Documentation/Doc/Home-Server/Introduction.md

Home Server – Overview

---

1. Goals

• Central point for my home-lab and dev-ops learning.
• Self-hosted services for media viewers, git, password manager, home assistant, etc.
• Clean separation between OS, data, and Docker stacks.
• Easy to maintain, backup, and rebuild if needed.

---

2. Hardware and Base OS

• Hardware: ZimaBoard used as a low-power home server.
• OS: Debian installed on the internal eMMC.
• Role: main server for the home LAN and VPN clients.

Linux basics and commands:

• Linux / Basics
• Linux / Administration
• Linux / Cheat Sheet

---

3. Storage Layout

OS, Docker, and data are clearly separated:

• eMMC: system root (/), /boot, and base Debian.
• NVMe SSD mounted on /srv/ssd for Docker (data-root, stacks, appdata).
• Data disks:
  • /srv/ebooks (sda1, ext4) for ebooks and comics.
  • /srv/media (sdb1, ext4) for movies, series, etc.

Key idea: Docker stacks and appdata live on the NVMe (/srv/ssd), not on /.

• Linux / Storage

---

4. Docker and Application Stacks

Docker runs on the Debian host and is my main way to deploy services.

• Docker data-root and volumes live under /srv/ssd.
• Stacks are organised under /srv/ssd/stacks/<stack-name>/.
• Typical services:
  • Media: Komga (ebooks), Jellyfin (videos).
  • Dev: Gitea + Postgres.
  • Password manager: Vaultwarden.
  • Monitoring: Homepage, Uptime Kuma, Dozzle, Glances.
• Containers use restart: unless-stopped so they come back after reboot.

Containerisation, Docker concepts and commands:

• Containerisation
• Containerisation / Docker
• Containerisation / Docker / Commands

---

5. Networking, DNS, and Reverse Proxy

Home server is the central point for internal names and HTTPS access.

• Internal DNS: dnsmasq on the host, listening on 0.0.0.0:53.
  • Resolves *.lan names (vaultwarden.lan, komga.lan, home.lan, etc.) to the server IP (for example 192.168.1.18).
  • Forwards public domains to external resolvers.
• Reverse proxy: Caddy in front of services on ports 80/443.
  • Exposes internal virtual hosts like vaultwarden.lan, home.lan, status.lan, logs.lan, metrics.lan, komga.lan, gitea.lan, jellyfin.lan.
  • Uses tls internal with an internal CA; I install the root CA certificate on clients so browsers trust *.lan.

Networking, DNS, and Reverse Proxy Documentation

• Network / Basics
• Network / DNS
• Network / Reverse Proxy

---

6. Remote Access

Remote access is provided by a WireGuard VPN running on the Debian host.

• Server interface: wg0 with address 10.10.10.1/24, listening on UDP 51820.
• Clients (PC, smartphone, etc.) get one IP each in 10.10.10.0/24.
• NAT rules allow VPN clients to reach the home LAN (192.168.1.0/24).
• Clients send both VPN and LAN traffic through the tunnel via AllowedIPs = 10.10.10.0/24, 192.168.1.0/24.
• DNS for clients is the home server itself (10.10.10.1) so .lan names always work.

Remote access documentation:

• Network / VPN Basics
• Security / Certificates
• Home-Server / WireGuard implementation

---

7. Monitoring and Dashboard

Monitoring is based on a lightweight stack under /srv/ssd/stacks/monitoring:

• Homepage: main dashboard and entry point for services, with basic widgets.
• Uptime Kuma: service availability checks.
• Dozzle: real‑time Docker logs.
• Glances: system metrics (CPU, RAM, disks, Docker, network).

These services are exposed internally via Caddy and DNS:

• https://home.lan → Homepage
• https://status.lan → Uptime Kuma
• https://logs.lan → Dozzle
• https://metrics.lan → Glances

---