{"id":25934649,"url":"https://github.com/savely-krasovsky/homelab","last_synced_at":"2026-06-30T09:31:46.123Z","repository":{"id":280374291,"uuid":"933344868","full_name":"savely-krasovsky/homelab","owner":"savely-krasovsky","description":"Personal Homelab","archived":false,"fork":false,"pushed_at":"2026-06-25T22:25:17.000Z","size":335,"stargazers_count":101,"open_issues_count":0,"forks_count":3,"subscribers_count":3,"default_branch":"master","last_synced_at":"2026-06-26T00:11:44.048Z","etag":null,"topics":["fedora-coreos","flatcar","homelab","opentofu","podman","proxmox","quadlets","terraform"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/savely-krasovsky.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-02-15T18:24:04.000Z","updated_at":"2026-06-25T22:25:21.000Z","dependencies_parsed_at":"2025-03-18T01:25:04.253Z","dependency_job_id":"b5ff1fec-8dc0-4a20-919a-1b971aa16b03","html_url":"https://github.com/savely-krasovsky/homelab","commit_stats":null,"previous_names":["savely-krasovsky/homelab"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/savely-krasovsky/homelab","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/savely-krasovsky%2Fhomelab","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/savely-krasovsky%2Fhomelab/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/savely-krasovsky%2Fhomelab/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/savely-krasovsky%2Fhomelab/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/savely-krasovsky","download_url":"https://codeload.github.com/savely-krasovsky/homelab/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/savely-krasovsky%2Fhomelab/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34961543,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-30T02:00:05.919Z","response_time":92,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["fedora-coreos","flatcar","homelab","opentofu","podman","proxmox","quadlets","terraform"],"created_at":"2025-03-04T00:58:41.666Z","updated_at":"2026-06-30T09:31:46.117Z","avatar_url":"https://github.com/savely-krasovsky.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Experimental Homelab\n\n- Uses immutable, atomic Fedora CoreOS provisioned on a Proxmox VE node as a base.\n- Uses rootless Podman instead of rootful Docker.\n- Uses Quadlet systemd-like containers instead of Docker Compose.\n- VM can be fully removed and re-provisioned in a few minutes, including container autostart.\n- Provisioning is done with OpenTofu/Terraform.\n- Configs are rendered from templates and synced automatically after changes.\n- Secrets are provided using Bitwarden Secrets Manager.\n- Bitwarden token is injected into VM credentials and then mapped to Podman/system credentials during bootstrap.\n- Source IP is preserved using\n [systemd socket activation](https://github.com/eriksjolund/podman-networking-docs?tab=readme-ov-file#socket-activation-systemd-user-service)\n with Traefik.\n- Native network performance due to the reason above.\n- Podman and application data are stored on a dedicated iSCSI-backed LVM disk.\n- Media, personal files, and observability data are stored on NFS shares.\n- Daily restic backups are done from LVM snapshots to Backblaze B2 and Storj.\n- Uses per-stack Podman networks plus a shared reverse-proxy network.\n- Container-to-container traffic stays on-host inside Podman networks,\n while shared domain names are still used via Traefik `NetworkAlias`.\n- Uses nftables default-deny firewall policy.\n- SELinux support (including explicit context fixes where needed).\n\nI also have some observability:\n\n- Storage: VictoriaMetrics, VictoriaLogs, and VictoriaTraces.\n- Collection and routing: Grafana Alloy (Prometheus/Loki/OTLP) and Telegraf for MQTT -\u003e OTLP.\n- Visualization: Grafana.\n- Traefik itself exports logs/metrics/traces via OTLP to Alloy.\n\n## Current services\n\n| Name | Description | Pod |\n|-----------------------------------------------------------------|---------------------------------------------------|-----|\n| Actual Budget (`actual-budget`) | Budgeting App | |\n| Anubis (`anubis`) | Anti-bot ForwardAuth gateway | |\n| Bluesky PDS (`bluesky-pds`) | ATProto Personal Data Server | |\n| CrowdSec (`crowdsec-security-engine`) | Advanced Fail2ban | ☑️ |\n| CrowdSec Web UI (`crowdsec-web-ui`) | CrowdSec web interface | ☑️ |\n| DavMail (`davmail`) | Exchange Gateway | |\n| Element Admin (`element-admin`) | Element Admin Panel | |\n| Element Call (`element-call`) | Element Call Client | |\n| Element Web (`element-web`) | Matrix Web Client | |\n| Forward Info Bot (`forward-info-bot`) | Telegram utility bot | |\n| Glance (`glance`) | Homelab Dashboard | |\n| Grafana Alloy (`grafana-alloy`) | OpenTelemetry Collector | |\n| Grafana (`grafana`) | Data-visualization Platform | |\n| Immich ML (`immich-machine-learning`) | Immich machine-learning worker | ☑️ |\n| Immich (`immich-server`) | Image \u0026 Video Management | ☑️ |\n| Karakeep Chrome (`karakeep-chrome`) | Browser worker for archiving | ☑️ |\n| Karakeep Meilisearch (`karakeep-meilisearch`) | Search index | ☑️ |\n| Karakeep (`karakeep-server`) | Bookmark App | ☑️ |\n| Masked Email Bot (`masked-email-bot`) | Telegram utility bot | |\n| MatrixRTC JWT (`matrix-rtc-jwt`) | LiveKit JWT service | ☑️ |\n| MatrixRTC SFU (`matrix-rtc-sfu`) | Matrix Realtime Stack | ☑️ |\n| Matrix Authentication Service (`matrix-authentication-service`) | Matrix auth service | ☑️ |\n| Matrix Synapse (`matrix-synapse`) | Matrix Homeserver | ☑️ |\n| Miniflux (`miniflux-server`) | RSS Reader | ☑️ |\n| OAuth2 Proxy (`oauth2-proxy-server`) | Identity-Aware Proxy | ☑️ |\n| Open WebUI (`open-webui`) | Chatbot UI | ☑️ |\n| OpenCloud (`opencloud-server`) | File Management and Collaboration Platform | ☑️ |\n| OpenCloud Collabora (`opencloud-collabora`) | Office editing backend | ☑️ |\n| OpenCloud Collaboration (`opencloud-collaboration`) | Realtime collaboration service | ☑️ |\n| Opengist (`opengist`) | Self-hosted Pastebin powered by Git | |\n| Outline (`outline-server`) | Personal Knowledge Base | ☑️ |\n| Plex (`plex`) | Personal Media Server | |\n| Pocket ID (`pocket-id`) | Single Sign-on Portal | |\n| Podman Exporter (`prometheus-podman-exporter`) | Podman Prometheus Metrics Exporter | |\n| qBittorrent (`qbittorrent`) | BitTorrent Client | |\n| Remnawave Panel (`remnawave-panel`) | Censorship Circumvention Management Platform | ☑️ |\n| Remnawave Subscription Page (`remnawave-subscription-page`) | Public subscription page | ☑️ |\n| Remnawave Node VLESS XHTTP (`remnawave-node-vless-xhttp`) | Proxy access node | |\n| Remnawave Node VLESS REALITY (`remnawave-node-vless-reality`) | Proxy access node | |\n| RMQTT (`rmqtt`) | MQTT Broker Server | |\n| Static Web Server (`static-web-server`) | Static files host | |\n| Step CA (`step-ca`) | Smallstep-based Homelab CA infrastructure | |\n| Tangled Knot (`tangled`) | Git Platform based on ATProto | |\n| Telegraf (`telegraf`) | MQTT to OpenTelemetry conversion | |\n| Traefik (`traefik`) | Application Proxy | |\n| VictoriaLogs (`victoria-logs`) | Logs Storage | ☑️ |\n| VictoriaMetrics (`victoria-metrics`) | Metrics Storage | ☑️ |\n| VictoriaTraces (`victoria-traces`) | Tracing Storage | ☑️ |\n| vmauth (`victoria-vmauth`) | Authorization module for VictoriaMetrics products | ☑️ |\n| Gatus | Uptime Monitoring[^2] | |\n\n## Caveats\n\nThis is not a ready-to-use configuration that you can just apply.\nIt requires initialized state and personal values (DNS, Proxmox, TrueNAS, Bitwarden secret IDs, Pocket ID clients,\netc.).\nYou can adapt it, but copying it as-is is not realistic.\nI see this repository more as a template for your own setup.\n\n## Future plans\n\n- [x] Move Traefik, Grafana Alloy and other configs to the repository.\n- [ ] Consider switching to Flatcar Linux. I still like it more, but missing pieces were a blocker.\n- [x] Monitor uptime and setup alerts with an external monitor[^1].\n- [ ] Harden network setup; some parts are still permissive.\n- [ ] Integrate `hashicorp/assert` support.\n\n[^1]: It lives outside this repository.\n[^2]: It lives outside this homelab host.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsavely-krasovsky%2Fhomelab","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsavely-krasovsky%2Fhomelab","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsavely-krasovsky%2Fhomelab/lists"}