phasheen/homelab

phasheen/homelab

Homelab

The self-hosted stack I run at home and in the cloud, and the rules that keep it boring.

Home and Oracle Cloud hosts connect out to a Pangolin proxy on a Seoul VPS through Newt tunnels, and to each other over Tailscale. internet https edge · VPS, Seoul Pangolin home Unraid Proxmox VE Oracle Cloud cloud hosts Newt tunnel Newt tunnel Tailscale
Hosts reach the edge through outbound Newt tunnels; Tailscale links my devices and hosts privately.

Stack

by layer
layerwhathow it's used
hostsUnraid · Proxmox VE · Oracle CloudStorage and hardware-bound services on Unraid, VMs and containers on Proxmox, a few always-on services in the cloud.
edgePangolin + NewtA reverse proxy on a small VPS in Seoul. Hosts dial out to it through Newt tunnels.
private networkTailscaleOne private mesh for my devices and hosts.
identityPocket IDOne OIDC sign-on for the services that support it.
deploysKomodo · Docker ComposeEvery service is a Compose file in git, deployed by Komodo.
opsAI-assisted, read-only firstAgents diagnose through read-only MCP tools; changes arrive as Compose diffs in pull requests that I review and merge.

services include

  • Vaultwarden
  • Immich
  • Home Assistant
  • Obsidian sync (CouchDB)
  • Komodo
  • Pocket ID
  • Pangolin

House rules

  1. 01Compose by default

    Everything goes through Komodo. Unraid templates only where a service needs the hardware: USB passthrough, GPU transcoding.

  2. 02Read before write

    Diagnostics run through read-only tools. Anything that changes state is a diff I can read.

  3. 03Pin versions

    Core pieces such as the tunnel client run pinned versions and are upgraded on purpose.

At the lab

TL-02 →

The same habits run my lab's shared stack, which I co-admin for about 20 researchers: Proxmox, Komodo deployments, Pangolin with Auth0 single sign-on, Grafana and InfluxDB monitoring, and Label Studio for annotation.