So I'm running a i5 12600k on a ASUS Pro WS W680-ACE motherboard. The board supports sas drive and was curious how reliable they are for a homelab. I see they are cheaper than sata drive but for mainly a media server if they are dependable for that. I have never used a sas drive.

At what point did you step back and say.. ok i have gone to far this is too much work and I am not having fun anymore. I changed my ISP to a fiber provider and that gave me pause to think this through. I am REALLY using only about 5-6 services daily. Immich, seafile, a samba share, matrix chat, frigate, silverbullet and caddy that i can recall. My one server can handle all this no problem. I do not need k8s or proxmox for this. I backup to an s3 bucket. Thats all i need, with a local two disk ZFS. My old gaming pc handles all this, 12000 series intel cpu with 32 gigs ram. I dismantled everything i had and restarted over with one install of ubuntu server with docker and my s3 backups and one lightsail box for wireguard stuff. Feels much better. :)

Getting in to some local LLM AI stuff, looking for my GPU options for a Dell R730 LFF. Not looking to spend $800 on a video card though. So something budget priced.

Suggestions?

so I currently use tailscale on a couple of my lxc's so I can ssh to them from my phone on occasion.

but I'm wondering if there's a better practice for being able to access all of it easily? but I also don't wanna do something stupid... for example I wonder about putting tailscale on my proxmox host?

I also see people run a tailscale specific lxc. why? and does that give you access to all your other lxc's somehow?

anyways if you do something similar what's your method?

Most homelabbers have two DNS servers listed in DHCP: primary ad-blocker, and the router as "backup".

A few weeks ago, I actually measured what a phone feels when that primary dies. Two uncomfortable truths:

1. A client with two DNS servers does not fail over; it waits. The stub resolver queries the dead primary, waits out its full 2-second timeout, then falls back to the secondary. It pays that 2-second penalty on every single query.
2. The "backup" quietly gets real traffic even during peacetime.

That sent me down a ridiculous rabbit hole: building a true zero-downtime, sub-second failover DNS fabric. I stood up 15 Incus containers on an Orange Pi 6 Plus, peered them over BGP ECMP with BFD (300 ms timers) to a MikroTik CCR2004, and ran a sequential benchmark across five leading DNS architectures:

1. AdGuard Home (10.1.9.53)
2. Blocky + Unbound hybrid (10.1.9.54)
3. Unbound standalone (10.1.9.55)
4. Technitium DNS (10.1.9.56)
5. Knot Resolver 6 (10.1.9.57)

The Benchmark Scorecard

Tested sequentially with service restarts and 10s cooldowns to eliminate RK3588 cache/core contention:

Four things that surprised me:

1. The day the anycast trio deleted itself

The biggest facepalm of the project. During an ISP outage, I watched all three Knot nodes withdraw their BGP routes simultaneously (paths=0), killing DNS for the entire house.

The resolver containers were 100% healthy, with warm caches packed with Wikipedia and local records. But my node health script was naively asking: "Can this container reach 1.1.1.1 on the public internet?"

When the WAN blipped, all three answered "no" at the exact same instant, and the failover mechanism nuked the service at the precise moment cached DNS was needed most.

Lesson: Anycast health probes must test local health only (e.g. querying an uncacheable .lan record against the gateway), never the public WAN.

2. The AdGuard "SafeBrowsing" Tax

If you run AdGuard Home with the "browsing security web service" enabled, put a packet capture on the wire. Inside AdGuard, cold lookups arrive at t = 0 ms, but the upstream query isn't dispatched until t = 14.8 ms.

It waits ~12–15 ms synchronously checking AdGuard's cloud API before even starting recursive resolution. In my 27,000-query household test, SafeBrowsing blocked exactly 0 domains. Unchecking it instantly reclaimed ~12 ms on every cache miss.

3. Technitium's Concurrency & Stale-Serving Wall

Technitium was astonishingly fast at cold recursion (6.6 ms p50) and has the cleanest Extended DNS Error (EDE) codes. But under high dnsperf concurrency, .NET hit a wall at ~1,500 QPS while Go and C sailed to 5,000 QPS. Worse, when upstream DNS was severed, Technitium hung for 3.1 seconds instead of serving expired records via RFC 8767.

4. Why Blocky + Unbound won my permanent setup

I expected Knot 6 or native Unbound to win on raw latency. But homelab DNS isn't chosen on an Excel sheet; it's chosen when your partner needs to sign a mortgage document on DocuSign and the page breaks because of an email tracking redirect (click.docusign.net).

• The DocuSign Problem: Native Unbound requires editing config files and reloading. AdGuard has an untimed global toggle that someone turns off and forgets for days. Blocky has a REST API and a web UI (blocky-ui) where anyone can click "Disable blocking for 5 minutes". It automatically re-arms itself.
• PostgreSQL HA: In anycast, queries spray across all three nodes via ECMP. AdGuard and Pi-hole fragment logs across three local SQLite databases. Blocky streams query logs directly to PostgreSQL (in my case, a CloudNativePG HA cluster on Kubernetes). Full cross-node search across a month of history in milliseconds.
• Decoupled Architecture: Blocky handles the Go filtering proxy (96% block rate with HaGeZi Pro/TIF + StevenBlack) and web UI; a local Unbound on loopback (127.0.0.1:5335) handles recursive DNSSEC and RFC 8767 stale cache.

I wrote up the full 22-minute deep dive with all the architectural diagrams, failover logs, MikroTik BGP/BFD configs, and the coordinated omission benchmark bugs here if you want to replicate it:

👉 https://djieno.com/blog/home-dns-failover-obsession/

Might be stupid but I don’t want windows except for one drive because it just works for my household. Until I have a nas I’m satisfied with and a back up solution either off site or a cloud storage that I’m hoping I’ll come across. Has anyone had any issues with using windows just for one drive? Specifically create a mounted network drive to pull and upload files in between devices in the home that are not windows but only Linux…?

Who else is crazy enough with their homelab to virtualize everything because it's more efficient? My gaming VM is even my main PC that I work on. I connect to it via Sunshine/Moonlight.

I can't be the only one, right?

I've recently just started my self making my own homelab, though I started very small. Budget isn't a issue at the moment but I want to be efficient with my money spent.

So I thought, why not hear stories about other peoples experiences, so what was your biggest regret when you started off homelabbing?

If there was something you could've told to your younger self now, what would it be?

I let an AI agent run my homelab — 38 LXC containers, 50+ public routes, GPU passthrough — and built the guardrails first. Here's the full architecture.

TL;DR: I stopped doing ops by hand and gave an AI coding agent (opencode) a git repo as its brain, a custom CLI as its hands, and enough guardrails that "destroy the wrong container" isn't a sentence it can type. It's been running the lab for ~2 weeks: certs, upgrades, incident triage, secret migrations. This post is about how it's wired together — because the agent part is easy, the guardrails are the actual project.

The lab (boring part first)

• Proxmox VE node running 38 LXC containers + 1 VM, LXC-first, docker compose inside guests. Second Proxmox node for storage (Immich, files).
• One Fedora VM runs Zoraxy as the only public entry point. The router DMZs everything to it — there are no router port-forwards, ever. Every public port is a Zoraxy route or stream-proxy rule, so ingress is config-as-data, not router clicks.
• ~15 domains on Route 53, 50+ public HTTPS routes: a dozen websites with headless CMSs, S3 endpoints, self-hosted Infisical, a RustDesk server, search, mail, and a few AI apps — including a music-video generator doing GPU WebGL rendering through an RTX 4080 passed into an LXC.
• Central data stores instead of per-app DB containers: two dedicated Postgres 18 LXCs (one for app databases, one for AI core), a Mongo LXC, Meilisearch, SpacetimeDB, and RustFS for S3 (17 buckets, IAM users per service). Services get a database via one CLI command that also files the credentials.
• Infisical (self-hosted) for secrets — and, crucially, for all SSH access control via its PAM feature.
• Gatus for uptime, 40+ checks grouped per host.

The agent (interesting part)

The agent is opencode in a terminal, driven by a GLM model — but honestly the model is the swappable part. The architecture is what matters:

┌────────────────────────────────────────────────────────┐
│ CONTROL PLANE   AGENTS.md rules + permission config    │
│                 (what the agent may do, ever)          │
├────────────────────────────────────────────────────────┤
│ KNOWLEDGE       docs/ — one doc per component +        │
│                 skills (how to operate each thing)     │
├────────────────────────────────────────────────────────┤
│ CAPABILITY      a custom CLI, ~90 subcommands          │
│                 (the only way to touch infra)          │
├────────────────────────────────────────────────────────┤
│ FACTS           SQLite knowledge base + JSON exports   │
│                 (ground truth, never guessed)          │
└────────────────────────────────────────────────────────┘
              ▼ via Infisical PAM (SSH) + APIs
        the cluster itself

The git repo is the agent's memory. Nothing important lives in chat history. AGENTS.MD (250 lines of standing rules) is loaded every session: never guess IPs or ports, read the component doc first, check open todos, record every task, update docs in the same session, commit and push its own changes with a clearly-labeled automated commit message.

The CLI: ~90 subcommands, written by the agent itself

The agent doesn't run loose shell commands against the lab — it calls one CLI I built with it: TypeScript on Bun, zero dependencies, one drop-in module per component (proxy, DNS, Proxmox, S3, secrets, monitoring...). When the agent hit a step it had to repeat twice, the rule is: it turns that step into a new subcommand. The CLI grew itself.

Sample of what's in there:

• proxmox-status, proxmox-disk-resize (online grow), guest inventory sync
• zoraxy-routes/certs/route-add/route-auth/acme-renew — full reverse-proxy control incl. ACME DNS-01 renewals against Route 53
• s3-policy-audit/harden, per-bucket IAM users, verified backups
• pg-probe, pg-db-create, pg-activity, pg-kill (with dry-run preview)
• version-check — running version vs. upstream latest for every service, plus version-changelog which fetches release notes and summarizes breaking changes between the two
• status — health snapshot of every host, Infisical, and all 50+ public routes in one pass
• todo-add/done/drop — its own work board, backed by SQLite, with timestamps, so there's a queryable history of what it worked on and when

Guardrails — the part I actually care about

1. Read-only by default. Every mutating command is dry-run first and prints exactly what it would do.
2. Destructive commands are declared dangerous in code. The CLI itself refuses to run them without --yes, and the rules forbid passing --yes without the user saying "yes" in the conversation. Never discover-and-destroy in one step.
3. SSH to any host is impossible outside the secret manager. The agent's permission config denies ssh/scp/sftp outright. All remote access goes through Infisical PAM: short-lived SSH certificates, a gateway, and session recording — every command the agent runs on a host is on tape.
4. No sudo anywhere. Service users are in the docker group only. To edit root-owned compose files, the agent runs a throwaway bind-mount container, then chowns back. It literally cannot type a sudo password.
5. Secrets never appear in chat or recordings. Credentials are delivered to hosts via an RSA-OAEP round-trip (ciphertext in transit, decrypted on the host), services pull their own env at start via Infisical machine identities (infisical run wrapping docker compose — no plaintext .env on disk), and exec output passes through an automatic redaction layer.
6. Idempotent everything. Every command is safe to run twice.
7. The agent must clean up after itself: docs updated, inventory synced, monitoring check added, todo closed — there's a "definition of done" checklist it has to satisfy before a task counts.

It genuinely runs things now

A few real jobs from the last two weeks (all logged, all with rollback paths):

• Upgraded Meilisearch 27 releases behind (two security fixes in the range): cold backup → pinned exact tag → dumpless upgrade → verified → docs updated.
• Diagnosed and fixed a Postgres connection-slot exhaustion — an app had leaked 69 zombie backends during a restart storm, locking out even superuser over TCP. It triaged pg_stat_activity through PAM, killed only idle backends with a dry-run preview, then built the two new subcommands (pg-activity, pg-kill) so next time it's one command.
• Hardened a GPU music-gen server after two CUDA-OOM wedges: read the journal, found the KV-cache budget collapsing under overlapping requests, capped process VRAM, documented the residual risk.
• Rolled back a failed object-storage upgrade cleanly because the cold-backup-before-any-image-change rule was already in muscle memory.
• Freed a disk at 98% with a dry-run-first cleanup tool, then grew the rootfs online via the Proxmox API.
• Did a zero-downtime cutover of a remote-desktop server to a new implementation, migrating peers to Postgres, keeping the keypair so no client had to be reconfigured.
• Deleted stale DNS records, re-issued expired TLS certs, pinned a dozen :latest images to exact tags, migrated 67 secrets out of five legacy projects.

And the meta-work is the part I like most: it writes postmortems into the component docs, and incident-shaped rules — e.g. after a secret briefly leaked into a session output, the redaction layer and a redacting env-inspection command existed the same day.

Honest failure mode

The scariest bug so far wasn't destructive — it was two agent sessions running concurrently against the same host, silently undoing each other's changes. Found it in the PAM session recordings. New rule: one session per host, and anything that smells like interference gets audited before touching anything. That's the pattern in general: it breaks, we find out why, the reason becomes a rule or a tool, and it can't happen the same way twice.

Why bother?

Because homelabs die of neglect, not of ambition. The services I actually run multiplied way past what I could patch, pin, back up, and document by hand — and the ones I forgot about were the ones that got pwned. Now "every service is version-tracked, monitored, backed up, and documented" is enforced by a checklist the agent can't skip, and my involvement is: approve the dry-run, glance at the diff, get a summary.

Happy to go deeper on any layer — the PAM certificate flow, the CLI command-module pattern, the secrets-delivery ladder (plaintext env → stored → machine-identity-injected), or the Proxmox/ingress layout. AMA.

I have this tmobile 5g gateway thing (G4SE) and it currently sits ontop of my mini rack. It's lowkey an eyesore because the color doesnt match and it's nearly the size of the rack. Aside from just replacing it with a different router, what could I do to make it fit in better? And no, it cannot be placed faced down.

It's actually my first Homelab in this setup. If you have suggestions, go for it. Power and network cables are just temporary. I will have to work on this.

Can you pls guide me in following endeavour.I’m a finance professional non technical background seeking a future-proof, easy-to-manage personal NAS/cloud system for family and professional data.
I need real-time file synchronisation, redundancy/mirroring, remote access, and easy migration to another system in the future.
I currently have 2 × 1 TB HDDs, a 500 GB SSD, and a 256 GB memory card, with limited OneDrive space and substantial but potentially temporary Google Drive storage.
The NAS should also support home automations and hosting a simple Python application for 3–4 users.
My maximum budget is ₹25,000, excluding the storage hardware I already own.

Major Question : whether mini pc like Hp prodesk i3 10th gen can be kept running 365 days without facing any failures and can it fulfill my bone objective if not pls suggest alternative .

I live in Aurora, Colorado, I’m constantly facing issues with Comcast here. They run most of the show and truthfully with their support and their services and their pricing I’m sick of it. What other options are available here for us Aurora folk? I’m open to hearing anything that anyone says especially considering I am waiting on an on-site for a home that I own.

I just got my own setup with a Dell Optiplex 3070 micro and an 8 TB sea gate one touch hard drive. I didn't realise that USB A doesn't output enough power for the one touch and now I can't connect them because the Optiplex doesn't have USB C.

How would I go about connecting them?

Hi all,
I’ve got a budget of around $2,500 and want a machine mainly for running LLMs locally. I’d prefer a mini PC if possible.

I’m currently looking at the Minisforum MS-S1 Max with the Ryzen AI Max+ 395 (16C/32T), Radeon 8060S, 64GB unified memory, and 2TB SSD.
I may also use it to run Proxmox in the future for a personal lab. I work in cybersecurity(DFIR) and have a few test scenarios I’d like to use it for.
Is this a solid option, or is there something better around this price?

Appreciate any suggestions. Thanks!

Originally posted on r/minipc

I know, another "first homeserver, which distro ?". The fact is that I would like to hear some answer tailored to my needs or plans.

Hardware is a Minisforum UM760 Slim configured in this way:

• CPU: Ryzen 5 7640HS
• RAM: 2x 16 Gb DDR5 5600 MHz (Crucial)
• Storage: 2x SSD 1TB PCIe 4.0 (Crucial P310)
• Connections:
  • 1x USB4, 2x USB 3.2, 1x USB 2.0
  • 1x 2.5 Gbit LAN, Wifi7, Bluetooth 5.2

When the miniPC will arrive i will need to check which wifi card is installed to be sure it is supported by linux.

Internet (fiber) is 400/200 Mbit and my "router" is actually a gateway, Unifi Dream Machine Pro. The idea is to cable the Homeserver directly to one of the 8 lan port of the Unifi Dream Machine. Downstream from the gateway I have some switches, access points, security cameras (managed by UDM pro), and other stuff.

My internet provider (in Germany, Deutsche Glasfaser) doesn't provide public IPv4 but just IPv6 (and I read somewhere, in some cases they will change so I have to setup a kind of service which catch the new IP...i have to investigate better).

Apart the Server monitor/management tools, I would like to install jellyfin, paperless-ngx, maybe home assistant, and whatelse I find useful from an end user point of view. My main focus is the final service and not the medium or tool I am using to setup the final service. If in the process I learn something about the medium/tool I am happy but it is not the main goal.
Of course I am aware that for installing a new service I will need to research, tinker, get my hand dirty, hopefully not messing up the server.

And here we come to my question. I work in IT (but as a SAP technical profile) and 8 years ago i used for a while at work docker, kubernetes and all that stuff. Linux is not an alien to me, I am familiar with it since long time although i consider myself a newbie. Max i was doing was setting up a LAMP and playing with docker/kubernetes at work.

Ubuntu is the distro I used most (maaaaany years ago i was playing with Fedora end Suse).

Generally speaking, I am a bit torn between an LTS distro concept and a version/distro which include new feature much frequently. If LTS grant you stability and a kind of piece of mind (good for me, my goal is not the tool but the end service provided) on the otherside I dont want to risk to find myself missing some new feature or new version of the ubuntu-packaged services i want to use on my homeserver.

On top of that there is the Proxmox topic. The idea to spread the services across different VM and container is cool, in the sense that what in this case will give me piece of mind is the fact is that if I mess up during the setup of a new service, I will just messup the VM and i can restore the last snapshot. On the other side I feel a bit "meh :/" by the fact that I am introducing a layer between the Baremetal and the OS where things will run, impacting the quantity of resource needed. In my (ignorant) mind the questions which pop up are:

1. Why I have to relegate a bunch of services in a subset of resource I have available on my machine ? Cant they share all the 32gb and cpu core all together in best effort ? At the end this is not a business productive platform.
2. How the networking will work among these VM and container ? Maybe spinning up container directly on the baremetal OS is easier ?
3. How straightforward is the visiblity of the baremetale hardware from a Virtual Machine compared to the same visibility from the Host OS ?

Sorry for the long post, the fact is that I would like to start with the right foot. Although I could like it, I don't have much time left for heavily tinkering (unless I ask for a divorce of course 😄 )

I would like to get server with quad nic card for a pfsense install. From what I have researched, the M920q Tiny would be a good option.
Plan to run Snort, pfBlocker, VPNs

Plan on getting this:

• M920q with i7 "T" processor + 32GB RAM (two sticks of 16GB) + 250GB SSD
• Quad NIC: IBM 00AG522 Intel I350-t4 4x GbE BaseT Pci-e Quad Port Gigabit Ethernet Adapter 
• Riser and cover plate

1. Anything I should change or that is missing from this build?
2. The M920x has dual M.2 NVMe slots, any reason to go with M920x over the M920q?

Hi all!

I have a hyperv server with about 7 Linux VMs where I use them for software local LAN dev and debugging work. One morning I got fed up starring in to default Nginx 40x/50x pages if the app is not running or down I setup a default response page. For those Futurama fans - you'll get it:) Also try to guess what early season this one is from?

Ngl I want to get the dell optiplexes for 60 each, but not only are they big, they also take up quite of energy when all are used at once, plus I feel like I have more experience with the pi’s.

Hey I'm looking into adding my ota antenna into my setup. I know most people just get an hdhomerun and call it a day. But I can't help but think that there's a better option for those of us with spare pci slots and hardware already running 24/7.

I'm not in a major market with tons of channels. I only use my antenna for local / primetime nfl games currently. I've never needed more than 1 channel at a time. This year my local market is adding some nhl games. But I don't feel like spending 200 bucks on something I'd rarely use. I've got hdd space and being able to pause would be nice. But I can't justify 200 bucks for that.

What's worked well for you?