Git, Gitea, Bind9, Postgres, Nginx and other python app and html web servers running in KVM for initial control. Here's my re-prioritized and optimized version of my in-progress list. I re-ordered it from foundational → infrastructure → security/monitoring → services (the way most stable labs are built). Suggested better or more modern alternatives where they make sense for a typical lab/self-hosted environment in 2026.

**Phase 1: Base & Networking (Must be first)**

1.  OPNsense (or OpenWRT on edge devices)  
    → Best open-source firewall/router today. Great UI, Zenarmor, WireGuard, etc.
    
2.  KVM/QEMU + Open vSwitch (or Proxmox VE as a full stack)  
    → Proxmox is usually the smarter choice for most people unless you specifically want to stay ultra-minimal.
    
3.  WireGuard + Netbird (or Tailscale/Headscale)  
    → Modern zero-trust mesh VPN. Netbird is excellent.
    
4.  Technitium DNS (or AdGuard Home + Unbound)  
    → Very solid self-hosted DNS + DHCP + blocking.
    
5.  piKVM (or alternatives like TinyPilot)  
    → Great for remote management of bare-metal machines.
    

**Phase 2: Identity, Storage & Orchestration**

6.  FreeIPA (or Keycloak + Authelia/Zitadel for OIDC)  
    → FreeIPA is heavy but powerful if you want full LDAP/Kerberos. Many people now prefer lighter OIDC stacks.
    
7.  TrueNAS Scale (or plain ZFS + Samba/NFS on Debian)  
    → Best file server experience. NFS + ZFS snapshots + replication.
    
8.  Ansible + Terraform (IaC)  
    → Keep this early — it will make everything else reproducible.
    
9.  Podman + Buildah + Skopeo (rootless) + Quadlet  
    → Better than Docker for security. Skip full Kubernetes unless you really need it.
    
10.  Incus (or LXC/LXD) + Proxmox  
     → Incus is the spiritual successor to LXD and very nice for lightweight containers/Vms.


**Phase 3: Core Services & Monitoring**

11.  Caddy (or Traefik / Nginx Proxy Manager)  
     → Caddy is fantastic with automatic HTTPS.
     
12.  PostgreSQL (primary DB)
     
13.  Nginx / Unit (as application server where needed)
     
14.  Cert-Manager (or use Caddy’s built-in ACME)
     
15.  Prometheus + Grafana + Loki (or Netdata + Uptime Kuma)  
     → Graphical metrics. Loki + Grafana is a strong combo.
     
16.  Graylog or VictoriaLogs + Netdata (or Zabbix/OBS)  
     → Logging stack.
     
17.  ntopng (traffic monitoring)
     
18.  Suricata (or CrowdSec + Fail2Ban)  
     → IDS/IPS. CrowdSec is much easier for homelabs.
     

**Phase 4: Applications & Self-Hosted Services**

19.  Nextcloud (or ownCloud Infinite Scale)
     
20.  Immich (photos) — excellent choice
     
21.  Jellyfin + Navidrome (music)
     
22.  Home Assistant
     
23.  Matrix (Synapse or Dendrite) + Element
     
24.  PeerTube
     
25.  Discourse (forum)
     
26.  Etherpad or Hedgedoc
     
27.  Wiki.js (or Bookstack / DokuWiki)
     
28.  Invoice Ninja
     
29.  qBittorrent (or Jellyseerr + \*arr stack if you go that route)
     
30.  Odoo (or Dolibarr / ERPNext) — lighter alternatives exist
     

**Phase 5: Nice-to-Haves / Advanced**

-   XMPP (e.g. Prosody + Snikket) — low priority unless you have specific need
    
-   Sphinx documentation
    
-   Pasetbin (or Pastefy, PrivateBin)
    
-   Webmin — mostly replaced by Cockpit / Portainer / custom Ansible
    
-   VyOS — good for advanced routing but OPNsense usually suffices
    
-   OpenBSD — great for specific hardened services
    
-   Jenkins — consider Woodpecker CI, Forgejo Actions, or Gitea/Forgejo + Drone instead (lighter)
    
-   Spiffe/Spire — overkill for most homelabs
    
-   DOCSIS 4 — very niche
    
-   oVirt — mostly replaced by Proxmox
    
-   AWS Quickstart / AsciiDoc — not relevant unless you're doing cloud migration docs
    
-   Automatic upgrades (use unattended-upgrades + Ansible)
    

**Quick Wins / Modern Stack Suggestion (2026)**

-   Hypervisor: Proxmox VE
    
-   Firewall: OPNsense
    
-   Containers: Podman + Quadlet (or Incus)
    
-   Reverse Proxy: Caddy
    
-   Auth: Keycloak or Zitadel
    
-   Monitoring: Netdata + Grafana + Loki
    
-   VPN: Netbird or Headscale
    
-   DNS: Technitium
    
  

This ordering dramatically reduces pain. Build the foundation (networking + storage + IaC) first — everything else becomes much easier and more reliable.Would you like me to:


-----------------

Here’s a realistic phased installation plan based on your list, reordered for stability, security, and dependency flow.

  
**Phase 1: Foundation (Week 1 – Get the base rock-solid)**

  

1.  OPNsense (primary firewall/router)
    
2.  WireGuard + Netbird (mesh VPN)
    
3.  Technitium DNS
    
4.  KVM/QEMU + Open vSwitch → Strongly consider Proxmox VE instead (much easier management)
    
5.  piKVM (for bare metal remote access)
    
6.  Ansible + Terraform (start writing playbooks early)
    

Goal: Reliable networking, remote access, and automation foundation.


**Phase 2: Storage & Virtualization (Week 1–2)**

7.  TrueNAS Scale (or ZFS on Linux) – NFS + Samba shares
    
8.  Incus (lightweight containers/VMs) or continue with Proxmox
    
9.  Podman + Buildah + Skopeo (rootless container runtime)
    

Goal: Secure storage with snapshots + solid container/VM layer.


**Phase 3: Identity, Security & Monitoring (Week 2–3)**

10.  Keycloak (or FreeIPA if you need full LDAP) + OIDC
     
11.  Caddy (reverse proxy + automatic HTTPS)
     
12.  Cert-Manager (if not using Caddy)
     
13.  Prometheus + Grafana + Loki (metrics + logs)
     
14.  Suricata + CrowdSec (IDS/IPS + modern blocking)
     
15.  ntopng (network visibility)
     

Goal: Secure access, observability, and threat protection before exposing services.


**Phase 4: Core Productivity Services (Week 3–4)**

16.  Nextcloud
     
17.  Immich (photos)
     
18.  PostgreSQL (primary database)
     
19.  Home Assistant
     
20.  Matrix Chat (Synapse/Dendrite + Element)
     
21.  Jellyfin + Navidrome
     
22.  Wiki.js
     
23.  Discourse (if you want a forum)
     

**Phase 5: Additional Services (Month 2+)**

24.  PeerTube
     
25.  Invoice Ninja
     
26.  qBittorrent (+ optional \*arr stack)
     
27.  Etherpad or Hedgedoc
     
28.  Odoo (or lighter ERP like Dolibarr)
     
29.  XMPP (Prosody/Snikket) – only if needed
     
30.  NGINX / Unit (for specific apps)
     
31.  Sphinx Documentation / internal docs
     

**Phase 6: Advanced / Specialized (Later)**

-   Jenkins → Replace with Forgejo + Woodpecker CI (lighter)
    
-   VyOS / OpenBSD (specific hardened routers/services)
    
-   Spiffe/Spire, oVirt, DOCSIS 4 – only if you have a clear need
    
-   Pasetbin, Webmin (low priority)
    
-   Automatic security upgrades (Ansible + unattended-upgrades)
    

**Recommended Modern Lab Stack Summary (2026)**

-   Hypervisor: Proxmox VE
    
-   Firewall: OPNsense
    
-   VPN: Netbird
    
-   Proxy: Caddy
    
-   Containers: Podman + Incus
    
-   Monitoring: Netdata/Grafana + Loki
    
-   Auth: Keycloak
    
-   Storage: TrueNAS Scale


-----------------

OLD LISt

Pangolin CADDY	
OPNSense / OpenWRT	KEA DHCP IPV6 OpenVswitch
FreeIPA/FreeRadius/OIDC	IPA Zitadel ID/KeyCloak/Authentik
KVM / Qemu / OpenVSwitch	
AnsibleTerraform	ANSIBLE
Kubernetes / LXConsole / Incus	RANCHER / K3S / K8S / RKE / Portainer.io
XMPP	
Podman, Buildah, Skopeo, Nomad	DOCKER ALT., Portainer.io
FLECTRA/OODOO	ERP
HA NFS / ZFS File Server	TrueNAS
netboot.xyz / DistroBox	NETBOOT, iPXE (DRBL,Clonezilla)
Jenkins	
	
Sphinx Documentation	
JELLYFIN Navidrome	Sonarr Radarr Streamyfin
PEERTUBE	PEERTUBE & JITSI
Suricata/SNORT/Graylog	GRAYLOG / Uptime Kuma
Graphical Metrics	GRAFANA Loki / PROMETHEUS /Alert Mgr.
DOCSIS 4	
NextCloud	
Ovirt	
Devops	CNCF Flux / Renovate Bot
Object Storage	MINIO
NGINX / Gunicorn / Django	UNIT,containerd, WASM, APACHE
EMAIL	EXIM GITEA SERVER EMAILS
PostgreSQL	PGADMIN4
Automatic Upgrades	? Disable Automatic
AWS Quickstart / AsciiDoc	
Discourse	
EtherPad	
HomeAssistant	
Matrix Chat	
NGINX / UNIT	UNIT WASM, APACHE
ntopng	
pasetbin	
Spiffe Spire BoKS/Keon	
Suricata/SNORT/Graylog	
VEOS VectorEngine NEC 	
VyOS and OpenBSD	
wiki.js	JS WIKI / MediaWIKI
Wireguard	Nginx Proxy Manager
CertManager	Mesh Central
QbitTorrent	Remotely
Invoice Ninja	Guacamole Remote access
Webmin	Netbird Wireguard VPN
pikvm	MediaWiki
Technitum DNS	
Netbird VPN, Wireguard	
immich photos	
