Homelab

This repository contains the configuration and documentation for a Debian 13 home server, its supporting network services, and a separate Proxmox test host.

At a glance

Most of the homelab runs on one Debian 13 server:

• Plex and Kavita provide films, series, anime, ebooks, manga, and comics.
• Seerr and the media managers turn a request into an organised library.
• Actual Budget runs as a separate personal service.
• Authelia and lldap give the supporting apps one single sign-on login, with a phone authenticator code, instead of a separate account per app.
• Grafana and Prometheus show what is healthy and raise an alert when something needs attention.
• Ansible, Docker Compose, and systemd keep the host, applications, and scheduled maintenance reproducible.

Two other machines have separate roles. An OPNsense box manages routing, firewall rules, local DNS, and network filtering. A Proxmox host provides disposable virtual machines for rehearsing larger changes away from the live server.

Internet
   |
OPNsense router
   |
Home network
├── Debian server
│   ├── Media and personal services
│   ├── Storage and backups
│   └── Monitoring and maintenance
└── Proxmox host
    └── Test virtual machines

The architecture page shows the same picture in more detail.

From a request to the screen

A media request moves through the stack as follows:

1. Someone asks for a film or series through Seerr.
2. Radarr or Sonarr chooses a suitable release, with Prowlarr searching the available sources.
3. SABnzbd handles usenet downloads. qBittorrent handles torrents through a VPN.
4. The finished file moves into the shared media library. Hardlinks allow a torrent to keep seeding without storing a second copy of the same file.
5. Plex makes the result available to viewers. If a device cannot play it directly, an Intel Arc GPU handles the conversion.

Other services manage metadata, viewing activity, invitations, anime links, and release preferences. Clonarr keeps release profiles aligned across the media managers.

Storage and backups

Five independent data drives hold the media library. mergerfs presents them as one large pool, while each disk remains a normal XFS filesystem that can still be read on its own.

A separate SnapRAID parity drive provides recovery from a single data-drive failure. Because it is not used for everyday reads, it can sleep when it is not needed. A fast NVMe drive holds application databases, settings, and unfinished usenet downloads, keeping frequent small writes away from the media disks.

Protection depends on the type of data:

• Media is protected by SnapRAID parity.
• Application data is protected by btrfs snapshots and restic backups.
• Backup copies are kept both locally and offsite.
• Docker waits for the expected storage mounts instead of starting against empty directories after a failed mount.

The storage notes explain the trade-offs and disk layout.

Operations

Systemd timers run parity updates, filesystem checks, snapshots, backups, health collectors, and service watchdogs. Prometheus collects the results, Grafana displays them, and Alertmanager reports failures.

Monitoring checks are configured not to wake the parity disk while checking its state.

Docker Compose defines the applications, Ansible converges the Debian host and deploys the Compose projects, and GitHub Actions checks proposed changes. Larger changes can be rehearsed on Proxmox. Credentials stay outside version control.

The production server now uses Ansible. The next-day backup, maintenance, monitoring, and image-refresh checks passed, and the final gate (an unattended parity spindown) was observed on 2026-07-14. Ansible is the only deployment path; the retired install.sh lives in Git history.

Explore the project

The documentation site includes the system overview and operator references:

• Architecture for the main flows and boundaries.
• Storage layout for the data and backup design.
• Migration from Unraid for the story behind the current system.
• Security boundaries for public/private configuration, authentication, and remote-access policy.
• Documentation index when looking for a specific runbook or reference.

The repository itself is organised around the same boundaries: the main media stack at the root; separate actual/, monitoring/, and identity/ Compose projects; host convergence under ansible/; source configuration for Docker, systemd, SSH, and hardening under host/; and reusable maintenance commands under scripts/.