Homelab

The stack

The goal is a stack that remains understandable, recoverable, private by default, and boring when it needs to be boring. Access is private by default over Tailscale, with no inbound port forwarding.

1. 1Trusted devicesThings I use to reach the system.
2. 2TailscalePrivate access without making the home network public.
3. 3Synology + DockerDurable storage and isolated service boundaries.
4. 4Focused servicesSmall pieces with one job and a clear failure mode.

Services

The service layer stays intentionally legible. Each piece has a focused role, while the access layer keeps the whole arrangement coherent.

Synology

Storage, container hosting, backups, and the durable center of the home stack.

Docker

Keeps individual services isolated and easier to upgrade, replace, and recover.

Home Assistant

The automation layer connecting otherwise unrelated pieces of the home.

AdGuard Home

Network-wide DNS filtering and local DNS behavior.

Unbound

Recursive DNS resolution rather than depending entirely on a third-party resolver.

Principles

Private by default

A service does not need to be publicly reachable merely because I want to access it remotely.

Understand the failure mode

It should be possible to explain what happens when DNS fails, the internet fails, a container dies, a drive disappears, or an upgrade goes badly.

Documentation is infrastructure

The person debugging something six months later is usually me, except with no memory of why I made the original decision. Help that person.

A successful backup job is nice. A successful restore is evidence.

Backups are treated as a recovery practice: protect important data with independent copies, make backup jobs observable, and rehearse restoration. A backup only earns trust when a restore has been shown to work.

Lessons learned

• Private-by-default access keeps the public surface small.
• Small, composable services make changes and recovery easier to reason about.
• Documentation and restore practice are part of reliability, not afterthoughts.

This page intentionally describes architecture rather than operational configuration.