what's running at home

Homelab

A snapshot of what's currently running at home. Media server, book pipeline, monitoring, home automation, and a handful of self-built tools, all running on a small self-hosted server behind a reverse proxy and tunnel, with no ports opened to the internet.

how it connects

Network Topology

Network topology diagram: Internet to a fiber ISP connection to a Wi-Fi 7 router. The router feeds a multi-gigabit switch, a directly connected Gaming PC, and two isolated wireless networks, Wi-Fi Main for trusted devices and Wi-Fi IoT. The switch connects to the Media Server running Unraid, which has a multi-bay USB drive enclosure attached. A Cloudflare Tunnel runs outbound only from the Media Server, so no ports are forwarded on the router and all external access goes through the tunnel.

scroll the diagram sideways to read it →

the machines

Hardware

🖥️  Gaming PC

Primary workstation for development and gaming

📦  Media Server

A mini PC running Unraid, hosting the docker stack below

💾  Drive Enclosure

A multi-bay USB enclosure with drives of varying sizes, connected to the media server

🌐  Network

Wi-Fi 7 router and a multi-gigabit switch connecting everything

why it's built this way

Key Decisions

Everything routes through a Cloudflare Tunnel rather than forwarded ports, so there are no inbound holes in the firewall, and it works the same whether at home or traveling. Storage runs on Unraid with parity protection, so any single drive can fail without losing data. Media, photos, and files are self-hosted (Immich, Nextcloud, Plex/Jellyfin) instead of paying for cloud storage subscriptions. Network-wide DNS filtering through AdGuard Home blocks ads and trackers for every device on the network, not just the ones with an extension installed.

acquisition to library

Media Stack Flow

Media stack flow diagram: two acquisition lanes, video from a private tracker and books from a self-built book search interface, both routing through an off-site seedbox that downloads and seeds for ratio. A scheduled rclone sync pulls content into the parity-protected Unraid storage array, which then fans out to Plex and Jellyfin, self-built AI-scheduled virtual live TV channels, and the ebook and audiobook library with auto-import on arrival. Nothing torrents directly on the home network.

scroll the diagram sideways to read it →

the docker stack

Services

ServicePurpose
Media
Plex / JellyfinMedia server (running in parallel)
TautulliPlayback monitoring for Plex
Tunarr + SmarTunarrSelf-built virtual live TV channels, AI-generated scheduling
Music
NavidromeSelf-hosted music streaming
YTPlayerSelf-built music player, custom auth
Books
Calibre-Web AutomatedEbook library with auto-import pipeline
AudiobookshelfAudiobook server
ShelfmarkBook search and acquisition
Genealogy
WebtreesSelf-hosted family tree
Photos & Files
ImmichPhoto/video library, mobile backup
NextcloudFile storage and sync
Finance
LedgerViewSelf-built personal finance dashboard
Utilities
RoundupSelf-built shared list PWA
IT-Tools / OmniToolsDeveloper and general utility toolkits
Home
Home AssistantSmart home automation platform
Games
RomMRetro game library manager
Infra
AdGuard HomeNetwork-wide DNS filtering
CaddyReverse proxy, internal HTTPS
Cloudflare TunnelExternal access, no open ports
Uptime Kuma / Glance / Beszel / DozzleMonitoring, dashboards, logs
AI Tooling
MCP serversAI-assisted access to vault and homelab tools, OAuth 2.0 + PKCE