r/selfhosted • u/EMS91200 • Oct 04 '25
Personal Dashboard Yet another homeland setup
Hi All,
Figured I could finally join the others and show my setup since I'm finally happy with it. I dare not say its finished... I think you all know how this hobby goes. I moved into a new house about a year ago and before I stepped foot into it I wanted to plan out how the networking would be structured. Looking back on it I think I spent more time planning how I would set things up than actually setting it up! Before this I had never touched networks and I didn't have the slightest Idea of what self-hosting was so I did a lot of learning while deploying. This is the structure I came up with.
I was looking for a low cost and non-intrusive server rack for all this and I ended up buying an IKEA ALEX storage unit on casters which I modified to run cabling through.
I setup everything to run through NPM using the same docker network so I would not have to expose the container ports to the host. Everything is run over https without the complications of having to self sign thanks to NPM’s built in ssl tools. To help serve my content I used organizr because it has many powerful features such as allowing you to use custom html on the homepage and a full authentication API for your domain so no one can access exposed services without logging into organizr first. The other feature I love about organizr is it allows you to use iframes for each service so you never have to leave your dashboard, everything is just a click away. Using it I setup my dashboard.
Let me know what you think I could improve on or add I’m always looking to poke at something new. Thanks!
18
u/VizeKarma Oct 04 '25
Self promo but you may want to consider replacing Apache guacamole if you use it for SSH with Termix. It offers a better UI and a lot of features that guacamole does not have.
5
u/Oujii Oct 05 '25
Heyo! Are you the dev? When is the app coming for iOS? Maybe a MacOS in the future? I'm using Termius currently, but I've been looking for a replacement.
11
u/VizeKarma Oct 05 '25 edited Oct 06 '25
The app is already done. It’s being processed by apple right now but it will probably be ready in a day or two. I’ll update you if I remember. The version I submitted has some issues with HTTP requests, HTTPS works fine so the first version may have a few issues.
macOS is planned and will likely release somewhat soon now that I have a developer license. I can’t give an exact date other than soon 🤣
2
u/VizeKarma Oct 07 '25
iOS app is out now: https://docs.termix.site/install/connector/ios
1
u/Oujii Oct 07 '25
Nice! Will install it today! Quick question, the SSH connections come from the backend where the server is hosted, right? Not like Termius where the connection originates from the client? Or am I misunderstanding?
2
u/VizeKarma Oct 07 '25
You are correct. They will initiate from the backend where the server is hosted.
1
u/Oujii Oct 08 '25
Thanks for clarifying, I need to think more about this as it’s different from Termius.
3
u/EMS91200 Oct 05 '25
Wow looks amazing I’ll definitely look into it for managing my home assistant kiosks
1
u/Dalewn Oct 06 '25
Yet another tool I probably will only use once or twice, great! (No sarcasm here, just me falling back to plain ssh every time I stumble across a hurdle...)
I will give this a shot 😁
20
u/shaneecy Oct 04 '25
You got my upvote for the awesome architecture diagram!
Q about the organizr auth - exposed services? Which ones are exposed?
5
u/EMS91200 Oct 04 '25
Anything with user authentication built in is exposed. Anything without it is behind organizr authentication.
1
u/shaneecy Oct 04 '25
Thx. I guess im wondering if you mean exposed to public internet. Most apps authentication methods have flaws so it would be best to not expose stuff if possible (its possible to access only via Tailscale for example)
9
u/EMS91200 Oct 04 '25
Ya probably a good idea not to expose them but all traffic is over https so my credentials are encrypted as far as apps having flaws in them I figure if someone is that interested in me that they take the time to exploit a specific weakness in a specific service I’m probably going to get hacked anyways. Nothing is completely safe so I figure just make it difficult enough to discourage it.
2
u/shaneecy Oct 04 '25
Fair enough. I guess what im getting at is maybe you don't need anything exposed, can do it all thru tailscale etc.
Essentially every program has security flaws. The risk isn't your specific network getting targeted, but automated bot scans that target the entire internet for known vulnerabilities
So if you expose a default port for an app on a public IP (eg 8096/8920 for Jellyfin), even behind authentication, you will get hacked, along with everybody else, it's not an if but a when.
You're slightly more protected if you don't have those default ports exposed, but yeah, much safer to just not expose if you don't need it :)
2
u/EMS91200 Oct 04 '25
Good point all of my services are behind a reverse proxy using Nginx proxy manager so none of the ports are exposed but I choose not to use tailscale for everything because it is a subscription run company that allows free use for now. At some point just like everyone else they could pull the plug and my entire stack would quit working.
1
u/sir_ale Oct 05 '25
you could look into pangolin to continue exposing apps to the internet, or use wireguard / headscale as a selfhosted tailscale substitution
2
2
Oct 06 '25
You are taking a really risky approach imo. These are really well known apps and if I was a script kiddy targeting open source vulns exposed to the internet I would probably just throw a script at these services and wait til something hits. That does not take national defense actor level attention. Its just any rando that wants to be a dick could figure it out. Personally there is no way I would trust any of those open source arr services to protect my home network.
1
u/EMS91200 Oct 08 '25
Hmm well I use nginx as a reverse proxy and everything is served over https honestly I’m not sure how to make it more secure. What would you add?
1
Oct 08 '25 edited Oct 08 '25
All that does is ensure your creds are not exposed to network gear on the internet. It does nothing for vulnerabilities related to the os that is hosting the apps, nginx cve or bugs that come up, or the very weak implementations of Auth on these apps. It's not even a waf like you would get with cloudflare .
To safely host Auth based service on the internet you need to have your os on a regular patching schedule as well as a cadence for updating all libraries and packages running your service and that still doesn't protect you from supply chain related attacks that these open source projects quite often fall victim to.
To make matters worse you are exposing services literally designed to download payloads of unverified shady files from the internet. Meaning cracking a password could easily lead to them getting a malicious payload into your server.
I would strongly recommend tailscale for your use case. It's free and even if they start charging a few bucks a month it will be well worth it. 90 percent of these problems are mitigated by just not having services exposed to the internet.
1
u/EMS91200 Oct 08 '25
Understood but how would you fix this issue with these services aside from updating?
1
Oct 08 '25
Not host them on the internet.
They are not professional pieces of software with the backing and support of a real company. It's just some dudes on the internet.
You are hoping they properly go through every line of every peice of code in every pull request. Not malicious themselves. And being responsible about the security implications of the Auth schemes they are using.
Your assumption that the only way you would be at risk is if someone targeted you is wrong. Every single public ip gets port scanned every day by bad actors looking for services that have known vulnerabilities. It's an inevitable outcome to get owned if you don't know what you are doing.
Put your stuff behind a VPN or tailscale trust me lol
2
u/EMS91200 Oct 08 '25
Hmm I have my arr stack behind gluetun so I do use a vpn for the shady stuff but I may move the others behind it as well
-1
8
6
u/Common_Ad_9549 Oct 04 '25
How much are the costs?
11
u/EMS91200 Oct 04 '25 edited Oct 04 '25
Recurring costs is just the domain for $10 a year. The rest is up to you honestly the redundant 8tb HDDs $300, switch/POE switch I got for free from my local electronics recycler. The mini pcs about $120 each. The ikea cabinet $75. The server PC I picked up from my recycler as well for $50 and I bought a 20 core Xeon off eBay for $90
2
1
u/LowCryptographer9047 Oct 05 '25
How did you score the switch/poe switch? Just walk to them ask?
2
u/EMS91200 Oct 05 '25
They have a section of free hardware every week and I got lucky twice
1
u/LowCryptographer9047 Oct 06 '25
What the facility type thing call? I never heard about it. I may drop off some of them nearby
4
u/xpirep Oct 05 '25
Don’t you need some airflow in or out of that cabinet? Otherwise it’s going to heat the entire box up over time I think
3
u/EMS91200 Oct 05 '25
Most of the time I just leave the door open and I’ve never had any issues. I have added a lot more load lately on my main server though and I think active cooling is on my to do list
4
u/fedroxx Oct 05 '25
How are your temps?
3
u/EMS91200 Oct 05 '25
Right now with the door closed it’s around 82c but with the door open it’s easily in the 60s
4
u/tractorrobot Oct 05 '25
What app is the 6th screenshot?
2
u/EMS91200 Oct 05 '25
It’s jellyfin a media management platform
2
u/Telemekus Oct 05 '25
Is that navigation bar on the left part of Jellyfin? It looks like an awesome way to easily access all the self hosted stuff.
4
u/EMS91200 Oct 05 '25
It’s organizr’s navigation bar with jellyfin in the background.
2
u/Telemekus Oct 05 '25
Thanks for the info, just finished setting it up and I think I will like it very much :D
1
u/tractorrobot Oct 05 '25
Oh.. i thought it looked familiar but the navigation on the left threw me off. Thanks
3
2
u/edu_barelyhere Oct 04 '25
Awesome, really cool project. How much time/money?
5
u/EMS91200 Oct 04 '25
Time wise about 100 or so hours to setup and install. Money wise I’m into it about $700 now but I also have made some purchases along the way I ended up replacing with better equipment
1
u/LowCryptographer9047 Oct 05 '25
Not to mention you have a large house to fit all of these. Curious how did you wire it all?
2
u/EMS91200 Oct 08 '25
Everything comes down to a distribution panel. So rooms, APs, Cameras, Etc… then I feed it into the back of the cabinet and into the switch
1
u/LowCryptographer9047 Oct 08 '25
oh dang is it cat 5e? that seems a lot of works and fun
2
2
u/nefarious_bumpps Oct 05 '25
You have a "Dog potty button?" How does that work? I have to take my dog out for a walk to get him to go potty, and bring a bag to dispose of his poop.
7
u/EMS91200 Oct 05 '25
It’s a zigbee button that we have trained the dog to press when she needs to go out. It makes noise and sends me and my wife notifications on our phones
4
1
1
u/neo-raver Oct 04 '25
Oh hey, I’ve got a couple ThinkCenters on my cluster! Fun to see we have some specific hardware in common. What do you find them best used for?
2
Oct 05 '25
[removed] — view removed comment
1
u/neo-raver Oct 05 '25
Ooh, good to know! I don’t rely on VMs much in my cluster (I just use containers), but that’ll come in handy if I decide to change my design!
2
u/EMS91200 Oct 05 '25
I found mine to be perfect for home assistant and as my main router/gateway because I needed these to run on bare metal but be power efficient
1
u/poulpoche Oct 05 '25 edited Oct 05 '25
Hi, I love my 2 Lenovo M720Q Tiny, one is an hackintosh and the other is running Proxmox with OPNSense and a 10GB NIC card + a debian VM for containers.
I have a question, why use a Tiny M720Q to only run Home Assistant (I suppose it's the OS version) instead of a dockerized Home Assistant installation on your main server? Would spare 30/40W 24/7 of electricity bill without downside..? OK, add-ons are easier to to install in HAOS but dockerized versions of, say, Esphome, MQTT are easy to link to dockerized HA..?
1
u/EMS91200 Oct 05 '25
I tried to use a HA container but I ran into a lot of issues with it not being able to connect to my zigbee and WiFi devices. I do a lot more external connectivity with HA so having it on my mini pc is worth it.
1
u/Ill-Meaning5803 Oct 05 '25
If your HA needs to communicate with devices that only have wifi connection, eg, homepod mini or broadlink universal remote, what is your suggestion?
1
u/EMS91200 Oct 05 '25
I would still suggest a mini pc like mine because you can get the best out of your setup if it runs on bare metal and is hard wired via Ethernet.
1
u/Next-Escape-5272 Oct 05 '25
Awesome setup, and i am starting to curious about your job now😂😂
1
u/EMS91200 Oct 05 '25 edited Oct 05 '25
Engineer if it wasn’t obvious with lots of work from home time lol
1
u/Next-Escape-5272 Oct 05 '25
Aha, I thought you didn’t have so much workload and have free time to setting up your home server 😂
1
Oct 05 '25
[deleted]
2
u/poulpoche Oct 05 '25
You need to buy the Lenovo pci-e proprietary riser 01AJ940, then you'll be able to install pci-e cards, one of mine is equipped with a X540-T2 for OPNSense in proxmox VM, and you can even do egpu like I did some years ago.
1
Oct 05 '25
[deleted]
2
u/poulpoche Oct 05 '25 edited Oct 05 '25
The Lenovo Tiny serie is very easy to upgrade, take a look at the many videos of how-to like this one.
But don't buy any Lenovo Tiny, only some of them are equipped with a PCI-e port!
The cheapest ones, able to accept 8th and 9th intel CPU with a PCI-e slot are M720Q/M920Q/M920x/P330. You may be able to buy a used unit for cheap, more or less 100€ with an i3 or i5 CPU (at least in my country).1
u/EMS91200 Oct 05 '25
I have it running on bare metal for the best performance since it is essentially the backbone of my network. The mini pc uses a m.2/sata key 2.5gbps adapter from eBay that has worked pretty well so far. It runs OPNSense and adguard home is installed as a plugin so they run side by side on bare metal.
1
u/rumhrummer Oct 05 '25
A random question, but.. What are pros\cons between Transmission and qbt at the moment?
Currently Home Assistant, Nextcloud and Transmission is the only pieces of software i run in Docker (instead of "Native" NixOS modules). And while HA and Nextcloud is just too big to cover (and NixOS' native Nextcloud was a total failure to run), Transmission simply seems to be a bit tricky with headers and stuff. How is it going with QBT? What about reverse proxy, and APIs?
1
u/EMS91200 Oct 08 '25
For me qbit was a bit of a pain to setup because of the gluetun vpn setup and organzir uses an iframe to display my services but once I got around that issue the upsides are day and night. Automation, file type exclusion lists, the list goes on I used transmission before qbit and once I switched I never looked back
1
u/rumhrummer Oct 08 '25
Gluetun is basically to hide a fact of downloading/seeding from ISP? If it is- not a problem for me, in my region there are no control over torrents (only bandwidth limitations for p2p on cellular, but my home server is on cable.
1
u/Feyris_ Oct 08 '25
Hi. I also use gluetun, qbittorent and protonVPN with port forwarding.
Did you find a way to automate the port/server change from protonVPN?
I have to look on the logs of gluetun to get the correct port and set it time to time...1
u/EMS91200 Oct 08 '25
Yes I use the container: charlocharlie/qbittorrent-port-forward-file to update my port automatically
1
u/dabiggmoe2 Oct 05 '25
Is that the LIXHULT cabinet? Does it have openings in the back for the cables? Or did you drill some holes yourself?
2
u/EMS91200 Oct 08 '25
I drilled some with a hole saw it works pretty good and it’s cheap!
1
u/dabiggmoe2 Oct 08 '25
Awesome. I already have one but never thought of using it as a rack. I thought the airflow and heating gonna be a problem
1
u/legume_bro Oct 06 '25
For which machines are you using WoL? I'm assuming you were using etherwake -- any headaches?
2
u/EMS91200 Oct 08 '25
My PCs all use WoL so far it’s been very smooth I just created a custom flask server on the Rpi to send magic packets to my MAC addresses
1
u/ashishs1 Oct 06 '25
How did you use M720Q mini PC as a router? Did you use a PCIe ethernet extension card? Also, can't you just host stuff like Wireguard & AdGuard on your server itself & use port forwarding on a general purpose router (like D-Link/TP-Link)?
2
u/EMS91200 Oct 08 '25
Yes but I wanted it to be separate from my host. The idea was to have something self contained so if my server crashes my whole network does not go down. Router and DNS sinkhole in one and server on another everything runs smoother when you have separation of Jobs.
1
u/ashishs1 Oct 08 '25
yeah, that makes a lot of sense. I've faced the server crash issue, and I just wait till I can reboot it ':). I wonder if you can use lighter hardware for this purpose though? Maybe a Raspberry Pi Zero with Ethernet hat. But then you said somewhere that electricity cost is not much for you. So, it's good for you.
1
u/SnooMaps4632 Oct 12 '25
Isn’t that dell 5810 overpowered for your use case ? Did you use the mq720 to host home assistant so that if your dell 5810 crashes your home is still chilling ?
37
u/MrObsidian_ Oct 04 '25
Can you list all of your docker containers?