IZAN | HomeLab & Systems

General HomeLab

Introduction

A HomeLab is a personal server environment where own services are run completely locally, without relying on third parties or the cloud. In my case, I set it up as a natural extension of my project and ASIX training: if I am going to manage production systems, I first need a real lab where I can break things, fix them, and learn.

The project started with the local AI project on my personal PC and I later acquired an old, limited machine to experiment, learn, and make my technological needs simpler. It now manages everything from my home network DNS to photo storage, plus continuous monitoring of all services.

All data stays on my local network. No service sends information to external servers. I only access from outside via VPN.

Hardware

The server is a repurposed old PC, chosen for its low power consumption but enough power to run stable, silent services 24/7 at home.

Component	Specification	Role
CPU	Intel i7-4790	Main compute + virtualisation
RAM	4 × 4 GB DDR3	Docker containers
OS Storage	436 GB SSD Kingston	Operating system + services
Network	Gigabit Ethernet	Main connectivity
Operating System	Ubuntu Server 24.04 LTS	Main host

Objective

The main objective of the HomeLab is threefold:

Hands-on learning

Replicating real production environments to practise systems administration, networking, and cybersecurity before facing them in the workplace.

Data sovereignty

Eliminating dependency on cloud services (Google Photos, Dropbox...) while maintaining total control over my personal data.

Experimentation

Having a safe environment to test new technologies, advanced network configurations, and projects without fear of breaking anything critical.

What does it give me?

Managing a personal HomeLab is building skills that are hard to learn in a classroom:

Real networking

DNS, DHCP, firewall rules — things configured for real, with real consequences if something fails.

Docker in production

Deployment, updating, and maintenance of containers, compose files, volumes, and networking between services.

Applied security

Service hardening, audit logs, and local SSL certificates.

Troubleshooting

Real fault diagnosis, log analysis, network problem debugging, and hardware failure recovery.

How do I manage it?

Administration is primarily done from the terminal via SSH, complemented by web interfaces for the more visual services:

# Access to main server
ssh izan@homelab.local -p 22

# Check Docker container status
docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"

# Update all services
docker compose pull && docker compose up -d

Network structure

The home network is segmented to isolate the server from other devices, with the server acting as DNS server for the entire local network:

The server acts as the primary DNS for the entire network, filtering ads and malicious domains via PiHole before resolving any query.

Security

Security is a priority in the HomeLab. I implemented measures such as firewall, network monitoring, and regular updates to protect all services. Additionally, I perform periodic audits using NMAP and Lynis after every major change.

Lynis — Security Auditing

Lynis is a security auditing tool I use to evaluate my system's configuration. It scans the system and provides a detailed report with a score and recommendations to improve security. It is an essential tool for keeping the HomeLab secure and protected against potential threats.

Future & Updates

The HomeLab is constantly evolving. Here is a short list of projects I plan to add in the future.

Immich security and capacity separation

Full migration from Google Photos to self-hosted Immich. Automated backup and RAID 1 for data protection.

NAS creation

Separate bay with 3 or more isolated disks to create a RAID system and large storage.

Security camera system

Installation of security cameras in a secure and stable manner, accessible via ethernet.

WireGuard VPN

Secure remote access to all HomeLab services from anywhere via self-hosted WireGuard VPN, replacing my current VPN service.

Second node (Raspberry Pi 5)

Adding a second low-power server as a secondary node for high availability of critical services like PiHole.

Local AI evolution

Integration of more specialised AI hardware (NVIDIA Orin or similar) to avoid using my main PC as the inference machine.

Monitoring

Monitoring is a critical part of any infrastructure. The HomeLab uses three complementary layers: real-time metrics, service availability checks, and hardware alerts.

Netdata

Netdata is the real-time monitoring engine for the server. With 1-second resolution, it captures CPU, RAM, disk, network, temperature, and process metrics for all Docker containers.

System metrics

Per-core CPU usage, RAM, disk I/O, component temperature, and system load in real time.

Docker containers

Per-container CPU and RAM usage, health check status, and automatic detection of abnormal resource consumption.

# Deploy Netdata with Docker support
docker run -d --name=netdata \
  --pid=host --network=host \
  -v netdataconfig:/etc/netdata \
  -v netdatalib:/var/lib/netdata \
  -v /etc/passwd:/host/etc/passwd:ro \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  --cap-add SYS_PTRACE \
  --security-opt apparmor=unconfined \
  netdata/netdata

Active — Port 19999

Uptime Kuma

Uptime Kuma checks every 60 seconds that all services are responding correctly.

Monitored services

PiHole, Immich, Netdata, Ollama, and Open WebUI. Real-time status with automatic alerts.

Active

Disk Failure Alert (S.M.A.R.T.)

Disks are monitored with smartmontools. A daily cron script analyses the S.M.A.R.T. status of each disk and sends an email alert if it detects bad sectors, read errors, or elevated temperature.

HDDs have an elevated failure rate after 3-5 years. S.M.A.R.T. monitoring allows detecting imminent failures before data is lost.

DNS PiHole

PiHole acts as the DNS server for the entire home network, intercepting requests to advertising, tracking, and malware domains before they reach devices. With blocklists updated automatically every week, it filters between 20% and 40% of total DNS traffic.

Ad blocking

Network-level ad blocking for all connected devices: PCs, phones, Smart TVs, and consoles — no installation needed on each device.

~25% requests blocked

Custom local DNS

Local DNS records to access HomeLab services with friendly names: immich.local, netdata.local...

12 local records

# docker-compose.yml — PiHole
services:
  pihole:
    image: pihole/pihole:latest
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "8053:80/tcp"
    environment:
      TZ: 'Europe/Madrid'
      WEBPASSWORD: '**********'
    volumes:
      - './etc-pihole:/etc/pihole'
      - './etc-dnsmasq.d:/etc/dnsmasq.d'
    restart: unless-stopped

Immich Gallery

Immich is the self-hosted alternative to Google Photos I use to store and manage all my photos and videos. The mobile app automatically backs up in real time to my server, and none of my photos ever pass through third-party servers again.

Immich includes AI-powered facial recognition, content-based search, automatic album generation, and a location map — all running locally.

Automatic backup

The Immich Android app automatically backs up every new photo and video as soon as the phone connects to the home WiFi.

Sync active

Integrated local AI

Facial recognition, object classification, and semantic search (search for "beach 2024") using AI models that run on the server itself.

Machine Learning active

Private gallery — not publicly available

My PersonalHomeLab