Services
About 40 services across application, infrastructure, and utility layers. Listed by category.
Reverse proxy & edge
Section titled “Reverse proxy & edge”Reverse proxy and TLS terminator for every externally-reachable service. Single wildcard certificate via DNS-01 renewal. Coupled with CrowdSec for request filtering.
Why: Centralized routing and certificate management. One renewal path, one DNS credential, one thing to monitor for cert expiry.
Alternatives:
- Nginx: more widely known, lower resource footprint, but requires per-service cert management or acme-in-nginx complexity.
- Traefik: dynamic discovery from container labels, good fit if the goal is frequent service churn; this homelab runs stable services so the extra configurability isn’t worth the overhead.
CrowdSec
Section titled “CrowdSec”Behavior-based IDS/IPS at the edge. Detects patterns of abuse (brute force, web scanner, etc.) and enforces blocks either locally or via integrations to firewalls.
Why: Catches abuse patterns faster than per-service rate limiting. One detection point for all services.
Alternatives:
- Fail2ban: simpler, log-based, lower overhead. CrowdSec offers broader pattern library and community feed updates.
Media & library
Section titled “Media & library”Media server. Transcodes and streams owned content (ripped DVDs/Blu-rays, home video, personal photos) to authorized users over the network.
Why: Hardware transcoding (GPU passthrough) is efficient. Familiar client ecosystem.
Alternatives:
- Jellyfin: fully open-source, no account requirement. More headless-friendly but client ecosystem is smaller.
- Kalebi: simpler, lighter. Fewer features.
Tautulli
Section titled “Tautulli”Monitoring and analytics layer for Plex. Tracks playback, users, bandwidth, and alerts on unusual patterns.
Why: Visibility into what’s actually being watched and when. Useful for capacity planning and catching broken clients silently failing.
Calibre-Web
Section titled “Calibre-Web”Web interface for an ebook library. Auto-imports epubs, manages metadata, serves over HTTP.
Why: Lighter than other ebook servers. Simple interface for adding and reading. Integrates with Plex as a library if structured as one.
Alternatives:
- Kavita: similar scope, faster search.
- Mylar: more comics-focused.
Infrastructure & utilities
Section titled “Infrastructure & utilities”Proxmox (hypervisor) & Proxmox Backup Server
Section titled “Proxmox (hypervisor) & Proxmox Backup Server”Virtualizes the cluster nodes. PBS handles scheduled guest backups with dedup and retention tiers.
Why: Hypervisor is stable, well-documented, no licensing lock-in. Native HA. PBS dedup makes retention cheap.
Alternatives:
- KVM + libvirt: lower overhead, steeper learning curve for cluster operations.
- ESXi: better clustering tooling, expensive licensing.
TrueNAS & ZFS
Section titled “TrueNAS & ZFS”Storage backend. ZFS provides snapshots, dedup, and redundancy. Exported over NFS to the cluster.
Why: ZFS snapshots are fast and cheap (copy-on-write). Straightforward RAID-Z implementation. NFS is simpler and more transparent than block storage.
Alternatives:
- Ceph: distributed, no single point of failure for the storage box. Overkill at this scale and harder to reason about.
- Linux NFS on standard filesystems: less visibility into the data and no rollback.
UniFi (network management)
Section titled “UniFi (network management)”Manages VLAN segmentation, DHCP, DNS for the LAN, and handles AP/switch provisioning.
Why: VLAN isolation is load-bearing (storage/management separated from general traffic). UniFi handles all of it from one UI.
Alternatives:
- OPNsense / pfSense: more granular, more overhead. Fine for this if the goal is to drop UniFi.
Homepage (dashboard)
Section titled “Homepage (dashboard)”Simple landing page with bookmarks and status cards for major services.
Why: Single entry point to everything. Quick visual check that major services are up.
Alternatives:
- Organizr, Heimdall: similar, more themeable.
- Static bookmarks: faster, less to maintain.
Download & distribution
Section titled “Download & distribution”Qbittorrent
Section titled “Qbittorrent”Torrent client. Downloads legal material: open-source distributions, software with a torrent release, Linux ISOs, research papers, personal media that was distributed via torrent.
Why: Efficient use of bandwidth. Integrates with other tools for seeding management.
Alternatives:
- Transmission: lighter, less resource overhead.
- Deluge: similar feature set.
Gluetun
Section titled “Gluetun”VPN client that routes specific containers through an external VPN. Used for distribution/upload work.
Why: Decouples VPN from the main network. Containers can selectively route through it; most traffic bypasses it entirely.
Alternatives:
- Host-level VPN: simpler in concept, affects all traffic. Fine if the goal is to simplify the container setup.
Development & admin tools
Section titled “Development & admin tools”Pelican-Wings
Section titled “Pelican-Wings”Game server controller. Manages provisioning and lifecycle of game server instances.
Why: Automation for repetitive server setup/teardown. API-driven so it can be triggered from other services.
Alternatives:
- Manual provisioning: simpler until you need to run more than a couple servers.
- Pterodactyl Panel: more UI-heavy, overkill if you don’t need the hosted game-provider ecosystem.
Adding a service
Section titled “Adding a service”Services are declared in OpenTofu (the guest, its resource allocation, DNS record) and configured in Ansible (packages, systemd units) if it’s not containerized, or as a Podman Quadlet if it is. A service’s persistent state goes on the NFS share (or the guest’s own disk for databases that don’t tolerate network latency). See Provisioning for the workflow.