Homelab
Every containerized service behind a single reverse proxy, with centralized authentication, HTTP caching and monitoring.
Background
The infrastructure is declared in Compose on a Debian server provisioned by Ansible: the network edge can be rebuilt from the configuration files alone. Some of the services are open to external users, which makes availability, authentication and monitoring non-negotiable.
Path of a request
Infrastructure topology.
- The browser resolves the domain at Cloudflare, then reaches Traefik over HTTPS or HTTP/3.
- Traefik terminates TLS with an automatically renewed wildcard certificate.
- CrowdSec analyses every request live and queries its decision engine, which answers with pass, CAPTCHA or block.
- Accepted requests go through application filtering, rate limiting and security headers.
- Routing is per-domain, and authentication is delegated to Authelia as SSO with TOTP.
- Part of the traffic goes through an HTTP cache before reaching the services.
- The containerized services are spread across isolated Docker networks.
Technologies and tools used
Network edge & security
Reverse proxy & TLS
Middlewares
- CrowdSec Bouncer & AppSec
- Rate limiting
- Security headers (HSTS, identity stripping)
Routing is per-domain behind a wildcard certificate renewed over DNS-01, and every request goes through a security analysis before it reaches a service.
Cache & network
Network & DNS
DNS is configured with Cloudflare, and a custom VCL keeps authenticated traffic out of the cache while holding a long TTL on assets.
Authentication & identity
Traefik delegates authentication to Authelia over ForwardAuth, with deny-by-default and TOTP on sensitive services.
Provisioning
A repeatable playbook describes the host configuration and the Docker stacks, checkable in a dry run before it is applied.
Operations
Monitoring
Netdata collects the metrics and Uptime Kuma probes the services from the outside, while restic pushes encrypted snapshots off site.
Experiments (outside production)
Virtualization & orchestration
An HA Kubernetes cluster on Proxmox VE and Ceph, and a WARP mesh with per-application access policies, both built to learn from.
Challenges
- Isolating services across Docker networks without breaking the dependencies between containers.
- Ordering the middlewares so authentication, caching and security analysis compose without contradicting each other.
- Moving to DNS-validated wildcard certificates, so no HTTP validation path is exposed publicly any more.