/uses · Hardware, Homelab & Software Inventoryuses.tech

What I Use (/uses)

A practical look at the single-box Proxmox server, split-horizon network, and self-hosted services behind HOME-LAB.net.

Welcome to the /uses page for HOME-LAB.net—a plain-English rundown of the hardware, network setup, and software stack behind my homelab, listed in the spirit of uses.tech.

Like a lot of homelabs, this setup originally sprawled into a three-node Threadripper cluster with enterprise MikroTik 10G/40G switches—until I did the math on what ~370W of continuous idle draw was doing to our home solar and battery system overnight. Today, everything is being consolidated onto a single standalone Proxmox VE host (with native ZFS storage right on the box) and a UniFi network core, sipping an estimated 105W combined when running private search, photo backups, GitLab, and self-hosted email with zero open ports on the home router.

Ed Stuurman

Infrastructure & Reliability

Jump to category

Proxmox Host(4)Network & Edge(6)Hosted Services(6)Workstation(4)

At a Glance

Server Host: Proxmox VE 8 · Native OpenZFS
CPU, Board & RAM: Threadripper 2920X · ASRock X399M · 64GB ECC
Network Core: UniFi Core · Unbound DNS · Caddy
Cloud Bridge: AWS Lightsail WireGuard · SES & S3 Relay
Public Edge: AWS CloudFront · S3 Multi-Region (MRAP)

Listed in the spirit of uses.tech/uses/

A living inventory of the server hardware, network setup, and self-hosted tools running behind HOME-LAB.net—updated as hardware is consolidated or new services come online.

01 · The Server Host

Single-Box Proxmox VE & Native ZFS

Everything inside the homelab runs on a single standalone tower server. Proxmox VE manages both the virtualized workloads and the underlying ZFS storage pools directly on the host—no separate NAS box required.

Proxmox VE 8 · Native OpenZFS

Hypervisor & Storage

Proxmox VE 8.x · Host-Managed ZFS Pools · LXC & KVM

Runs all internal services as lightweight unprivileged LXC containers or VMs. ZFS is built right into the Proxmox host: fast NVMe mirrors handle databases and container disks, while bulk drives connected through an LSI SAS HBA store media and backups.

Inspect project

Threadripper 2920X · ASRock X399M · 64GB ECC

CPU, Board & RAM

12 Cores / 24 Threads · Quad-Channel DDR4 ECC · Noctua NH-U9

A compact Micro-ATX TR4 board populated with 64GB of quad-channel ECC memory and plenty of PCIe lanes for NVMe storage and an LSI HBA, cooled quietly by a Noctua tower cooler in a desktop chassis.

Solar & Battery-Friendly Power Budget (~105W Estimated)

Power Efficiency

~85W Proxmox Host + ~20W UniFi Core · ~2.5 kWh / day

Being consolidated down from a 3-node Threadripper cluster and three MikroTik rack switches (~370W idle) that used to drain our home solar battery before midnight. At an estimated ~105W total, the stack uses under 1.5 kWh overnight.

Inspect project

APC Smart-UPS (750W)

Power Protection

750W Pure Sine-Wave · Line-Interactive UPS

A 750W APC Smart-UPS keeps the Proxmox host and network core riding smoothly through brief power blips and triggers a clean shutdown.

02 · Network, DNS & Cloud Bridge

Split-Horizon Routing Without Port Forwarding

The network is built around one simple rule: zero inbound ports open on the home router. Public visitors hit AWS edge caches, while local and WireGuard devices—depending on their VLAN—route directly to the Proxmox host.

UniFi Network Core

Gateway & Switching

Unified Routing & VLANs · ~20W Idle · Retired MikroTik Rack

Replaced a noisy stack of MikroTik 10G SFP+ and PoE+ switches (CRS326 & CRS328) with a unified UniFi network core that handles inter-VLAN firewall rules, network segmentation, and local switching under one clean interface.

Unbound Local DNS (On Proxmox)

Split-Horizon DNS

Recursive DNSSEC Resolver · Local *.home-lab.net Overrides

Runs in a lightweight container on the Proxmox host. Resolves outbound queries directly against root nameservers and answers *.home-lab.net queries with the local Caddy proxy IP for trusted VLANs and WireGuard clients.

Inspect project

Caddy Reverse Proxy (DNS-01 Wildcard TLS)

Local HTTPS

Let's Encrypt Wildcard (*.home-lab.net) · Route 53 DNS-01

Terminates HTTPS for every internal service on the Proxmox host. By validating certificates over the Route 53 API instead of HTTP, everything gets valid TLS without ever opening ports 80 or 443.

Inspect project

AWS Lightsail WireGuard Relay (ap-northeast-1)

VPN & Zero-Port Ingress

Stateless WireGuard Hub · Outbound Homelab Tunnel · On-Demand Roaming

A lightweight stateless WireGuard relay in Tokyo. The Proxmox host maintains an outbound tunnel to Lightsail, allowing phones and laptops to roam onto the home network via WireGuard On-Demand—without publishing the home IP or opening a single port on the home router.

AWS SES, Lambda & S3 Store-and-Forward

Serverless Ingestion

SES Inbound Mail → S3 · Future Lambda Umami Ingestion → S3

Managed AWS services that buffer external traffic in encrypted S3 buckets until the homelab pulls it over outbound HTTPS—handling inbound @home-lab.net emails via Amazon SES today, and public Umami analytics events via Lambda in the future.

AWS CloudFront & S3 Multi-Region Access Point

Public Showcase

4 AWS Regions · SigV4a Origin Access Control · CloudFront Functions

Serves this public static version of HOME-LAB.net from S3 buckets in the US, Europe, Tokyo, and Sydney—completely isolated from the home network.

03 · Hosted on Proxmox

Self-Hosted Services & Local AI

Every service below runs inside containers or VMs on the Proxmox VE host, backed by local ZFS datasets and fronted by Caddy and Authelia.

Internal Astro Cockpit & SearXNG (home-lab.net)

Start Page & Search

Dynamic Node SSR (:4331) · Embedded SearXNG (search.home-lab.net)

The private version of this site serves as my default browser start page on LAN—combining a private SearXNG search bar (with !g, !gh, and !aw bangs), service launchers, and host status.

Nous Hermes 3 Local AI (ai.home-lab.net)

Future Project · Local AI

Planned M5 Ultra Mac Studio (To Be Spec'd)

A future project involving an upcoming M5 Ultra Mac Studio (still to be spec'd out) for running local inference, log triage, and shell command assistance without sending internal data to third-party cloud APIs.

Stalwart Mail Server & Roundcube (mail.home-lab.net)

Email & Webmail

Single-Binary Rust MTA · S3 HTTPS Pull · SES Outbound Relay

Self-hosted email without the port-25 headache. Stalwart pulls encrypted inbound messages from our AWS S3 relay bucket over outbound HTTPS, stores mailboxes on local ZFS, serves Roundcube webmail, and sends outbound mail through Amazon SES.

Inspect project

Immich Photo Library (photos.home-lab.net)

Photos & Video

Direct ZFS Dataset Mount · Mobile WireGuard Background Sync

Our self-hosted Google Photos replacement. Phones back up raw photos and videos automatically over WireGuard straight onto a dedicated ZFS dataset on the Proxmox host.

Inspect project

GitLab CE & GitLab Runner (gitlab.home-lab.net)

Code & CI/CD

Repositories · Container Registry (registry.home-lab.net) · CI Runner

Keeps infrastructure code, Terraform configs, and container images in-house, and runs the pipelines that build both the public S3 static site and the internal LAN cockpit.

Authelia SSO & Decoupled Umami Analytics

Auth & Telemetry

WebAuthn Passkeys (auth.home-lab.net) · S3-to-Local Umami Pull

Authelia protects internal apps behind a single passkey login. For public site analytics, a CloudFront/Lambda endpoint writes events to S3 and a 5-minute systemd timer inside an LXC container pulls them into a local Umami instance.

Inspect project

04 · Workstation & Workflow

Daily Driver & Tooling

The laptop, web stack, and command-line tools I use day-to-day to build and look after the lab.

MacBook Pro (Apple Silicon)

Workstation

macOS · WireGuard On-Demand · Seamless Split-DNS

Main daily computer. Uses an iOS/macOS WireGuard On-Demand profile that stays off on home Wi-Fi and quietly connects through the Tokyo relay whenever I'm working away from home.

Astro 7 + Tailwind CSS v4 (Dual-Target Codebase)

Web Engine

output: static (Public S3) + @astrojs/node SSR (Internal LAN)

A single codebase that compiles into two different sites depending on the build target: a fast static showcase for the public web, and a live SSR dashboard for the home network.

Inspect project

Terraform & Systemd Timers

Automation

Declarative AWS Edge · LXC Pull Workers

Terraform manages the AWS side (CloudFront, S3 MRAP, Route 53, SES, IAM), while simple systemd timers and Node/Rust workers inside LXC containers pull queued mail and analytics from S3.

Terminal & Editor Stack

CLI & Editor

zsh · tmux · VS Code / Neovim · btop · lazygit

Clean, keyboard-driven setup with hardware-backed SSH keys for jumping into the Proxmox host and containers.

Architecture & Stack FAQ

Frequently Asked Questions

Quick answers on how the split-horizon setup, power budget, and store-and-forward relays work in practice.

Split-Horizon & Zero Open Ports

How the public website and private homelab share the same domain safely.

Are any ports forwarded on the home router?

None at all. Public visitors hit AWS CloudFront and S3. When I'm on a trusted VLAN at home or connected over WireGuard, local Unbound DNS resolves *.home-lab.net straight to the Proxmox host's local Caddy proxy. Every connection between the homelab and AWS (for WireGuard, mail, and analytics) is initiated outbound from inside the LAN.

How do internal services get valid HTTPS certificates without port 80/443 open?

Caddy uses the Let's Encrypt DNS-01 challenge via the Route 53 API to issue and renew wildcard certificates for *.home-lab.net and home-lab.net. Because verification happens over DNS, no inbound HTTP check is ever needed.

What happens to incoming @home-lab.net email or analytics if the server is rebooting?

Nothing gets lost or bounced. Inbound mail hits Amazon SES in Tokyo and lands as encrypted raw .eml files in an S3 bucket (with a 7-day auto-expiry safety net). Public analytics events follow the same pattern via Lambda and S3. As soon as the Proxmox host is back up, Stalwart and the local Umami sync timer pull the queued items over outbound HTTPS.

Hardware & Consolidation

Why everything runs on one Proxmox box instead of a multi-node rack cluster.

Why a single Proxmox server instead of a 3-node high-availability cluster?

Power and simplicity. I previously had three Threadripper 2920X nodes and three MikroTik switches that pulled roughly 370W continuously at idle—which was enough to drain our home solar battery before midnight every single night. Consolidating onto one Proxmox host (~85W) and a UniFi network core (~20W) cuts idle draw by over 70% while keeping every container and native ZFS dataset on one easy-to-maintain machine.

Is ZFS running on a separate NAS box?

No—ZFS is managed natively by Proxmox VE right on the server host. Containers and VMs mount datasets directly from the host's NVMe mirrors and bulk storage pools without the extra power draw or network overhead of a separate storage appliance.