Over the past year, I've been slowly building out a homelab to learn, self-host the services I rely on, and have more control over my data. It's not the biggest setup, but it's practical, secure for remote access, and has grown organically based on what I actually need.

The Foundation

The heart of it all is a single server running Debian 13 on ARM64 (a Raspberry Pi 5). It sits on my home network and handles everything from DNS to reverse proxying and running most of my containerized workloads.

Networking & DNS

I run Technitium DNS Server natively on the host (not in Docker). It handles DNS for my internal .home.arpa domain, letting me reach services by friendly names like docker.home.arpa, n8n.home.arpa, logs.home.arpa, and ha.home.arpa. All of these resolve to the server's IP, and Caddy takes care of routing based on the hostname.

Remote Access with Tailscale

For access outside my home network, I rely on Tailscale. It runs on the host, providing a secure VPN into my network.

Private Access To Public Apps

I have some containers exposed to the web because it’s just easier than constantly connecting to Tailscale like when I want to push code up to my private git server. To handle this I use Cloudflare Tunnels. With Cloudflare Tunnels I’m able to expose my app to the internet without having to expose any ports.

Reverse Proxy with Caddy

Caddy sits in front of almost everything, handling HTTPS termination with internal TLS certificates. All of my internal services are exposed through .home.arpa subdomains via Caddy's reverse proxy configuration. It keeps routing simple - some services are proxied to other Docker containers by name (like logs or n8n), while others go directly to IPs on the network when they're running outside Docker.

Containerized Workloads

Most of my services run in Docker containers, with a mix of self-hosted apps that cover productivity, automation, security, monitoring, and collaboration.

- Automation & workflows: n8n handles my automations and workflows.

- Version control & collaboration: Gitea for self-hosted Git, along with a Gitea Actions runner and an AI Git bot to help with automation around repositories.

- Authentication & security: Vaultwarden for password management and Pocket ID as an OIDC/OAuth identity provider.

- Monitoring & ops: Dozzle gives me a clean view of container logs, and Dockhand helps manage Docker resources.

- Email & communications: Listmonk for managing mailing lists (with its own Postgres instance).

- Networking: Cloudflare Tunnel (cloudflared) and Tailscale for secure access paths.

- Tailscale integration: A dedicated Tailscale container sidecar setup keeps the mesh connected cleanly.