Home-Lab

1. EXECUTIVE SUMMARY

The Home-Lab project is a self-sustained personal infrastructure node built on a Raspberry Pi 5 (8GB RAM). Over a 50+ month execution cycle, the lab evolved from a naive, port-exposed single-board computer into an enterprise-grade local network. By migrating away from graphical managers like Portainer and Nginx Proxy Manager, the system now implements native Docker Compose orchestration via secure SSH, strict network isolation via custom bridge configurations, and zero-open-port ingress via Tailscale VPN and Traefik.

Today, the node serves as a high-availability personal cloud, hosting critical services such as Immich (photo library), Paperless-ngx (OCR document vault), and Actual Budget (envelope ledger) with end-to-end SSL encryption.

2. EVOLUTION & MILESTONES

The networking and application topologies were refined over three distinct execution phases to optimize performance, eliminate wear-and-tear bottlenecks, and establish a security-first posture.

3. HARDWARE SPECIFICATIONS

4. DOCKER ORCHESTRATION & ISOLATION

To prevent port conflicts and limit exposure, every application stack runs on a dedicated private network. Communication between web-facing containers and the ingress router is routed through a shared bridge network (infra_default).

No backend services (such as databases or cache brokers) expose ports to the host interface.

5. ACTIVE SERVICES PORTFOLIO

• —Immich: AI-powered photo and video backup workspace. Features metadata parsing, geocoding/location maps, and facial clustering models running on local CPU resources.
• —Paperless-ngx: Local document management vault utilizing Tesseract OCR to convert images and scans into searchable PDFs. Supported by Apache Tika for processing docx/xlsx, and Gotenberg for standard office document rendering.
• —Actual Budget: Local-first finance tracking dashboard utilizing envelope-based budgeting. Runs offline as a PWA, syncing changes seamlessly when connected.
• —Booklore: Self-hosted E-Book catalog database and management library. Revived with secure HTTPS wildcard certificate routing to support installation as a mobile PWA.
• —Reactive Resume: Customizable resume editor equipped with Model Context Protocol (MCP) integrations for on-the-fly AI resume optimization.
• —Zerobyte: Server backup daemon that runs automated crons to package compose configurations, persistent volumes, and databases, pushing encrypted archives to S3-compatible endpoints.

6. RETIRED SERVICES LOG

Legacy services were decommissioned to reduce CPU overhead, conserve RAM, and streamline routing:

7. NETWORKING & VPN ROUTING

Security is enforced by blocking all inbound WAN traffic. Tailscale acts as a Virtual LAN gateway, assigning a secure tailnet IP address to the node.

Traefik handles TLS routing using a dual approach:

1. —Tailscale SSL Certs: Retrieves certificates from the Tailscale API for single-device tailnet domains (e.g., Actual Budget).
2. —acme-dns Wildcard Certs: Solves DNS-01 challenges via acme-dns.io to provision a wildcard certificate (*.local.surjyadipsen.in), bypassing domain-wide HSTS policies for self-hosted apps (e.g., Booklore).

Hotspot routing between the WAN (wlan0) and LAN (wlan1) interfaces is managed dynamically via custom NetworkManager dispatcher scripts (/etc/NetworkManager/dispatcher.d/99-hotspot-rules) applying nftables NAT masquerade and forwarding rules.

8. ASSOCIATED FIELD LOGS & POSTS

This project's design, setup, and networking upgrades are documented in detail across a three-part article series:

• —Initial Setup (Part 1): Setting up the Raspberry Pi 5, containerizing early services (Pi-hole, Gitea, Minecraft, NPM), and early custom DNS lessons.
• —Setup Upgrade (Part 2): Migrating from Portainer to Docker Compose, service auditing, and Traefik network isolation.
• —Networking Upgrade (Part 3): Modernizing network topology, zero-open-ports ingress using Tailscale, and dual-interface failover.
• —Subdomain HSTS & Wildcard SSL (Follow-up): Resolving subdomain HSTS conflicts by implementing ACME DNS-01 wildcard certificates using Traefik and acme-dns.io.
• —Wi-Fi Router & Driver Debugging: Troubleshooting out-of-tree RTL8822BU drivers, NetworkManager nftables dispatcher rules, and 5 GHz RF channel congestion on the Raspberry Pi router.