personal/2026-In-Progress-List.md

Git, Gitea, Bind9, Postgres, Nginx and other python app and html web servers running in KVM for initial control. Here's my re-prioritized and optimized version of my in-progress list. I re-ordered it from foundational → infrastructure → security/monitoring → services (the way most stable labs are built). Suggested better or more modern alternatives where they make sense for a typical lab/self-hosted environment in 2026.

Phase 1: Base & Networking (Must be first)

1. OPNsense (or OpenWRT on edge devices)
   → Best open-source firewall/router today. Great UI, Zenarmor, WireGuard, etc.

2. KVM/QEMU + Open vSwitch (or Proxmox VE as a full stack)
   → Proxmox is usually the smarter choice for most people unless you specifically want to stay ultra-minimal.

3. WireGuard + Netbird (or Tailscale/Headscale)
   → Modern zero-trust mesh VPN. Netbird is excellent.

4. Technitium DNS (or AdGuard Home + Unbound)
   → Very solid self-hosted DNS + DHCP + blocking.

5. piKVM (or alternatives like TinyPilot)
   → Great for remote management of bare-metal machines.

Phase 2: Identity, Storage & Orchestration

6. FreeIPA (or Keycloak + Authelia/Zitadel for OIDC)
   → FreeIPA is heavy but powerful if you want full LDAP/Kerberos. Many people now prefer lighter OIDC stacks.

7. TrueNAS Scale (or plain ZFS + Samba/NFS on Debian)
   → Best file server experience. NFS + ZFS snapshots + replication.

8. Ansible + Terraform (IaC)
   → Keep this early — it will make everything else reproducible.

9. Podman + Buildah + Skopeo (rootless) + Quadlet
   → Better than Docker for security. Skip full Kubernetes unless you really need it.

10. Incus (or LXC/LXD) + Proxmox
    → Incus is the spiritual successor to LXD and very nice for lightweight containers/Vms.

Phase 3: Core Services & Monitoring

11. Caddy (or Traefik / Nginx Proxy Manager)
    → Caddy is fantastic with automatic HTTPS.

12. PostgreSQL (primary DB)

13. Nginx / Unit (as application server where needed)

14. Cert-Manager (or use Caddy’s built-in ACME)

15. Prometheus + Grafana + Loki (or Netdata + Uptime Kuma)
    → Graphical metrics. Loki + Grafana is a strong combo.

16. Graylog or VictoriaLogs + Netdata (or Zabbix/OBS)
    → Logging stack.

17. ntopng (traffic monitoring)

18. Suricata (or CrowdSec + Fail2Ban)
    → IDS/IPS. CrowdSec is much easier for homelabs.

Phase 4: Applications & Self-Hosted Services

19. Nextcloud (or ownCloud Infinite Scale)

20. Immich (photos) — excellent choice

21. Jellyfin + Navidrome (music)

22. Home Assistant

23. Matrix (Synapse or Dendrite) + Element

24. PeerTube

25. Discourse (forum)

26. Etherpad or Hedgedoc

27. Wiki.js (or Bookstack / DokuWiki)

28. Invoice Ninja

29. qBittorrent (or Jellyseerr + *arr stack if you go that route)

30. Odoo (or Dolibarr / ERPNext) — lighter alternatives exist

Phase 5: Nice-to-Haves / Advanced

• XMPP (e.g. Prosody + Snikket) — low priority unless you have specific need

• Sphinx documentation

• Pasetbin (or Pastefy, PrivateBin)

• Webmin — mostly replaced by Cockpit / Portainer / custom Ansible

• VyOS — good for advanced routing but OPNsense usually suffices

• OpenBSD — great for specific hardened services

• Jenkins — consider Woodpecker CI, Forgejo Actions, or Gitea/Forgejo + Drone instead (lighter)

• Spiffe/Spire — overkill for most homelabs

• DOCSIS 4 — very niche

• oVirt — mostly replaced by Proxmox

• AWS Quickstart / AsciiDoc — not relevant unless you're doing cloud migration docs

• Automatic upgrades (use unattended-upgrades + Ansible)

Quick Wins / Modern Stack Suggestion (2026)

• Hypervisor: Proxmox VE

• Firewall: OPNsense

• Containers: Podman + Quadlet (or Incus)

• Reverse Proxy: Caddy

• Auth: Keycloak or Zitadel

• Monitoring: Netdata + Grafana + Loki

• VPN: Netbird or Headscale

• DNS: Technitium

This ordering dramatically reduces pain. Build the foundation (networking + storage + IaC) first — everything else becomes much easier and more reliable.Would you like me to:

---

Here’s a realistic phased installation plan based on your list, reordered for stability, security, and dependency flow.

Phase 1: Foundation (Week 1 – Get the base rock-solid)

1. OPNsense (primary firewall/router)

2. WireGuard + Netbird (mesh VPN)

3. Technitium DNS

4. KVM/QEMU + Open vSwitch → Strongly consider Proxmox VE instead (much easier management)

5. piKVM (for bare metal remote access)

6. Ansible + Terraform (start writing playbooks early)

Goal: Reliable networking, remote access, and automation foundation.

Phase 2: Storage & Virtualization (Week 1–2)

7. TrueNAS Scale (or ZFS on Linux) – NFS + Samba shares

8. Incus (lightweight containers/VMs) or continue with Proxmox

9. Podman + Buildah + Skopeo (rootless container runtime)

Goal: Secure storage with snapshots + solid container/VM layer.

Phase 3: Identity, Security & Monitoring (Week 2–3)

10. Keycloak (or FreeIPA if you need full LDAP) + OIDC

11. Caddy (reverse proxy + automatic HTTPS)

12. Cert-Manager (if not using Caddy)

13. Prometheus + Grafana + Loki (metrics + logs)

14. Suricata + CrowdSec (IDS/IPS + modern blocking)

15. ntopng (network visibility)

Goal: Secure access, observability, and threat protection before exposing services.

Phase 4: Core Productivity Services (Week 3–4)

16. Nextcloud

17. Immich (photos)

18. PostgreSQL (primary database)

19. Home Assistant

20. Matrix Chat (Synapse/Dendrite + Element)

21. Jellyfin + Navidrome

22. Wiki.js

23. Discourse (if you want a forum)

Phase 5: Additional Services (Month 2+)

24. PeerTube

25. Invoice Ninja

26. qBittorrent (+ optional *arr stack)

27. Etherpad or Hedgedoc

28. Odoo (or lighter ERP like Dolibarr)

29. XMPP (Prosody/Snikket) – only if needed

30. NGINX / Unit (for specific apps)

31. Sphinx Documentation / internal docs

Phase 6: Advanced / Specialized (Later)

• Jenkins → Replace with Forgejo + Woodpecker CI (lighter)

• VyOS / OpenBSD (specific hardened routers/services)

• Spiffe/Spire, oVirt, DOCSIS 4 – only if you have a clear need

• Pasetbin, Webmin (low priority)

• Automatic security upgrades (Ansible + unattended-upgrades)

Recommended Modern Lab Stack Summary (2026)

• Hypervisor: Proxmox VE

• Firewall: OPNsense

• VPN: Netbird

• Proxy: Caddy

• Containers: Podman + Incus

• Monitoring: Netdata/Grafana + Loki

• Auth: Keycloak

• Storage: TrueNAS Scale

---

OLD LISt

Pangolin CADDY OPNSense / OpenWRT KEA DHCP IPV6 OpenVswitch FreeIPA/FreeRadius/OIDC IPA Zitadel ID/KeyCloak/Authentik KVM / Qemu / OpenVSwitch AnsibleTerraform ANSIBLE Kubernetes / LXConsole / Incus RANCHER / K3S / K8S / RKE / Portainer.io XMPP Podman, Buildah, Skopeo, Nomad DOCKER ALT., Portainer.io FLECTRA/OODOO ERP HA NFS / ZFS File Server TrueNAS netboot.xyz / DistroBox NETBOOT, iPXE (DRBL,Clonezilla) Jenkins

Sphinx Documentation JELLYFIN Navidrome Sonarr Radarr Streamyfin PEERTUBE PEERTUBE & JITSI Suricata/SNORT/Graylog GRAYLOG / Uptime Kuma Graphical Metrics GRAFANA Loki / PROMETHEUS /Alert Mgr. DOCSIS 4 NextCloud Ovirt Devops CNCF Flux / Renovate Bot Object Storage MINIO NGINX / Gunicorn / Django UNIT,containerd, WASM, APACHE EMAIL EXIM GITEA SERVER EMAILS PostgreSQL PGADMIN4 Automatic Upgrades ? Disable Automatic AWS Quickstart / AsciiDoc Discourse EtherPad HomeAssistant Matrix Chat NGINX / UNIT UNIT WASM, APACHE ntopng pasetbin Spiffe Spire BoKS/Keon Suricata/SNORT/Graylog VEOS VectorEngine NEC VyOS and OpenBSD wiki.js JS WIKI / MediaWIKI Wireguard Nginx Proxy Manager CertManager Mesh Central QbitTorrent Remotely Invoice Ninja Guacamole Remote access Webmin Netbird Wireguard VPN pikvm MediaWiki Technitum DNS Netbird VPN, Wireguard immich photos