Own project · 2026
Homelab infrastructure
Three Proxmox nodes, containers and services behind a reverse proxy, internal name resolution, backup and monitoring: the environment where I practice what later runs at clients.
Build and operation
Built with
Proxmox VE · LXC · Docker · Reverse proxy · Uptime monitoring
The problem
Anyone running systems for other people needs a place to practice where a mistake costs nothing but their own evening. Distributed services bring the same questions with them as they do at a client: how does a service get a name, who renews the certificates, what happens in a power cut, and how would I even notice that something has stopped?
The solution
Three Proxmox nodes carry containers and virtual machines, separated by job rather than by chance. Access runs through a reverse proxy, the only service visible from outside, which renews the certificates centrally. Names are resolved internally, so services are reachable under readable addresses without appearing in public DNS. Backups run on a schedule to separate storage, and monitoring happens from outside. An outage reports itself instead of being discovered.
The result
- Services run under readable internal names instead of IP addresses and port numbers.
- Certificates renew centrally, with no intervention per service.
- Backups run on a schedule to separate storage and get restored, not just created.
- Outages report themselves through external monitoring instead of turning up on the next visit.
Why an environment of my own
Maintenance means keeping systems running, not just setting them up. You learn that where things are allowed to break. Every step an order calls for, meaning reverse proxy, certificates, backup and monitoring, has gone wrong here at least once first and become explainable afterwards.
How it is built
Separated by job: one node for media and steady load, one for development and short-lived containers, one for virtual machines. The only thing visible from outside is the reverse proxy. Inside, name resolution makes sure services are reachable under readable addresses without those names being resolvable publicly.
What I take from it
A backup that has never been restored is not a backup. Monitoring that runs on the same node as the service it watches goes quiet exactly when it would matter. Both are sentences you only believe once they have hit you, and both are therefore in every maintenance offer I write.