My Home Lab Journey: Start Here
As a platform engineering leader, I spend my weekdays designing cloud architectures and scaling teams. On weekends, I run a homelab — not because I have to, but because it keeps my hands dirty and my instincts sharp. This series documents everything I've built, broken, and automated along the way.
What I Run
My homelab is a single Ubuntu Server host running everything via Docker Compose. Here's the full stack:
- Traefik — Reverse proxy with a self-signed wildcard TLS certificate (
*.homelab) from a local CA - Pi-hole — DNS server and ad blocker, serving as the network's primary DNS
- Plex — Media server for movies and TV
- Tautulli — Plex monitoring and analytics
- Arr Stack — Prowlarr, Radarr, Sonarr, qBittorrent, and Gluetun (WireGuard VPN) for media acquisition
- Immich — Self-hosted photo backup with PostgreSQL
- Home Assistant — Home automation hub
- Homepage — Dashboard with live widgets pulling stats from every service
- Glances — System metrics (CPU, memory, network, disk)
The Backup-First Philosophy
The centerpiece of my homelab isn't any single service — it's the automated backup system. My repo is the source of truth for all configuration. Every day at 03:25 UTC, a cron job:
- Syncs allowlisted config files from
~/intoconfigs/using an inventory file - Redacts every password, API key, and token automatically via regex patterns
- Scans for any unredacted secrets — and blocks the push if anything slips through
- Commits and pushes the sanitized snapshot to GitHub
Every Sunday, a weekly snapshot tag (backup-YYYY-MM-DD) is created for point-in-time recovery. The entire setup can be rebuilt from zero using the repo's fresh-install and restore runbooks.
Why This Matters for My Career
Running this lab forces me to practice what I preach: infrastructure as code, automated pipelines, secret management, disaster recovery, and documentation-first operations. When I advise teams on platform engineering practices at work, I've already battle-tested those patterns at home — on my own weekends, with my own hardware.
What This Series Covers
- Automated Config Backup with Secret Redaction — The daily/weekly backup pipeline that keeps my configs safe and secrets out of Git
- Docker Compose All The Things — Running 10+ services on a single host with Traefik, Pi-hole, and internal TLS
- Disaster Recovery in Under an Hour — Fresh-install and compose-based restore workflows
- Secrets Management for Homelabs — Redaction, scanning, rehydration, and rotation practices
- Single Sign-On with Authentik — Forward-auth, OIDC, MFA, and Cloudflare Tunnel for external access