Self-Hosted Home Lab

35+ Docker containers on Ubuntu · reverse proxy, tunnels, VPN & DNS filtering

Ubuntu Linux Docker / Compose Networking Defensive hardening ● Live

Summary A production-style self-hosted server running 35+ Docker containers across a dozen compose stacks on Ubuntu (with an NVIDIA GPU for AI workloads). It sits behind a proper edge: Nginx Proxy Manager for TLS, Cloudflare Tunnels for zero-open-port ingress, a WireGuard VPN for remote access, and Pi-hole for network-wide DNS filtering. It is the platform every other project on this page runs on.

01How it is built

It's my hands-on environment for Linux administration, containerisation, networking and defensive hardening. Nothing is exposed by punching holes in the router: inbound web traffic arrives through Cloudflare Tunnels, remote access is via WireGuard, and internal services sit behind a reverse proxy with TLS. Pi-hole filters DNS for the whole network, config is backed up to a NAS on a schedule, and the AI agent team keeps the whole thing monitored and self-healing.

02Edge & core components

Component	Image	Role
Nginx Proxy Manager	`jc21/nginx-proxy-manager`	Reverse proxy + Let's Encrypt TLS for all internal services (ports 80/443).
Cloudflare Tunnel	`cloudflare/cloudflared`	Outbound-only ingress: publishes services with no inbound firewall ports open.
WireGuard	`linuxserver/wireguard`	Fast VPN for secure remote access back into the lab (UDP 51820).
Pi-hole	`pihole/pihole`	Network-wide DNS sinkhole: ad/tracker/malware blocking for every device.
Pi-hole edge	`nginx:alpine`	Lightweight nginx front for the Pi-hole admin UI.
PostgreSQL / MariaDB	`postgres:16`, `mariadb`	Shared databases backing the app stacks.
Host	Ubuntu Server + NVIDIA GPU	Bare-metal host; GPU passthrough for the local-AI workloads.

03What runs on top

The same server hosts the other projects here: the Splunk × Tenable SIEM lab, the AI agent team, the private LLM stack, the Home Assistant smart home, the media server and the Australian Homestead WordPress site. All are isolated in their own compose stacks and published through the shared edge.

04What this demonstrates

Linux & Docker at scale: a dozen compose stacks, shared networks, volumes and databases kept healthy together.
Secure networking: reverse proxy + TLS, tunnel-based ingress with no open ports, VPN remote access and DNS filtering.
Defensive hardening: least-exposure architecture, segmentation, secrets handling and scheduled backups.
Operations: it runs 24/7 for real, monitored by an automated agent team rather than by hand.

back to projects