mirror of
https://github.com/IntenseWebs/personal.git
synced 2026-08-26 13:17:26 -05:00
317 lines
8.2 KiB
Plaintext
317 lines
8.2 KiB
Plaintext
Git, Gitea, Bind9, Postgres, Nginx and other python app and html web servers running in KVM for initial control. Here's my re-prioritized and optimized version of my in-progress list. I re-ordered it from foundational → infrastructure → security/monitoring → services (the way most stable labs are built). Suggested better or more modern alternatives where they make sense for a typical lab/self-hosted environment in 2026.
|
||
|
||
**Phase 1: Base & Networking (Must be first)**
|
||
|
||
1. OPNsense (or OpenWRT on edge devices)
|
||
→ Best open-source firewall/router today. Great UI, Zenarmor, WireGuard, etc.
|
||
|
||
2. KVM/QEMU + Open vSwitch (or Proxmox VE as a full stack)
|
||
→ Proxmox is usually the smarter choice for most people unless you specifically want to stay ultra-minimal.
|
||
|
||
3. WireGuard + Netbird (or Tailscale/Headscale)
|
||
→ Modern zero-trust mesh VPN. Netbird is excellent.
|
||
|
||
4. Technitium DNS (or AdGuard Home + Unbound)
|
||
→ Very solid self-hosted DNS + DHCP + blocking.
|
||
|
||
5. piKVM (or alternatives like TinyPilot)
|
||
→ Great for remote management of bare-metal machines.
|
||
|
||
|
||
**Phase 2: Identity, Storage & Orchestration**
|
||
|
||
6. FreeIPA (or Keycloak + Authelia/Zitadel for OIDC)
|
||
→ FreeIPA is heavy but powerful if you want full LDAP/Kerberos. Many people now prefer lighter OIDC stacks.
|
||
|
||
7. TrueNAS Scale (or plain ZFS + Samba/NFS on Debian)
|
||
→ Best file server experience. NFS + ZFS snapshots + replication.
|
||
|
||
8. Ansible + Terraform (IaC)
|
||
→ Keep this early — it will make everything else reproducible.
|
||
|
||
9. Podman + Buildah + Skopeo (rootless) + Quadlet
|
||
→ Better than Docker for security. Skip full Kubernetes unless you really need it.
|
||
|
||
10. Incus (or LXC/LXD) + Proxmox
|
||
→ Incus is the spiritual successor to LXD and very nice for lightweight containers/Vms.
|
||
|
||
|
||
**Phase 3: Core Services & Monitoring**
|
||
|
||
11. Caddy (or Traefik / Nginx Proxy Manager)
|
||
→ Caddy is fantastic with automatic HTTPS.
|
||
|
||
12. PostgreSQL (primary DB)
|
||
|
||
13. Nginx / Unit (as application server where needed)
|
||
|
||
14. Cert-Manager (or use Caddy’s built-in ACME)
|
||
|
||
15. Prometheus + Grafana + Loki (or Netdata + Uptime Kuma)
|
||
→ Graphical metrics. Loki + Grafana is a strong combo.
|
||
|
||
16. Graylog or VictoriaLogs + Netdata (or Zabbix/OBS)
|
||
→ Logging stack.
|
||
|
||
17. ntopng (traffic monitoring)
|
||
|
||
18. Suricata (or CrowdSec + Fail2Ban)
|
||
→ IDS/IPS. CrowdSec is much easier for homelabs.
|
||
|
||
|
||
**Phase 4: Applications & Self-Hosted Services**
|
||
|
||
19. Nextcloud (or ownCloud Infinite Scale)
|
||
|
||
20. Immich (photos) — excellent choice
|
||
|
||
21. Jellyfin + Navidrome (music)
|
||
|
||
22. Home Assistant
|
||
|
||
23. Matrix (Synapse or Dendrite) + Element
|
||
|
||
24. PeerTube
|
||
|
||
25. Discourse (forum)
|
||
|
||
26. Etherpad or Hedgedoc
|
||
|
||
27. Wiki.js (or Bookstack / DokuWiki)
|
||
|
||
28. Invoice Ninja
|
||
|
||
29. qBittorrent (or Jellyseerr + \*arr stack if you go that route)
|
||
|
||
30. Odoo (or Dolibarr / ERPNext) — lighter alternatives exist
|
||
|
||
|
||
**Phase 5: Nice-to-Haves / Advanced**
|
||
|
||
- XMPP (e.g. Prosody + Snikket) — low priority unless you have specific need
|
||
|
||
- Sphinx documentation
|
||
|
||
- Pasetbin (or Pastefy, PrivateBin)
|
||
|
||
- Webmin — mostly replaced by Cockpit / Portainer / custom Ansible
|
||
|
||
- VyOS — good for advanced routing but OPNsense usually suffices
|
||
|
||
- OpenBSD — great for specific hardened services
|
||
|
||
- Jenkins — consider Woodpecker CI, Forgejo Actions, or Gitea/Forgejo + Drone instead (lighter)
|
||
|
||
- Spiffe/Spire — overkill for most homelabs
|
||
|
||
- DOCSIS 4 — very niche
|
||
|
||
- oVirt — mostly replaced by Proxmox
|
||
|
||
- AWS Quickstart / AsciiDoc — not relevant unless you're doing cloud migration docs
|
||
|
||
- Automatic upgrades (use unattended-upgrades + Ansible)
|
||
|
||
|
||
**Quick Wins / Modern Stack Suggestion (2026)**
|
||
|
||
- Hypervisor: Proxmox VE
|
||
|
||
- Firewall: OPNsense
|
||
|
||
- Containers: Podman + Quadlet (or Incus)
|
||
|
||
- Reverse Proxy: Caddy
|
||
|
||
- Auth: Keycloak or Zitadel
|
||
|
||
- Monitoring: Netdata + Grafana + Loki
|
||
|
||
- VPN: Netbird or Headscale
|
||
|
||
- DNS: Technitium
|
||
|
||
|
||
|
||
This ordering dramatically reduces pain. Build the foundation (networking + storage + IaC) first — everything else becomes much easier and more reliable.Would you like me to:
|
||
|
||
|
||
-----------------
|
||
|
||
Here’s a realistic phased installation plan based on your list, reordered for stability, security, and dependency flow.
|
||
|
||
|
||
**Phase 1: Foundation (Week 1 – Get the base rock-solid)**
|
||
|
||
|
||
|
||
1. OPNsense (primary firewall/router)
|
||
|
||
2. WireGuard + Netbird (mesh VPN)
|
||
|
||
3. Technitium DNS
|
||
|
||
4. KVM/QEMU + Open vSwitch → Strongly consider Proxmox VE instead (much easier management)
|
||
|
||
5. piKVM (for bare metal remote access)
|
||
|
||
6. Ansible + Terraform (start writing playbooks early)
|
||
|
||
|
||
Goal: Reliable networking, remote access, and automation foundation.
|
||
|
||
|
||
**Phase 2: Storage & Virtualization (Week 1–2)**
|
||
|
||
7. TrueNAS Scale (or ZFS on Linux) – NFS + Samba shares
|
||
|
||
8. Incus (lightweight containers/VMs) or continue with Proxmox
|
||
|
||
9. Podman + Buildah + Skopeo (rootless container runtime)
|
||
|
||
|
||
Goal: Secure storage with snapshots + solid container/VM layer.
|
||
|
||
|
||
**Phase 3: Identity, Security & Monitoring (Week 2–3)**
|
||
|
||
10. Keycloak (or FreeIPA if you need full LDAP) + OIDC
|
||
|
||
11. Caddy (reverse proxy + automatic HTTPS)
|
||
|
||
12. Cert-Manager (if not using Caddy)
|
||
|
||
13. Prometheus + Grafana + Loki (metrics + logs)
|
||
|
||
14. Suricata + CrowdSec (IDS/IPS + modern blocking)
|
||
|
||
15. ntopng (network visibility)
|
||
|
||
|
||
Goal: Secure access, observability, and threat protection before exposing services.
|
||
|
||
|
||
**Phase 4: Core Productivity Services (Week 3–4)**
|
||
|
||
16. Nextcloud
|
||
|
||
17. Immich (photos)
|
||
|
||
18. PostgreSQL (primary database)
|
||
|
||
19. Home Assistant
|
||
|
||
20. Matrix Chat (Synapse/Dendrite + Element)
|
||
|
||
21. Jellyfin + Navidrome
|
||
|
||
22. Wiki.js
|
||
|
||
23. Discourse (if you want a forum)
|
||
|
||
|
||
**Phase 5: Additional Services (Month 2+)**
|
||
|
||
24. PeerTube
|
||
|
||
25. Invoice Ninja
|
||
|
||
26. qBittorrent (+ optional \*arr stack)
|
||
|
||
27. Etherpad or Hedgedoc
|
||
|
||
28. Odoo (or lighter ERP like Dolibarr)
|
||
|
||
29. XMPP (Prosody/Snikket) – only if needed
|
||
|
||
30. NGINX / Unit (for specific apps)
|
||
|
||
31. Sphinx Documentation / internal docs
|
||
|
||
|
||
**Phase 6: Advanced / Specialized (Later)**
|
||
|
||
- Jenkins → Replace with Forgejo + Woodpecker CI (lighter)
|
||
|
||
- VyOS / OpenBSD (specific hardened routers/services)
|
||
|
||
- Spiffe/Spire, oVirt, DOCSIS 4 – only if you have a clear need
|
||
|
||
- Pasetbin, Webmin (low priority)
|
||
|
||
- Automatic security upgrades (Ansible + unattended-upgrades)
|
||
|
||
|
||
**Recommended Modern Lab Stack Summary (2026)**
|
||
|
||
- Hypervisor: Proxmox VE
|
||
|
||
- Firewall: OPNsense
|
||
|
||
- VPN: Netbird
|
||
|
||
- Proxy: Caddy
|
||
|
||
- Containers: Podman + Incus
|
||
|
||
- Monitoring: Netdata/Grafana + Loki
|
||
|
||
- Auth: Keycloak
|
||
|
||
- Storage: TrueNAS Scale
|
||
|
||
|
||
-----------------
|
||
|
||
OLD LISt
|
||
|
||
Pangolin CADDY
|
||
OPNSense / OpenWRT KEA DHCP IPV6 OpenVswitch
|
||
FreeIPA/FreeRadius/OIDC IPA Zitadel ID/KeyCloak/Authentik
|
||
KVM / Qemu / OpenVSwitch
|
||
AnsibleTerraform ANSIBLE
|
||
Kubernetes / LXConsole / Incus RANCHER / K3S / K8S / RKE / Portainer.io
|
||
XMPP
|
||
Podman, Buildah, Skopeo, Nomad DOCKER ALT., Portainer.io
|
||
FLECTRA/OODOO ERP
|
||
HA NFS / ZFS File Server TrueNAS
|
||
netboot.xyz / DistroBox NETBOOT, iPXE (DRBL,Clonezilla)
|
||
Jenkins
|
||
|
||
Sphinx Documentation
|
||
JELLYFIN Navidrome Sonarr Radarr Streamyfin
|
||
PEERTUBE PEERTUBE & JITSI
|
||
Suricata/SNORT/Graylog GRAYLOG / Uptime Kuma
|
||
Graphical Metrics GRAFANA Loki / PROMETHEUS /Alert Mgr.
|
||
DOCSIS 4
|
||
NextCloud
|
||
Ovirt
|
||
Devops CNCF Flux / Renovate Bot
|
||
Object Storage MINIO
|
||
NGINX / Gunicorn / Django UNIT,containerd, WASM, APACHE
|
||
EMAIL EXIM GITEA SERVER EMAILS
|
||
PostgreSQL PGADMIN4
|
||
Automatic Upgrades ? Disable Automatic
|
||
AWS Quickstart / AsciiDoc
|
||
Discourse
|
||
EtherPad
|
||
HomeAssistant
|
||
Matrix Chat
|
||
NGINX / UNIT UNIT WASM, APACHE
|
||
ntopng
|
||
pasetbin
|
||
Spiffe Spire BoKS/Keon
|
||
Suricata/SNORT/Graylog
|
||
VEOS VectorEngine NEC
|
||
VyOS and OpenBSD
|
||
wiki.js JS WIKI / MediaWIKI
|
||
Wireguard Nginx Proxy Manager
|
||
CertManager Mesh Central
|
||
QbitTorrent Remotely
|
||
Invoice Ninja Guacamole Remote access
|
||
Webmin Netbird Wireguard VPN
|
||
pikvm MediaWiki
|
||
Technitum DNS
|
||
Netbird VPN, Wireguard
|
||
immich photos
|