Proxmox home lab
A home server running self-hosted services, with client-side encrypted three-tier backups and remote access without a single open port.
The problem
Family photos, passwords, films and home automation scattered across different cloud services and a NAS that no longer gets security updates. The goal: bring everything home, onto a single small and quiet server, reachable from every phone in the family, without opening a single port to the internet and with backups that can really be trusted.
The choices
A 35 W office mini PC running Proxmox VE. Low power, it fits in a 3D-printed 10” rack, and its integrated GPU is enough for video transcoding and photo recognition.
Containers for infrastructure, VMs only where needed. LXC containers only use the RAM they actually consume and share the integrated GPU; there is a VM only where it is mandatory (Home Assistant). Measured result: eight containers and one VM use about 5.4 GB of RAM out of 24.
A shared GPU, not a dedicated one. PCI passthrough would hand the GPU to a single service: shared across containers, both the video and the photo libraries use it.
No ZFS. Two disks of different sizes don’t make a mirror: the ZFS cache would cost RAM without adding redundancy. LVM-thin still provides snapshots.
Remote access without open ports. The home connection sits behind CGNAT and no port is exposed: the only way in from outside is Tailscale, which publishes the individual addresses needed rather than the whole network. The NAS and smart devices stay unreachable from outside.
Valid HTTPS on every device. A Caddy reverse proxy with a wildcard Let’s Encrypt certificate obtained via DNS-01: no certificate authority to install on phones, no service published on the internet.
Three-tier backups, encrypted on the client. Proxmox Backup Server with deduplication; a nightly copy to the NAS, which receives data already encrypted; a monthly offline copy on a disconnected drive, the only defence against ransomware that also encrypts network shares. The key lives in the password manager and on paper.
Alerts only when needed. A single Telegram bot for host, backups, disks and services. Successes are not reported: if a message arrives, something needs a look.
Careful updates. Only Debian security updates are automatic; applications are updated by hand, after a notice and a snapshot.
The method
Everything lives in a git repository: configuration, restore procedures and a decision log with the reasoning behind each choice and the alternatives that were discarded. There is also a non-technical guide for the family. Every night a script with read-only credentials updates the server inventory in Notion.
What I learned
How to run a multi-layer infrastructure and bring different needs together (photos, passwords, films, home automation, backups, remote access) into a single solution that is simple and fast for the whole family to use.