Skip to content
Adam Palma, home

homelab

My homelab is where I run real services me, a friend and our families using the same tools I use for everyday work. It’s split across two homes: a rack server and a desktop at mine, a mini PC at my friend’s, joined into one private network. Everything runs headless Debian, services live in containers, data is copied between sites, and the whole thing is reachable from anywhere without a single open port on either router.

What this demonstrates:

  • Running and maintaining headless Linux servers
  • Containerised services that are easy to update, move and restore
  • Off-site backups across two physical locations
  • Secure remote access with Cloudflare Tunnel and Tailscale, with no exposed ports
  • Infrastructure configs version-controlled in Git

## hardware

  • ServerSite A

    Dell PowerEdge R720

    Main server. Runs every container and the sandboxed agent VM.

    • 2× Intel Xeon
    • 64 GB ECC RAM
    • 12 TB storage, XFS
    • Debian (headless) · Docker · KVM
  • WorkstationSite A

    Headless PC

    Consumer-hardware PC. Rips discs and syncs to the shared library. Also hosts back-ups and gitea

    • Ryzen 5 5600XT
    • 32 DDR4 GB RAM
    • 10 TB HDD + 1.8 TB SDD
    • Debian (headless) · Docker
  • Mini PCSite B

    Lenovo ThinkCentre M715q

    Second site. Rips discs and holds an off-site copy of the library.

    • AMD Ryzen 5 5600
    • 32 GB RAM
    • 1 TB Internal storage + 5 TB HDD
    • Debian (headless)

## services

  • Jellyfin

    Media

    Streams the shared film and TV library to phones, TVs and browsers.

    runs on: Server

  • Navidrome

    Media

    Streams the music library to any Subsonic-compatible app.

    runs on: Server

  • HandBrake

    Media

    Rips and encodes movie discs, then drops them into the shared library.

    runs on: Workstation, Mini PC

  • Nextcloud

    Storage

    Self-hosted file storage, sync and calendars, replacing Google Drive.

    runs on: Server, Workstation

  • Gitea

    Dev

    Private Git hosting for code and infrastructure configs that AI agents read and update.

    runs on: Workstation

  • Hermes agent

    Automation

    An AI agent running in its own KVM virtual machine, isolated from the host.

    runs on: Server, Workstation

  • Docker

    Platform

    Runs and isolates every service so each one can be updated, moved or rebuilt on its own.

    runs on: Server

  • Tailscale

    Networking

    Encrypted mesh network joining both sites for backups, library sync and admin access.

    runs on: Server, Workstation, Mini PC

  • Cloudflare Tunnel

    Networking

    Publishes the media apps to the internet without opening a single router port.

    runs on: Server

## network

Family & friends

phones · TVs · laptops

HTTPS

Cloudflare edge

DNS · TLS · DDoS protection

Cloudflare Tunnel: outbound only, no open ports

Site A · My place

  • Server

    Debian (headless) · Docker · KVM

    • Jellyfin
    • Navidrome
    • Nextcloud
    • Hermes agent
    • Docker

  • Workstation

    Debian (headless) · Docker

    • HandBrake
    • Nextcloud
    • Gitea
    • Hermes agent
Tailscale meshWireGuard-encrypted, all nodes

Site B · Friend's place

  • Mini PC

    Debian (headless)

    • HandBrake
Public traffic reaches only the media apps, through Cloudflare. Everything else, including backups, sync and admin access, stays inside the Tailscale mesh.

## write-ups