Homelab

This project represents the backbone of my personal infrastructure. It is an ecosystem of interconnected machines and self-hosted services, designed for the deployment of applications, media streaming, and secure data storage, all orchestrated to bypass network restrictions imposed by the ISP (CGNAT) through an advanced Mesh VPN.

Architecture and Cluster Nodes

1. Main Server (ZimaBlade 7700)

The operational heart of the Home Lab is based on the ZimaBlade 7700 with 16GB of RAM, running the native ZimaOS system.

• Storage Tiering: System divided between an ultra-fast 1TB M.2 NVMe dedicated to the system and Docker containers, combined with two 8TB NAS HDDs (in RAID 1 for total data redundancy managed by ZimaOS).
• Core Services:
  • Seafile: File sync between my devices and the server. It replaced Nextcloud, which was too heavy.
  • Jellyfin & Arr Suite: Multimedia streaming assisted by automations like Radarr/Sonarr and Prowlarr/qBittorrent.
  • Immich: Archive for my personal photos.
  • FranzPLAY: Custom web platform for video streaming, developed for managing and playing personal media content.

2. Secondary Server (Raspberry Pi 4)

Runs the light, always-on services, on Debian 13 with rootless Docker, managed through Portainer.

• Core Services:
  • SiYuan: My personal wiki, with notes and documentation for the whole lab.
  • Homepage: A dashboard with every service at a glance.
  • Geek Country: A Laravel + Vue eCommerce site in production.

3. Gateway, Reverse Proxy and NetBird VPN (VPS)

Since the home router cannot open ports (ISP Ehiweb/CGNAT limitations), all nodes communicate externally through a server in Switzerland (Infomaniak VPS). The VPS acts as a network bridge, running self-hosted NetBird:

• NetBird mesh VPN: The VPS hosts the NetBird server: dashboard, node management and built-in login, all on my own domain. ZimaBlade, Raspberry, PC and VPS talk to each other peer-to-peer over WireGuard tunnels, on a private network with hand-picked addresses.
• Relay on the VPS: When a direct P2P connection fails, traffic goes through the NetBird relay on the Swiss VPS, not through public servers.
• Built-in reverse proxy: Public services under franzpage.it go through the NetBird proxy, with Traefik in front and Let’s Encrypt certificates. The proxy reaches the home containers inside the tunnel: no ports are opened at home.
• Group-based access: Policies decide which devices can see each other. Without a rule, traffic between nodes is blocked.
• First Headscale, now NetBird: The first version used Headscale + Tailscale, with a custom DERP relay and Nginx Proxy Manager. I moved to NetBird because it lets me assign node IPs from the dashboard and already includes a reverse proxy, group policies and SSH.

Every single service in the lab, from the front-end to databases, is containerized on Docker, ensuring seamless migrations and zeroing out dependency conflicts.