating financial reconciliation for an actual operation integrated with a card/PIX payment terminal, not just a homelab experiment.