You can find the configurations for each of the services I self-host in the accompanying directories, with descriptions of each below.
The services are managed using Portainer and Docker Compose. For just Docker Compose usage, you can use the following commands:
cp .env.example .env
# Fill in the required variablesdocker network create proxy-internal --ipv6
docker network create proxy-external --ipv6
docker network create proxy-plausible --internal
docker network create proxy-immich-public --internal
docker network create proxy-immich-upload-public --internal
docker network create proxy-ottrbox --internal
docker compose up -ddocker compose downdocker compose pull
docker compose up -d
docker image prune -fThis diagram gives an overview of the services I run and how they interact with each other and the outside world.
graph TB
%% Groups
subgraph "External Access"
EXT[External Users]
CF[Cloudflare]
end
subgraph "Internal Access"
INT[Internal Users]
TAILSCALE[Tailscale]
end
subgraph "Homelab Network"
subgraph "Network Infrastructure"
CF_TUNNEL[Cloudflare Tunnel]
CADDY_EXT[External Reverse Proxy]
IMMICH_PROXY[Immich Public Proxy]
CADDY_INT[Internal Reverse Proxy]
ERROR_PAGES[Custom Error Pages]
SABLIER[Sablier]
end
subgraph "User Services"
IMMICH[Immich]
NEXTCLOUD[Nextcloud]
PLAUSIBLE[Plausible]
OTTRBOX[OttrBox]
HOMEPAGE[Homepage]
POCKET_ID[Pocket ID]
GOTIFY[Gotify]
HEALTHCHECKS[Healthchecks]
UPTIME_KUMA[Uptime Kuma]
AIRTRAIL[AirTrail]
STIRLING[Stirling PDF]
MAZANOKE[Mazanoke]
CONVERTX[ConvertX]
IT_TOOLS[IT Tools]
SPOTIFY[Spotify Dashboard]
PORTAINER[Portainer]
BESZEL_HUB[Beszel Hub]
TINYAUTH[Tinyauth]
end
subgraph "Infrastructure Services"
BESZEL_AGENT[Beszel Agent]
DIUN[Diun]
SOCKET_PROXY[Docker Socket Proxy]
end
DS[Docker Socket]
end
%% Connections
%% External Access
EXT --> CF
CF --> CF_TUNNEL
CF_TUNNEL --> CADDY_EXT
%% External Service Routing
CADDY_EXT --> OTTRBOX
CADDY_EXT --> IMMICH_PROXY
CADDY_EXT --> IMMICH
IMMICH_PROXY --> IMMICH
CADDY_EXT --> PLAUSIBLE
%% Internal Access
INT --> TAILSCALE
TAILSCALE --> CADDY_INT
%% Internal Service Routing
CADDY_INT --> ERROR_PAGES
CADDY_INT --> IMMICH
CADDY_INT --> NEXTCLOUD
CADDY_INT --> PLAUSIBLE
CADDY_INT --> HOMEPAGE
CADDY_INT --> POCKET_ID
CADDY_INT --> GOTIFY
CADDY_INT --> HEALTHCHECKS
CADDY_INT --> UPTIME_KUMA
CADDY_INT --> AIRTRAIL
CADDY_INT --> SABLIER
SABLIER --> STIRLING
SABLIER --> MAZANOKE
SABLIER --> CONVERTX
SABLIER --> IT_TOOLS
SABLIER --> SPOTIFY
CADDY_INT --> PORTAINER
CADDY_INT --> BESZEL_HUB
CADDY_INT --> TINYAUTH
%% Service Dependencies
BESZEL_HUB --> BESZEL_AGENT
CADDY_INT --> SOCKET_PROXY
SABLIER --> SOCKET_PROXY
TINYAUTH --> SOCKET_PROXY
DIUN --> SOCKET_PROXY
BESZEL_AGENT --> SOCKET_PROXY
PORTAINER --> DS
SOCKET_PROXY --> DS
%% Styling
classDef external fill:#ffe66d,stroke:#ffc107,stroke-width:2px,color:#000
classDef internal fill:#a8e6cf,stroke:#66bb6a,stroke-width:2px,color:#000
classDef user-services fill:#42a5f5,stroke:#1976d2,stroke-width:2px,color:#fff
classDef infra-services fill:#ba68c8,stroke:#9c27b0,stroke-width:2px,color:#fff
class CF,CF_TUNNEL,IMMICH_PROXY,CADDY_EXT external
class TAILSCALE,CADDY_INT,ERROR_PAGES,SABLIER internal
class IMMICH,NEXTCLOUD,PLAUSIBLE,OTTRBOX,HOMEPAGE,PORTAINER,BESZEL_HUB,POCKET_ID,GOTIFY,HEALTHCHECKS,UPTIME_KUMA,AIRTRAIL,STIRLING,MAZANOKE,CONVERTX,IT_TOOLS,SPOTIFY,TINYAUTH user-services
class SOCKET_PROXY,BESZEL_AGENT,DIUN infra-services
Portainer is a lightweight management UI that allows you to easily manage your Docker containers, images, networks, and volumes. I use it to deploy and manage my self-hosted services, using the GitOps feature to automatically deploy changes to my services when I push to this repository. I also run a Portainer agent on my ODROID N2+ to manage the staging environment.
I use Caddy as the reverse proxy for my services due to its robust feature set and ease of use. I use a custom build that includes the Caddy Docker Proxy and Cloudflare DNS plugins for label-based configuration and automatic SSL certificate management.
Additionally, I use Sablier along with its Caddy plugin to automatically scale down user tools (i.e. services that are used for short periods and don't perform background tasks) when not in use and scale them back up when needed, which helps save system resources.
I also use Error Pages to provide custom error pages for my services, resulting in more user-friendly error information.
Beszel is a lightweight server monitoring platform that includes Docker statistics, historical data, and alert functions. I use it as the main monitoring tool for my homelab, providing insights into the performance and health of my machines.
My authentication service of choice is Pocket ID. It is a self-hosted identity provider that supports OpenID Connect and OAuth 2.0, allowing me to manage user authentication and authorization for my applications securely. I chose it for its simplicity, clean UI, ease of integration, and focus on passwordless authentication.
Tinyauth is an application that enables authentication in front of services that do not natively support it. For my use case specifically, it allows me to use Tinyauth as an authentication proxy for Pocket ID with Caddy. This means I can protect any service behind Caddy with Pocket ID authentication, and even provide OAuth account functionality to some services through user headers, such as Healthchecks.
Docker Image Update Notifier (Diun) is an application for receiving notifications when a Docker image is updated on a Docker registry. I use it to monitor my important containers and notify me via 3rd-party integrations when a new image version is found.
I use Homepage as the central dashboard for my homelab. It provides a customizable and user-friendly interface to access and manage all my services in one place.
To monitor the uptime of my services, I use Uptime Kuma. It is a feature-rich monitoring tool that supports various check types, has many notification options, and has a status page builder.
Healthchecks is a cron job and background task monitoring service. It allows you to create "check-ins" for your scheduled tasks, and if a task fails to check in within a specified time frame, it sends you an alert via email or other notification methods. I use it to monitor various scheduled tasks and ensure they are running as expected.
Due to some services' reliance on connection to the docker socket, I use Docker Socket Proxy to securely expose the Docker API to my services in read-only mode without giving them direct access to the Docker daemon (with the exception of Portainer, which requires full access).
Immich is a self-hosted photo and video storage solution with functionality similar to Google Photos. It allows you to automatically back up your photos and videos from your devices, providing a web interface to view and manage your media. It is my primary photo and video management solution.
I also run Immich Public Proxy to provide secure external access to link shares and public albums without exposing the main Immich server directly to the internet.
Nextcloud is a powerful productivity platform that provides file storage, collaboration tools, and more. I use it mainly to store and share files.
To facilitate secure public access to a subset of my services, I use Cloudflared to create secure tunnels to my internal services. This allows me to expose specific services to the internet without exposing my entire network.
Plausible is a web analytics tool that is privacy-friendly and compliant with GDPR. It provides insights into website traffic without compromising user privacy. I use it to track and analyze the traffic to my internal and external services.
OttrBox is a fork of the archived Pingvin Share project. It is a self-hosted file sharing service that I expose publicly to send and receive files easily and securely.
AirTrail is a flight tracking and logging application. It provides a web interface to log flights, view statistics, and integrate with various flight tracking services.
I use Stirling PDF for all my PDF needs. It is a self-hosted tool that allows you to merge, split, and manipulate PDF files easily without giving up your privacy.
Spotify Dashboard is purely for displaying historical listening data. It is not a replacement for the Spotify app, but rather a nice tool to visualize your listening habits and statistics over time.
I run Mazanoke for easy photo compression and conversion. It provides a clean web interface and runs completely in the browser, making it a convenient tool for quick image processing tasks.
ConvertX is a file conversion service that allows you to convert various file types easily from a simple web interface.
IT Tools is a collection of useful tools for IT professionals and software developers, including key generators, network tools, cheat sheets, and more.