Ali Alhammadi
Back to the main page

The homelab

A custom-built Unraid server I've run since 2018. It started as storage and media, and grew into a small platform with more than 30 services, built with the same habits I use at work.

Homelab architecture A visitor reaches Cloudflare's edge, which handles DNS, DDoS protection, WAF and an Access policy that requires a passkey through Pocket ID. Traffic reaches the home Unraid server only through an outbound Cloudflare Tunnel. The server runs cloudflared, Pocket ID, more than 30 Docker Compose stacks synced from a private GitHub repo, and Grafana, which sends alerts to Discord. Visitor any browser Cloudflare edge DNS DDoS protection Web application firewall Access policy passkey required on every login identity provider: Pocket ID tunnel outbound only Home network UniFi gateway, NextDNS, no inbound ports Unraid server NVIDIA GPU for transcoding cloudflared tunnel connector Pocket ID passkeys, single sign-on for most services 30+ services Docker Compose stacks deployed by Dockhand Grafana dashboards, alert rules GitHub private repo sync Discord alert channel alerts
How a request reaches a service. The server opens the tunnel outward, so the home network accepts no inbound connections.

Why I run it

Most of what I'm confident about at work, I broke at home first. The homelab is where I try things without a change window: new services, new ways to deploy them, and new ways to lock them down.

What runs on it

More than 30 open-source services, grouped roughly like this:

Every service lives in Git

I moved past Unraid's built-in app templates early. Each service is a Docker Compose stack in a private GitHub repository, and Dockhand syncs those stacks to the server. A change is a commit, so I have history and can roll back, and if the server died I could rebuild the whole platform from the repo and the data.

No open ports

Nothing is published by forwarding ports on the router. The services I reach from outside go through a Cloudflare Tunnel, which the server opens outward to Cloudflare. Cloudflare then handles DNS, DDoS protection and the web application firewall in front of everything.

Passkeys, every time

Cloudflare Access sits in front of each published service, and its policy requires a passkey on every login from the internet. The identity provider is Pocket ID, which I host myself and which only supports passkeys, so there are no passwords to phish or reuse. Most internal services use Pocket ID for single sign-on as well, so one identity covers the whole lab.

Watching it

Grafana collects metrics from the server and services, and alert rules post to a Discord channel, so I hear about a full disk or a stopped container before I notice it myself.

The network around it

The home network is deliberately simple: a UniFi Cloud Gateway Ultra for routing and firewalling, and NextDNS as the DNS provider. The complexity lives on the server, where it's version-controlled.