Personal Homelab
Shared self-hosted infrastructure plus personal applications — all containerized, reverse-proxied, and reachable from anywhere via Cloudflare Tunnel.
Architecture
Traffic enters through Cloudflare, is terminated by Nginx Proxy Manager, and is routed to services running on the application server.
Secure inbound path. No open ports on the home network. TLS handled at the edge.
Reverse proxy and SSL termination for internal services. Central entry point for all apps.
Hosts all services. Every application is containerized and managed with Docker Compose.
Applications
This homelab is not only infrastructure. It runs shared platform services and personal applications — each as its own Docker Compose stack on the application server.
Platform services
Shared components that keep the lab reachable and operable.
- Cloudflare Tunnel
- Nginx Proxy Manager
- Monitoring & observability
- Internal networking & DNS
Personal applications
Private apps for day-to-day use, isolated per Compose project and exposed only through the proxy.
- Productivity & notes
- Media & file services
- Automation & helpers
- Experimental / side projects
Design principles
How this homelab is built and operated.
Everything is Dockerized
All applications — infrastructure and personal — run in containers and are defined with Docker Compose.
Zero open ports
External access is only through Cloudflare Tunnel. The home network has no inbound ports exposed to the internet.
Central reverse proxy
Nginx Proxy Manager on 10.0.0.17 routes traffic and manages certificates for every service.
Compose-first
Each application lives in its own Compose stack. Updates, restarts, and rollbacks stay simple and consistent.
Single public domain
Services are reached under *.homelabmz.uk with automatic HTTPS via Cloudflare and NPM.
Home network isolation
Application workloads run on 10.0.0.16. Proxy duties stay on a dedicated host.
Tech stack
Core building blocks of this environment.
Contributors
People who build and maintain this homelab.