Homelab
Single-node self-hosted lab on a Linux machine (Ryzen 5800X, RTX 3090, 32 GB)
running ~25 services. Everything containerized is orchestrated with
rootless Podman Quadlets (systemd-managed); a handful of GPU/audio
services run as systemd user units. TLS terminates at an nginx reverse
proxy with a Let’s Encrypt wildcard; identity is centralizing on Kanidm
(OIDC). Monitoring: VictoriaMetrics + VictoriaLogs + vmagent + Grafana,
probed by Gatus and Uptime Kuma.
The homelab repo itself is private (network details, vhosts, admin
accounts); this note is the public index of the OSS it runs.
What runs there
| Layer | Services |
|---|---|
| Monitoring | victoria-metrics (OSS), victoria-logs (OSS), vmagent (OSS), grafana (OSS), gatus (OSS), uptime-kuma (OSS), autokuma (OSS), node-exporter (OSS), nvidia-gpu-exporter (OSS) |
| AI/LLM | llama-swap (OSS), litellm (OSS) |
| Identity & secrets | kanidm (OSS), vault (OSS) |
| Code | forgejo (OSS) |
| Media & books | immich (OSS), audiobookshelf (OSS), calibre-web-automated (OSS) |
| Documents & bookmarks | paperless-ngx (OSS), karakeep (OSS) |
| Kitchen | mealie (OSS), tandoor (OSS) (trial pair) |
Why these choices
- Quadlets over compose — systemd manages restarts/health natively;
no daemon to babysit,journalctlper service. - Rootless Podman — containers never run as host root; the biggest
single hardening win for a single-admin box. - VictoriaMetrics over Prometheus — single binary, better compression,
drop-in Prometheus compatibility (vmagent scrapes, Grafana queries). - Kanidm over Authelia/Keycloak — passkey-first, Rust, distroless
container, no Java. OAuth2/OIDC per-service rollout in progress. - llama-swap + LiteLLM — local GGUF inference with hot model swap,
fronted by one OpenAI-compatible gateway routing local↔cloud.
Related: Digital gardens is published by the same machine (Quartz on
the garden-site project). Full private docs live in the homelab repo.