Services: What Runs Where and How It’s Exposed

Concrete list of what I run, which host/VM it’s on, and how nginx and TLS are configured.

Reverse proxy (nginx) — HA pair

• Keepalived MASTER (Proxy Host): Bare-metal Ubuntu in the network closet. Holds the VIP under normal operation. Runs nginx, keepalived, certbot, fail2ban, UFW. DDNS updater starts via keepalived notify when this node holds the VIP.
• Keepalived BACKUP / config primary (nginx VM on Desktop Host): Ubuntu VM. Assumes VIP when the Proxy Host fails. Runs nginx, certbot, keepalived, inotify-based config sync to the Proxy Host, and DDNS when it holds the VIP.
• Config: Homelab vhosts live in per-service files under conf.d/ (e.g. homepage.conf, vaultwarden.conf, plex.conf, uptime-kuma.conf). Main nginx.conf handles process/events/http, TLS defaults (1.2/1.3, modern ciphers), and include conf.d/*.conf.
• Sync: Config and cert sync from config primary (nginx VM) to the Proxy Host is active (inotify-based). Either node can hold the VIP and serve all traffic.

nginx documentation · keepalived

DNS — Pi-hole × 3 (synced)

• Instance 1: Docker container on the Docker VM on the Desktop Host (network_mode: host; web admin proxied at e.g. pihole01.detellem.com, LAN-only via nginx allow/deny).
• Instance 2: Docker container on the NAS Host (same IP as the NAS, different port). Proxied at e.g. pihole02.detellem.com, LAN-only.
• Instance 3: Docker container on the Proxy Host (network_mode: host). Proxied at e.g. pihole03.detellem.com, LAN-only.

Three Pi-holes plus one Google DNS fallback are in the DHCP “DNS servers” list. Nebula Sync replicates config from the primary to both replicas every 15 minutes. Pi-hole admin is not exposed to the internet; nginx returns 403 for those LAN-only hostnames.

Pi-hole docs · Nebula Sync

Main landing — Homepage

• Where: Docker container on the Docker VM (Desktop Host).
• Role: Dashboard with links to all my services (Plex, Vaultwarden, Mealie, etc.). Served at the root domain and at www, home, dashboard, homepage subdomains (one nginx server block, same backend).
• Config: YAML for widgets and services; I version the config in the homelab repo and mount it into the container.

gethomepage/homepage

Plex

• Where: Desktop Host (Windows), not in a VM — same machine as Hyper-V and Ollama.
• How it’s exposed: plex.detellem.com through nginx (TLS at the proxy) to the Plex port on the Desktop Host.
• Media: Libraries on the NAS Host over SMB; RTX 3070 for hardware transcoding.

Plex · Jellyfin (alternative)

Vaultwarden (password manager)

• Where: Single Docker container on the Docker VM (Desktop Host). Vaultwarden is a lightweight Rust reimplementation of the Bitwarden server API (~50MB RAM, SQLite database).
• Exposed as: bitwarden.detellem.com. Client max body size increased in nginx for attachments. Works with all official Bitwarden clients (iOS, Android, browser extensions, desktop, CLI).
• Data: SQLite database and file attachments; automated nightly backups to NAS Host, encrypted at rest with GPG (AES-256 symmetric).

Vaultwarden · Vaultwarden Wiki

Paperless-ngx (document management)

• Where: Docker on the Docker VM (Desktop Host). Five containers: main application (web UI + consumer + celery workers), Redis (task queue), PostgreSQL (metadata), Gotenberg (office → PDF), and Tika (content extraction).
• Exposed as: paperless.detellem.com. OCR, full-text search, automatic tagging, and correspondent detection.
• Storage: Document media (originals + archive) on the NAS Host via NFS mount. PostgreSQL data in a local Docker volume. Consumption folder auto-imports any file placed in it.

Paperless-ngx

Mealie (recipes)

• Where: Single Docker container on the Docker VM. One port mapped on the host.
• Exposed as: recipes.detellem.com and mealie.detellem.com (same server block).
• Data: Docker volume; backed up nightly to NAS Host.

Mealie

Donetick (chores)

• Where: Docker container on the Docker VM.
• Exposed as: chores.detellem.com and donetick.detellem.com.

Donetick · donetick.com

IT-Tools

• Where: Docker container on the Docker VM. Stateless.
• Exposed as: it-tools.detellem.com.

CorentinTh/it-tools

ConvertX (file conversion)

• Where: Docker container on the Docker VM. Needs a larger client_max_body_size in nginx for uploads (e.g. 1G).
• Exposed as: xconvert.detellem.com and convertx.detellem.com.

c4illin/convertx

OpenWebUI (LLM chat)

• Where: Docker container on the Docker VM (Desktop Host). Backend: Ollama running on the Desktop Host Windows machine using the NVIDIA RTX 3070.
• Exposed as: ai.detellem.com, llm.detellem.com. Built-in auth (email/password); WebSocket and streaming-safe nginx config. (chat.detellem.com was repurposed for Stoat Chat — see below.)

Open WebUI · Ollama

Stoat Chat (self-hosted Discord alternative)

• Where: Dedicated Ubuntu VM on the Desktop Host (Hyper-V). 15 containers (API, web frontend, voice via LiveKit, MongoDB, file storage via MinIO, message broker via RabbitMQ, etc.).
• Exposed as: stoat.detellem.com and chat.detellem.com. nginx reverse proxy for HTTP/WebSocket; nginx stream proxy for LiveKit voice/video (TCP + UDP). Invite-only registration; CincySMP-branded frontend (custom CSS theme, wordmark, and favicon injected via volume mounts).
• Backups: Automated daily (MongoDB dump, MinIO data, config) to NAS Host; 7 daily + 4 weekly retention.

Stoat Chat / Revolt

Minecraft (game server + landing page)

• Where: Dedicated Ubuntu VM on the Desktop Host (Hyper-V). Not a Docker container — runs as a native systemd service with its own 6 vCPUs and 32GB RAM.
• Exposed as: cincysmp.detellem.com on port <MINECRAFT_PORT> (raw TCP, not HTTPS). Nginx’s stream module on the Proxy Host forwards the connection and passes the real client IP via PROXY protocol.
• Landing page: A separate Docker container on the Docker VM serves cincysmp.detellem.com over HTTPS — an Astro static site with server status, resource pack download, and server info. nginx routes HTTP traffic to the landing page and TCP game traffic to the Minecraft VM.
• Security: Mojang authentication (online-mode), whitelist-only, fail2ban connection-flood jail on the proxy, UFW on the VM allowing only the proxy IP.

PaperMC

Uptime Kuma (monitoring)

• Where: Docker container on the Docker VM (Desktop Host).
• Exposed as: status.detellem.com and uptime.detellem.com (LAN-only via nginx allow/deny).
• Role: HTTP/HTTPS uptime checks, status dashboard, and alerting for service downtime.

Uptime Kuma

NAS Host

• Where: Dedicated machine. Ubuntu + ZFS (RAIDZ1 on 4×8 TB). Not exposed through the reverse proxy to the internet. SMB shares are used by the Desktop Host and other devices. Datasets hold media, backups, and container data. Pi-hole 2 runs as a Docker container on the same host.
• Role: Central storage and backup target for the entire homelab.

Ubuntu Server · OpenZFS

Summary table

← Network | Back to index | Next: Monitoring →