Welcome to My Homelab: Your Gateway to Self-Hosting! reddit / selfhosted ---------------------------------------------------------------------- KillerTic · 2023-10-03 00:41 Hi everyone, I hope I understood the rules correctly, and this does not fall into any frowned-upon category! I have started my self-hosting journey about 4 years ago, running quite a lot at home - over 44 containers, and thoroughly enjoy what I have done and learned. On my way, I have taught three people what I have done and got them to join our little rabbit hole. Now I wanted to be able to share with more people and started my own site (based on Ghost) and today marks the first day of sharing. My first post just went live, which is "just" a general overview of my homelab. In the future, I will dive deeper into specific aspects of my setup in order to actually create a learning experience for others. If you liked the article, please do let me know, and I am also very interested in knowing if there are certain aspects you want to know more about. [https://nerdyarticles.com/my-homelab-a-general- overview/](https://nerdyarticles.com/my-homelab-a-general-overview/) ​ [My Homelab](https://preview.redd.it/5quoxl9kvvrb1.png?width=2272&form at=png&auto=webp&s=915a9bf30484c45e5560b873e5dcd9c1fd769dc5) ---------------------------------------------------------------------- sowhatidoit · 2023-10-03 01:00 Very cool! ---------------------------------------------------------------------- KillerTic · 2023-10-03 01:04 Thank you! ---------------------------------------------------------------------- GOVStooge · 2023-10-03 01:37 Very similar to mine. Couple things you might consider: I added Unbound as a recursive DNS solution (one each for each pihole). Pihole never looks outside the internal network for DNS resolution. Originally I used Cloudflare -companion as well, but I ditched it in favor of CNAME \*.domain.tld. Now my DNS records have no mention of the actual subdomains I run. Not saying my way is better, just that I like it and figured I'd share. ---------------------------------------------------------------------- KillerTic · 2023-10-03 01:42 Hey thanks for the tip! I‘ll have a look at Unbound! Regarding the wildcard CNAME, I used to have that as well, but at that time you could not proxy a wildcard CNAME entry. I haven’t checked since then and it also is worth mentioning, that I am on the free plan. Not saying my way is better, but I‘ll keep it 😆 ---------------------------------------------------------------------- GOVStooge · 2023-10-03 01:48 free plan as well.. As far as I can tell, it proxies. It's orange anyways :P ---------------------------------------------------------------------- KillerTic · 2023-10-03 01:53 Oh cool! Need to check it out! They must have changed it! Thanks man! Saves me checking the DNS entries from time to time and deleting old ones. ---------------------------------------------------------------------- GenerlAce · 2023-10-03 02:56 Well done. Please continue to give insight into your journey. Any tips, tricks, walkthroughs are greatly appreciated. Self hosting can be daunting, and the more information out there the better ---------------------------------------------------------------------- penghon · 2023-10-03 05:37 Thanks for the insight into your homelab. It was an interesting read. ---------------------------------------------------------------------- wall-e29 · 2023-10-03 05:41 I would love to read the full setup of authelia with lldap ---------------------------------------------------------------------- sowhatidoit · 2023-10-03 06:33 What is the File Backup app running on Hermes and BiForest? Also - what is the other app running inside docker on Hermes? Finally got through the whole article, and about page. Love that you are using GenAI! ---------------------------------------------------------------------- KillerTic · 2023-10-03 06:51 That is quite nice and handy. Will add it to the list! Have you signed up, so you will get an email when a new article is published 👍🏼 ---------------------------------------------------------------------- KillerTic · 2023-10-03 06:56 The file backup is always done with Restic. Will surely do an article on my backup strategy. I have been using this strategy for quite a while and it is sich a breeze to restore with! Hermes is the mailserver which is based on Mailcow. There is a docker compose, which will launch about 20 containers doing everything you need to run the mailserver. GenAi is a lot of fun to use! It makes writing and creating so much easier and fun. I adore the picture Bing Chat created with the whale in the server room 😍 And cool you made it all the way through. It is quite the long read, but I did not want to shorten it! ---------------------------------------------------------------------- KillerTic · 2023-10-03 06:58 Thank you! I am looking forward to share more!!! ---------------------------------------------------------------------- KillerTic · 2023-10-03 06:58 Glad it still was an interesting read!!! ---------------------------------------------------------------------- Edlace · 2023-10-03 07:21 Have you considered using proxmox backup server? You can install it alongside pve (since you’re already using proxmox…) ---------------------------------------------------------------------- KillerTic · 2023-10-03 07:56 Yes! Bifroest, which is a old laptop based at my parents house is running PBS. My VMs and LXC are backed up nightly, but I regard this backup as my last resort and I also don't find it feasible to use PBS to backup >200GB worth of files and pictures. Bifroest at the same time is on the receiving end of Restic for the file based backup. Imagine you delet one file or folder by mistake and now you have to restore from a large VM, only to spin it up and then copy the files somewhere else... Some files are in the PBS backup as well as Restic. I regard Restic as my main backup and the PBS VM backups are my safety net. ---------------------------------------------------------------------- Edlace · 2023-10-03 08:00 With pbs you have file based restore… you can just open the backup in your webinterface and download that one file or folder you need. I use it to backup everything in my homelab (about 4 TB of vm and personal data) Aswell as my psychical machines (laptop usw) with pbs client for Debian ---------------------------------------------------------------------- KillerTic · 2023-10-03 08:01 Oh I did not know that. Will need to check it out! ---------------------------------------------------------------------- moontear · 2023-10-03 08:53 Tell me more about that keepalived solution you are running (I’m fortunate - with my UniFi setup I can set up multiple dns servers via dhcp). Where is it running? How is it assigning a virtual IP? I would like having some kind of load balancer / fail over like that. ---------------------------------------------------------------------- [deleted] · 2023-10-03 08:54 [removed] ---------------------------------------------------------------------- moontear · 2023-10-03 08:57 I see you are running home assistant and authelia - it’s a real shame that HA is blocking the development of an OAUTH solution so we can use authelia (or others) to login. ---------------------------------------------------------------------- just-ans · 2023-10-03 09:00 Your site fonts are rendering a little weird on my Arch Linux machine, maybe it's the Linux can't render font's problem. Or maybe you setup the site while using a high DPI problem. The fonts are small and too sharp, when the site loads first, Obviously I can zoom and read. ---------------------------------------------------------------------- just-ans · 2023-10-03 09:04 BTW, what OS/Containerization are you using for Heimdall and Asgard?, I don't recognize those I con's on the top left. ---------------------------------------------------------------------- KillerTic · 2023-10-03 09:10 Some day, I probably will also pull the trigger on a dream machine and more UniFi swag :) It is surprisingly simple. Just installed directly on the two machines (or more) you want to have HA between, extremly simple config. You only need to make sure your virtual IP is free. I was also surprised, that it is not showing up in my router and just works. I will write about that, for now check out TechnoTim. I followed his guide to learn about keepalived. https://technotim.live/posts/keepalived-ha-loadbalancer/ ---------------------------------------------------------------------- KillerTic · 2023-10-03 09:11 I know right?! There is a git repo in my "to check out" list, which might solve the issue: https://github.com/BeryJu/hass-auth-header ---------------------------------------------------------------------- KillerTic · 2023-10-03 09:13 hmm, weird... As I am not great at design, I am using Ghost out of the box and haven't seen any issues so far. But I use Windows and iPhone/Ipad. All looks fine... also haven't heard about any issues from friends. The fonts it uses are "Modern sans-serif" and "Elegant serif" ---------------------------------------------------------------------- KillerTic · 2023-10-03 09:15 The Heimdall logo I also did not know before. That is an LXC container and thats the logo for LXC. Asgard runs TrueNAS-SCALE. ---------------------------------------------------------------------- KillerTic · 2023-10-03 09:54 By the way, it looks like Cloudflare enabled the wildcard proxy for free users on 03.05.2022! https://blog.cloudflare.com/wildcard-proxy-for-everyone/ ---------------------------------------------------------------------- ozzeruk82 · 2023-10-03 10:34 Very interesting, thanks for sharing. I've subscribed to your blog via RSS. I do many similar things, I like your setup. ---------------------------------------------------------------------- jmadden912 · 2023-10-03 10:40 Definitely worthwhile. Ive been using it successfully for a while. BeryJu is the dev of authentik fyi. ---------------------------------------------------------------------- KillerTic · 2023-10-03 10:42 Thank you! Looking forward to be sharing more detailed info about different areas of the homelab! ---------------------------------------------------------------------- KillerTic · 2023-10-03 10:44 Oh I didn't know and good to know you have been using the hass-auth- header successful! Authentik still is on my list of things to try. Looks quite promissing and I might switch over from authelia, due to the amount of features authentik brings to the table. ---------------------------------------------------------------------- nashosted · 2023-10-03 12:14 Love the diagram. Can’t wait to see more from you. Subscribed! ---------------------------------------------------------------------- KillerTic · 2023-10-03 12:26 Thanks! ---------------------------------------------------------------------- sowhatidoit · 2023-10-03 16:52 > https://nerdyarticles.com/my-homelab-a-general-overview/ Whao! No idea that could be done. Thanks for sharing. ---------------------------------------------------------------------- sowhatidoit · 2023-10-03 16:59 I look forward to reading your backup strategy because under my desk sits an almost identical machine as your HyperV, and on top of sits an old laptop - kind of like your asgard, both collecting dust. So many ideas!!! My main concern is that I might do too much too fast, I want to think the design through with security being paramount and convenience being the key. ---------------------------------------------------------------------- KillerTic · 2023-10-03 17:10 The last sentence sounds like a copy from my article :D Will surely cover that part soon. I wouldn't want to dive to deep into a homelab setup without the piece of mind, that I can basically break it, buy new hardware and be back up and running under 24 hours. There are also qquite a few things I still want to introduce regarding security, but I am now reaching some (for me) quite complex areas. ---------------------------------------------------------------------- hardypart · 2023-10-03 18:08 Would be great if you could share the authentication backend part of your Authelia config. I have LLDAP and Authelia both running seemingly properly (Authelia is working perfectly fine with file based user management), but i can't get it running with LLDAP. ---------------------------------------------------------------------- sowhatidoit · 2023-10-03 18:21 >Security is paramount, but convenience is key. This was so well written! This is my new mantra for my homelab. I might even frame it. On a different note, what type of skills were required for Ansible? I'll be setting up my homelab from scratch and to me the concept of documenting my configurations in Ansible seem like a no brainer. If I had a device failure, I could potentially use Ansible playbooks to restore the configs on a new machine. Is that how you use it? ---------------------------------------------------------------------- KillerTic · 2023-10-03 18:23 Sure thing. Will be a while before I actually write about it, so here you go. `authentication_backend:` `password_reset:` `disable: false` `# How often authelia should check if there is an user update in LDAP` `refresh_interval: 1m` `ldap:` `implementation: custom` `url: ldap://:` `timeout: 5s` `start_tls: false` `base_dn: dc=,dc= # Needs to match your LLDAP_LDAP_BASE_DN you set in your lldap container` `username_attribute: uid` `additional_users_dn: ou=people` `users_filter: "(&(|({username_attribute}={input})({mail_attribute}={i nput}))(objectClass=person))"` `additional_groups_dn: ou=groups` `groups_filter: "(member={dn})"` `group_name_attribute: cn` `mail_attribute: mail` `display_name_attribute: displayName` `user: uid=,ou=people,dc=>DOMAIN_NAME>,dc= # Create an extra user you add to the "lldap_strict_readonly" access group in lldap` ---------------------------------------------------------------------- KillerTic · 2023-10-03 18:31 Love it! Please post a picture, when you have framed it. Must say though, that cudos goes to ChatGPT. My instructions (part of it) where "Keeping everything secure is extremly important, but things have to stay convienient." I also love, what ChatGPT made from it. I really only use Ansible to run all my updates. on all my machines. Actually creating everything through Ansible playbooks might be great and maybe one day I try to create a playbook doing the standard Debian config, but before that I have tons of other things I want to do. :D So I can't really tell you what is needed, took me a while to get all updates working. Well TrueNAS is missing at the moment. In my mind it is a little overkill for a homelab, but hey I got an internal domain with SSL, pi-hole fail over and twice daily incemental backups... Who am I to say "That's overkill" ---------------------------------------------------------------------- hardypart · 2023-10-03 20:29 I will make sure to check that out as soon as I have time, thanks buddy! ---------------------------------------------------------------------- YinAndYangFang · 2023-10-03 21:47 Looking forward to more articles! Would be nice to see code included as well! Saw that you are running OwnCloud and was hoping to draw on your setup as an example. ---------------------------------------------------------------------- KillerTic · 2023-10-03 21:49 For sure is the plan to include code snippets and most likely also setup a git repo. But it will take me some time! ---------------------------------------------------------------------- moontear · 2023-10-04 04:54 Tried Authentik, a looooooooot (Keycloak I would add many more o's) more complicated than Authelia. Authelia does what it does and just works (tm). ---------------------------------------------------------------------- KillerTic · 2023-10-04 10:21 Tried it as well, but felt like the documentation still needed work or I just don’t understand enough 😂 ---------------------------------------------------------------------- just-ans · 2023-10-05 07:35 Yes, In windows and Mac these fancy fonts look good, but for long reading seasons personally I don't prefer/like them, but you do you keep up the good work. ---------------------------------------------------------------------- just-ans · 2023-10-05 07:36 Why do you use LXC container instead of docker? Do you get some performance benefits? ---------------------------------------------------------------------- KillerTic · 2023-10-05 07:41 Quite simple answer in that case. As the LXC runs my master Pi-Hole, I don't want it in my general docker stack. It needs to be up pretty much 24/7. Before I had a fail over Pi-Hole, it would have been extremly annoying, when I work on my docker stack and have to do a restart or something like that. So I opted for LXC, because I did not want the overhead of a full VM. ---------------------------------------------------------------------- sowhatidoit · 2023-10-06 22:47 I got access to Dall-E and ChatGPT plus - inspired from reading your blog! I'm curious what prompt did you give DALL-E to create the very cool looking Image for this post? ---------------------------------------------------------------------- KillerTic · 2023-10-06 22:56 Hey cool! I used Bing Image Creator with the prompt "Docker whale, sea of cables, server room, dark, slr, cinematic" Takes quite a few tries and tweaks to get a good looking picture. Try using prompts like "3D render", "cinematic", "DLSR" to get more beautiful pics. I also often use [ideogram.ai](https://ideaogram.ai) and [leonardo.ai](https://leonardo.ai) for creating pictures. Especially ideaogram is great, as it currently is the only AI know to me, which can handle text on pictures quite well, plus you can browse the pictures of others and look at the prompts they used. You do know though, that you do not need to pay for ChatGPT and Dall-E to do what I have done, right? Only reason to pay for ChatGPT is, if you need access to the plugins. I use the free ChatGPT version, as I like the writing of GPT 3.5 more then GPT 4.0. But If you want to use GPT 4.0, just use Bing Chat. OpenAI was bought by Microsoft and they integrated it into Bing. I haven't payed a cent for these services. Oh and make sure you check the terms and condictions, that you are allowed to use the results of AI tools you use. Bing, ideogram and leonardo I have checked for private use. ---------------------------------------------------------------------- sowhatidoit · 2023-10-06 23:24 Thanks for helping me get started. I've been thinking about starting a blog for my homelab with AI after seeing what you are doing - I hope you don't mind? LOL At first I felt guilty with the whole 'plagiarism' thing - but the more I think about it the more exciting this whole project seems. ---------------------------------------------------------------------- KillerTic · 2023-10-06 23:30 Why would I mind? It is a great experience. I really do enjoy it. I do not see it as plagiarism (if you mean using AI to help you). Everyone I explain GenAI to (its part of my job), I descibe it as your best buddy or assitant. Do make sure to check your facts. GenAI hallucinates (google it) and will tell you clearly wrong things. Have fun! ---------------------------------------------------------------------- just-ans · 2023-10-07 04:25 Can you run LXC containers on top of Proxmox? Don't you need some base OS for that? ---------------------------------------------------------------------- KillerTic · 2023-10-07 04:54 It is an inbuilt function of Proxmox, nothing I „hacked“ my way through to habe running. Also to keep in mind, that Proxmox is based on Debian. When you SSH onto the Proxmox host, it is just like any other Debian system. That’s also the base OS the LXC container is using ---------------------------------------------------------------------- BOC14 · 2023-10-08 10:51 Thanks for bringing Unbound to my attention too. I'm currently running pihole but it's a basic setup and redundancy is on my to do list, so OP and your comment have given me a lot of content to read. I'm curious, are you syncing any config between your instances? (for Unbound in particular) Do you have a sample docker-compose you can share for your pihole/unbound/keepalived setup? (keepalived is an assumption on my part)