Neon & Silicon: A Cyberpunk Tour of My Homelab
The rain never really stops in the part of the internet most people live in. It comes down in subscriptions, in terms-of-service updates, in “we’re sunsetting this feature” emails. The skyline is lit by logos you didn’t choose, and every tower in it has a meter running. You live there, and you pay rent on your photos, your files, your passwords, and your own habits.
Down in the lower levels there’s another way to live. It’s a rack of humming metal in a back room, a few blinking status lights, and a stack you built, understand, and can take apart with your own hands. No landlord and no kill switch.
This is a tour of that place: my homelab. I’m not writing a how-to. Think of it as a walk through the alleys, with a look at the philosophy behind the wiring and the general shape of the build.
Concrete Walls, Clean Lanes
The network: how I split my home into separate zones.
Every good district has borders, and mine start at the router. A UniFi router carves the network into three segments: one for the household, one for the homelab servers, and one isolated network for work.
The household lane is the noisy one, full of phones, TVs, and whatever else wants to talk to the outside world. The lab lane is where the servers live, and it’s quieter and more deliberate. The work network is walled off from both. If something misbehaves in one zone, the other two don’t have to care.
That’s the first layer of a theme you’ll see all through this build: security in layers. No single wall has to be perfect, because there’s always another one behind it. Segmentation, minimal exposure, encryption, and least privilege each cover for the others’ blind spots.
The Heavy Iron, the Back-Alley Node, and the Command Deck
The hardware: three machines, three very different jobs.
The main server does most of the heavy lifting. It’s a mid-range Ryzen box with an NVIDIA GPU that earns its keep on video transcoding. It has separate drives for the operating system, the bulk media library, and local backups. Keeping those apart means a problem in one place doesn’t automatically become a problem everywhere.
The second node is an old laptop that got a second life. It runs headless with no screen and no keyboard, just a lid and a power cable. Its disk is fully encrypted, so if it ever walked out the door, it would be a brick to whoever took it. It’s also the home of an off-host backup copy, which I’ll get to.
The third machine isn’t part of the cluster at all. It’s my desktop workstation, which I call the command deck. Everything is managed from there over SSH. Keeping it outside the cluster is deliberate. The thing I use to control the infrastructure shouldn’t be a thing the infrastructure depends on. If the lab goes sideways, the deck is still standing, and I still have hands on the controls.
The Only Door in the Wall
The public edge: how the lab reaches the internet without revealing my home.
Most of what I run is never exposed to the open internet. Where something does need to be reachable, there’s exactly one front door, and it isn’t in my house.
It’s a small rented cloud server. It sits out in the wild, takes the traffic, and passes it home through an encrypted tunnel. My home IP stays hidden behind it. Anyone poking at the public edge finds a small, boring, well-watched surface. They don’t find my living room.
For my own access when I’m away, I skip port-forwarding and hope. I use a private mesh VPN. My devices talk to each other on a network that doesn’t exist to anyone else. Internal services still use HTTPS with real certificates, because “it’s only internal” is exactly the kind of sentence that precedes a bad day.
The less you expose, the less you have to defend.
The Street Market
The services: what the lab actually does, and how it’s organized.
A lab only matters if it does something for you. Mine runs a small bazaar of services, all of them replacing something I used to rent:
- A media server with automated library management, plus audiobooks.
- A private cloud for files, notes, and RSS.
- A self-hosted password manager.
- Network-wide ad and tracker blocking, backed by privacy-respecting upstream DNS.
- Monitoring dashboards and uptime alerts, so the lab can tell me when it’s unhappy.
- An internal wiki that documents all of it, because future me is a stranger who deserves clear notes.
Under the hood, services run on a deliberate mix of a lightweight Kubernetes cluster (k3s) and plain Docker. I don’t treat that as a compromise. Some workloads benefit from orchestration, and some are better as a simple container that does one job.
Core plumbing, meaning DNS and the reverse proxy, stays outside the cluster on purpose. If the cluster has a bad night, name resolution and routing keep working, and I can still reach the tools I need to fix it. The foundation shouldn’t depend on the things built on top of it.
This is the second theme: keep it simple. Every change should be reversible and easy to maintain, and the stack should be only as complex as it needs to be. I’ve learned the hard way that cleverness has a maintenance cost. You pay it later, usually at the worst time.
Black Ice and Safety Nets
Backups: how I make sure I can lose a machine without losing my data.
In this city, hardware dies and drives fail. Sometimes you just fat-finger the wrong command at midnight. Backups are what turn those events from disasters into inconveniences.
Mine follow a layered approach, much like the security does:
- Encrypted daily backups to a local drive on the main server.
- A second copy on the other node, so a single-machine failure doesn’t take everything with it.
- An encrypted recovery USB, a small physical lifeline for the worst-case scenario.
- An off-site cloud copy, which is still in progress.
That last item is honest: it isn’t finished. The off-site piece is the part that covers fire, theft, and the truly bad day, and it’s the next big thing on my list. A backup plan that only exists in one building is incomplete, and I’d rather say so than pretend otherwise.
Ghosts in the Machine
AI helpers: how I use AI agents to build and maintain the lab, safely.
Yes, I use AI agents to help build and maintain this place. They’re good at the tedious parts: drafting configs, untangling problems, keeping documentation honest. I treat them like contractors, not owners.
Each agent has its own restricted account and scoped credentials. None of them gets the keys to the whole district. They get access to what their job requires and nothing more. If one makes a mistake, the damage has edges. If one’s credentials leak, the blast radius is small.
This is the same least privilege principle that runs through the network and the edge, applied to a new kind of coworker. It’s easy to hand an assistant full access because it’s convenient. It’s better to decide, up front, what it actually needs.
What’s Next, and Why Any of This Is Worth It
The closing: where the lab is headed and why I keep doing this.
The lab is in what I’d call its finishing phase. The major pieces are in place and the architecture holds together. The remaining work is finishing the off-site backup, tuning things that are almost right, and tightening what I’ve learned could be tighter. There’s always something to tune. A homelab is never done, only stable enough to enjoy until the next idea shows up.
Why bother, when you could rent all of this for a monthly fee? Because of what you get in return:
- Ownership. My data lives on hardware I control, under rules I set. Nobody can change the terms, raise the price, or quietly shut it down.
- Understanding. When something breaks, I know where to look, because I built the thing. That knowledge belongs to me, too.
- Resilience. Layers, backups, and a sensible separation of concerns mean a bad day is survivable.
- Calm. It’s a lot less stressful to run a system that’s simple, documented, and reversible.
None of this takes a megacorp’s budget. It takes patience, a willingness to learn, and a few principles you actually stick to. Start small and keep it simple. Lock the doors, back up your data, and give every process only the access it needs.
The rain’s still coming down out there, and the neon still flickers in the towers. In here, the fans are spinning, the status lights are green, and the stack is mine.
Featured image: “cybercity” by OiMax, licensed under CC BY 2.0.