The Home Lab
A home network that deliberately mirrors a corporate one: segmented VLANs, SSO on everything, full virtualisation, and no published inbound ports.
It started in late 2022 as two stand-alone ESXi NUCs and a stated goal: be as secure as possible, because someone in information security should practise what they preach. It grew into a full vSphere stack for customer demos, then moved to Proxmox with Proxmox Backup Server. Networking consolidated from three management planes onto an all-UniFi estate, and every service sits behind Authentik single sign-on and a Cloudflare Tunnel with nothing exposed inbound.
Goals
The build log from the start lists them plainly: be as secure as possible, learn Docker, WebAuthn, OAuth and SAML hands-on, keep running costs down with cheap or free tooling, and replicate corporate-grade segmentation, visibility and single sign-on with a SIEM as the end goal.
The stack
| Layer | What is in it |
|---|---|
| Compute | Intel NUC11PAHi7 with 64 GB RAM, NVMe plus 2 TB SATA; Asus PN61 i7 with 32 GB; Raspberry Pi 4s |
| Hypervisor | ESXi, then vSphere under a VMUG Advantage licence for demos, now Proxmox VE with Proxmox Backup Server |
| Storage | Synology NAS for files and the Immich photo stack |
| Network | UniFi Dream Router, main and office switches, Flex Minis, UAP-AC-Pro, U6+ and a mesh AP, with VLAN segmentation and remote syslog |
| Power | USB UPS exposed over the network with NUT and automatic shutdown |
| Guests | DietPi for Pi-hole and Homebridge, minimal Debian for Docker hosts, Windows Server and Windows 10 for demo labs |
| Containers | Docker Compose managed through Portainer, plus Cosmos Server with a private marketplace |
| Identity | Authentik with Postgres and Redis; Nginx Proxy Manager with wildcard certificates |
| Services | Wiki.js backed by self-hosted GitLab, Guacamole, Pi-hole, LibreNMS, Homarr, Immich, InfluxDB, Actual Budget, Home Assistant, Sonos, UniFi Protect |
| Edge | Cloudflare Tunnel for inbound, Workers for public hosting, WARP for device enrolment |
Single sign-on everywhere
WordPress, Portainer, Wiki.js and Guacamole through OAuth2 or OIDC. Pi-hole and Homarr through proxy auth in front, with the local admin login removed. LibreNMS through OIDC via Socialite, which was the hardest of the lot and needed a PHP upgrade. Each integration is written up in the build log with what worked first time and what did not.
The blog that documents it
The build log itself was WordPress and MariaDB running inside the lab, which meant a database, PHP and a public attack surface just to serve a handful of posts. In 2026 it was exported, converted to Markdown and rebuilt as a static Astro site on a Cloudflare Worker with every original permalink preserved. See the JDWLab blog project.
Patterns
Every project in the lab shares a few habits: back up before destroying, express configuration as reviewable files rather than clicks, and write down why a setting exists. The NUT installer timestamps a backup of the config directory before touching it. The Stream Deck layout is generated from code and backs up the Companion database first. The blog's URL structure is validated by a regex in both the content schema and the CMS. Small things, consistently.
Screenshots
