A Complete Proxmox Home Lab Architecture Breakdown: 50+ Self-Hosted Services in Practice

What a Real Home Lab Actually Looks Like

In the self-hosting community, people frequently share lists of services they run — but these posts often stay at the level of "look at all this software I installed." A home lab setup shared by a Reddit user offers a far more instructive perspective. It serves double duty as both a daily-use environment for the household and a personal learning sandbox for new technologies. What makes it especially valuable is its honest distinction between services that are genuinely used and those that are just sitting there.

The entire environment is unified on Proxmox as the hypervisor, with Debian VMs running Docker and Komodo for container orchestration on top. What's particularly interesting is the deployment pipeline: Forgejo (a self-hosted Git service) handles code hosting, Komodo reads and deploys containers, and Docker labels drive Traefik for reverse proxying and service exposure. The entire chain forms a reproducible, version-controlled GitOps-style workflow — remarkably professional for a home environment.

GitOps is an operational paradigm that treats a Git repository as the single source of truth for a system. All infrastructure and application configurations are stored as code in Git, and deployments are triggered automatically by code changes rather than manual commands. Its core strengths are auditability (every change has a commit record), rollback capability (revert to any historical version), and reproducibility (a new machine can be rebuilt from the same codebase). In enterprise Kubernetes environments, ArgoCD and Flux are the dominant GitOps tools. This home lab achieves a similar effect with Forgejo + Komodo: developers push configuration changes to Git, Komodo watches the repository and automatically pulls the latest config to deploy containers, and Traefik dynamically updates routing rules by reading container labels — no human intervention required at any step.

The Primary Server, Jupiter: Production-Grade Daily Workloads

The author refers to the host named Jupiter as the home's "production environment." This machine previously ran Unraid and was migrated to the Proxmox + Debian VM architecture just a few weeks prior, bringing it in line with the rest of the environment.

The author's classification system is worth noting. Faced with the classic self-hoster's existential question — "do you actually use all this software?" — he honestly sorts services into distinct tiers:

Used Daily or Weekly

This tier represents the core value of the lab. It includes nearly 20 applications: Authentik (SSO identity management), Immich (photo library, an open-source Google Photos alternative), Plex (media server), Open WebUI (AI chat frontend), OpenHands (AI agent), Mealie (recipe manager), Outline (knowledge base wiki), Penpot (design tool), Forgejo (Git), and Windmill (workflow automation), among others.

Notably, AI-related tools have made it into the high-frequency daily use list. The combination of Open WebUI and OpenHands signals that local LLM chat and automated agents are becoming standard equipment in home labs — no longer just novelties to experiment with.

Backend Services Used Indirectly

Grafana, Paperless-ngx (document management), the Prowlarr/Radarr/Sonarr media automation suite (the *arr stack), and Tautulli (Plex statistics) fall into the category of "things users never directly open, but which continuously support the experience in the background." These services illustrate a mature lab's layered thinking — front-end applications depend on an entire invisible automation pipeline running beneath them.

The Infrastructure Layer: Logging In Means Something Is Broken

The author's description of infrastructure-class applications is memorable: "If I need to directly log into any of these things, something is broken. lol"

This layer includes Traefik (reverse proxy), Komodo (container management), CrowdSec (intrusion prevention), Wazuh (SIEM — Security Information and Event Management), VictoriaMetrics (metrics database), Beszel and Node Exporter (monitoring), Backrest (backups), Umami (web analytics), and VersityGW (S3 gateway).

From CrowdSec to Wazuh, paired with a complete metrics collection and backup solution, this security and observability stack is approaching small-business standards. For anyone looking to systematically learn DevOps and SRE practices, this is a genuinely useful tech stack reference. The author also candidly admits that several services — including Actual Budget, Navidrome, and Lidarr — "probably should be torn down." That kind of clear-eyed awareness of technical debt is equally worth learning from.

CrowdSec is a collaborative intrusion prevention system (IPS) that analyzes log files for anomalous behavior patterns (such as brute-force attempts and port scans), blocks attacks locally, and anonymously shares threat intelligence with the community — so all users benefit from a global blocklist of attacker IPs. Wazuh is an open-source SIEM platform that collects, correlates, and analyzes security logs from hosts, providing file integrity monitoring, vulnerability detection, and compliance auditing. VictoriaMetrics is a Prometheus-compatible, high-performance time-series database that consumes less memory and queries faster than native Prometheus at scale; it's commonly used as a long-term storage backend for Prometheus, paired with Grafana. Together, these three tools cover the complete security operations loop of prevention → detection → observability.

Saturn and Mars: Purpose-Built Nodes with Clear Responsibilities

Saturn was the first Proxmox host in the environment, originally used for spinning up VMs for testing and training junior colleagues. It has since evolved into the smart home and development hub. It runs Home Assistant (home automation), Music Assistant (multi-room audio), Z-Wave JS UI, Mosquitto (MQTT message broker), and two local voice components: Faster Whisper (speech-to-text) and Piper (text-to-speech). The latter two allow the voice assistant to operate entirely without cloud dependencies.

Mars is a Beelink EQ14 mini PC equipped with dual 2.5 Gbps NICs, dedicated exclusively to serving as a soft router and firewall. It runs OPNsense, Technitium DNS (primary DNS), Cloudflare DDNS, and Tailscale (as a VPN exit node). Isolating the router and firewall onto dedicated hardware rather than co-locating them with other workloads is a smart choice for improving network stability.

OPNsense is a FreeBSD-based open-source firewall and routing OS that provides enterprise-grade networking features including stateful firewall, traffic shaping, intrusion detection (via Suricata integration), and VPN — making it a popular choice for replacing commercial routers in home labs. Tailscale is built on the WireGuard protocol and establishes peer-to-peer encrypted tunnels between any devices, using relay servers (DERP) to traverse NAT, enabling secure remote access to home network devices. Deploying Tailscale on the dedicated Mars node as an exit node means other devices can route traffic through the home network's gateway — providing remote access to internal services while acting as a lightweight VPN gateway. Technitium DNS is a self-hosted, full-featured DNS server with support for DNS-over-HTTPS, ad filtering, and custom resolution rules, giving complete control over internal domain name resolution.

An Empty DR Cluster and IaC in Practice

Perhaps the clearest expression of this lab's learning-oriented character is three additional hosts named Uranus, Neptune, and Pluto. They also run Proxmox, but are kept intentionally idle — reserved exclusively for disaster recovery (DR) exercises and technology stack exploration.

Using OpenTofu (the open-source fork of Terraform) and Ansible playbooks, the author can spin up different "scenarios" or "DR bubbles" on demand, currently focusing on OpenStack, Kubernetes, and various business simulation environments. This combination of Infrastructure as Code and on-demand, disposable practice environments is precisely how modern cloud-native engineers sharpen their skills.

Infrastructure as Code (IaC) means describing the desired state of servers, networks, storage, and other infrastructure using declarative or imperative code, then using tooling to automatically converge the real environment to match that state. OpenTofu is the open-source community fork of HashiCorp Terraform (born after Terraform changed its license to BSL in 2023); it is fully syntax-compatible with Terraform and can be used to declare and manage the creation and destruction of VMs, networks, storage, and other resources. Ansible is an agentless automation configuration tool that executes playbooks over SSH to handle software installation, configuration file distribution, and service management on target machines. The two are typically used together: OpenTofu answers "does this machine exist?", while Ansible answers "what's installed on it and how is it configured?" This combination allows an entire practice environment to be brought up from scratch in minutes — or torn down with a single command — dramatically reducing the cost of repeated experimentation.

What This Setup Teaches Self-Hosters

Setting aside the sheer number of services, what's truly worth learning from this lab is its engineering mindset: a unified virtualization foundation, a GitOps-style deployment pipeline, clear service layering, a robust monitoring and security posture, and an IaC-managed elastic environment for DR drills.

For anyone building their own home lab, a few things are directly actionable: first, use Proxmox to unify the environment and reduce maintenance overhead; second, honestly audit the actual usage rate of every service — as the author does — and clean up technical debt proactively; third, introduce monitoring, backups, and IaC early, and treat the lab as a genuine engineering project rather than a random pile of software.