# Home Server – Overview

---

## 1. Goals

- Central point for my home-lab and dev-ops learning.
- Self-hosted services for media viewers, git, password manager, home assistant, etc.
- Clean separation between OS, data, and Docker stacks.
- Easy to maintain, backup, and rebuild if needed.

---

## 2. Hardware and Base OS

- Hardware: ZimaBoard used as a low-power home server.
- OS: Debian installed on the internal eMMC.
- Role: main server for the home LAN and VPN clients.

Linux basics and commands:
- [Linux / Basics](../Linux/Basics.md)
- [Linux / Administration](../Linux/Administration.md)
- [Linux / Cheat Sheet](../Linux/CheatSheet.md)

---

## 3. Storage Layout

OS, Docker, and data are clearly separated:

- eMMC: system root (`/`), `/boot`, and base Debian.
- NVMe SSD mounted on `/srv/ssd` for Docker (data-root, stacks, appdata).
- Data disks:
	- `/srv/ebooks` (sda1, ext4) for ebooks and comics.
	- `/srv/media` (sdb1, ext4) for movies, series, etc.

Key idea: Docker stacks and appdata live on the NVMe (`/srv/ssd`), not on `/`.

- [Linux / Storage](../Linux/Storage.md)

---

## 4. Docker and Application Stacks

Docker runs on the Debian host and is my main way to deploy services.

- Docker data-root and volumes live under `/srv/ssd`.
- Stacks are organised under `/srv/ssd/stacks/<stack-name>/`.
- Typical services:
	- Media: Komga (ebooks), Jellyfin (videos).
	- Dev: Gitea + Postgres.
	- Security: Vaultwarden.
	- Monitoring: Homepage, Uptime Kuma, Dozzle, Glances.
- Containers use `restart: unless-stopped` so they come back after reboot.

Containerisation, Docker concepts and commands:

- [Containerisation](../Containerisation/Basics.md)
- [Containerisation / Docker](../Containerisation/Docker/Basics.md)
- [Containerisation / Docker / Commands](../Containerisation/Docker/Commands.md)

---

## 5. Networking, DNS, and Reverse Proxy

Home server is the central point for internal names and HTTPS access.

- Internal DNS: `dnsmasq` on the host, listening on `0.0.0.0:53`.
	- Resolves `*.lan` names (vaultwarden.lan, komga.lan, home.lan, etc.) to the server IP (for example 192.168.1.18).
	- Forwards public domains to external resolvers.
- Reverse proxy: Caddy in front of services on ports 80/443.
	- Exposes internal virtual hosts like `vaultwarden.lan`, `home.lan`, `status.lan`, `logs.lan`, `metrics.lan`, `komga.lan`, `gitea.lan`, `jellyfin.lan`.
	- Uses `tls internal` with an internal CA; I install the root CA certificate on clients so browsers trust `*.lan`.

Networking, DNS, and Reverse Proxy Documentation

- [Network / Basics](../Network/Basics.md)
- [Network / DNS](../Network/DNS.md)
- [Network / Reverse Proxy](../Network/ReverseProxy.md) 

---

## 6. Remote Access

Remote access is provided by a WireGuard VPN running on the Debian host.

- Server interface: `wg0` with address `10.10.10.1/24`, listening on UDP 51820.
- Clients (PC, smartphone, etc.) get one IP each in `10.10.10.0/24`.
- NAT rules allow VPN clients to reach the home LAN (`192.168.1.0/24`).
- Clients send both VPN and LAN traffic through the tunnel via `AllowedIPs = 10.10.10.0/24, 192.168.1.0/24`.
- DNS for clients is the home server itself (10.10.10.1) so `.lan` names always work.

Remote access documentation:

- [Network / VPN Basics](../Network/VPN/Basics.md)
- [Security / Certificates](../Security/Certificates.md)
- [Home-Server / WireGuard implementation](../Home-Server/Implementations/VPN/WireGuard.md)

---

## 7. Monitoring and Dashboard

Monitoring is based on a lightweight stack under `/srv/ssd/stacks/monitoring`:

- Homepage: main dashboard and entry point for services, with basic widgets.
- Uptime Kuma: service availability checks.
- Dozzle: real‑time Docker logs.
- Glances: system metrics (CPU, RAM, disks, Docker, network).

These services are exposed internally via Caddy and DNS:

- `https://home.lan` → Homepage
- `https://status.lan` → Uptime Kuma
- `https://logs.lan` → Dozzle
- `https://metrics.lan` → Glances

---