Everything above (the game servers, the wiki, the whole self-hosted stack) runs out of one home rack. Here's the current shape of it.
The main hypervisor. AMD Threadripper 1950X, 128GB RAM, running dozens of LXC containers and VMs — everything from the media stack to game servers to monitoring lives here. An RTX 4090 is passed through to a dedicated GPU VM via PCI passthrough for local AI/image-generation workloads.
A Ryzen 9 7950X / RX 7900 XT desktop that pulls double duty as the daily driver, gaming rig, and the machine used to actually administer the whole homelab.
A dedicated VM with the passthrough RTX 4090, running Ollama with local models (Qwen) for low-stakes drafting and lookup tasks, plus ComfyUI for local image generation. Deliberately scoped narrow — a local model handles quick sub-tasks, not real infrastructure judgment calls.
Two Synology units: a general-purpose 11/12-bay array (RAID5) handling the media library and Docker container configs, and a second dedicated unit (RAID6) that exists purely as backup storage.
A dedicated PBS instance backs up every VM and container nightly, with a daily/weekly/monthly retention schedule, storing to the dedicated backup NAS over NFS. See the how-to guide for the full setup.
Local btrfs snapshots on every system update, plus nightly incremental backups shipped off-box to the NAS fleet — so a bad update or a failed drive doesn't mean starting over.
Checkmk monitors the whole fleet — hosts, VMs, containers, NAS health, and per-VM backup freshness — feeding a unified Grafana dashboard for at-a-glance fleet health.
NetBox is the source of truth for every device and VM, kept in sync automatically from both the UniFi network controller and the Proxmox hypervisor, then pushed into Checkmk for monitoring — no manually re-entering hosts. See the write-up on how it's wired together (and the real bugs it took a while to catch).
A recurring scanning pipeline — network/host scanning, container image CVE scanning, and web app baseline scanning — keeps tabs on the fleet automatically. Full breakdown in the wiki guide.
A private CA issues real, browser-trusted HTTPS certificates for every internal admin tool, so nothing on the LAN shows a scary self-signed warning. See how it's built.
Every host in the fleet — containers, VMs, and both NAS units — has been hardened against weak SSH MAC algorithms, the one real finding from a full-subnet vulnerability scan. Details in the guide.
Separate VLANs for management, media, family, and IoT devices, with the media VLAN locked down so it can't reach anything else on the network. See how VLANs actually get isolated (it's not automatic just because they're separate networks).
The family network routes through a WireGuard VPN for privacy, tuned and tested specifically to stay fast enough for gaming. Full write-up, including a real test suite that goes past ping, in the wiki guide.
Slowly replacing cloud and vendor-app dependencies with things that live on the homelab instead.
Radarr, Sonarr, Lidarr, Prowlarr, and qBittorrent, containerized and wired together into a fully automated media pipeline.
Vaultwarden (a Bitwarden-compatible server) runs in its own isolated VM, fully covered by the backup pipeline. See how it was migrated off a general-purpose Docker host.
Immich (photos/video) and Radicale (CalDAV/CardDAV) replace the NAS vendor's built-in apps — better photo search, and everything backed up properly. Full migration write-up here.
Caddy, running on its own host, fronts every public-facing domain — replacing the NAS's built-in reverse proxy. See the migration guide, including a near-miss that briefly took down every public site.
Everything on the gaming page — Minecraft, Palworld, Enshrouded, Dune Awakening, and TeamSpeak — runs as its own container or VM, tunneled to the public internet.