Robin Miller

Family and friends use my services every day — so the lab runs in production, around the clock. If something goes down, I quickly have enough people on the phone complaining. At the same time it's my laboratory: it's where I try technologies before I take them seriously.

Cluster

2 × Proxmox VE + quorum device

Services

30+ self-hosted

Backup

Proxmox Backup Server, versioned

Docs

100% as a Git repo (docs as code)

• Two-node cluster with an external quorum device — one node can fail without the cluster losing its majority
• Direct Thunderbolt link between the nodes — replication and live migration run over a dedicated, very fast connection instead of the regular network
• Segmented network: separate VLANs for infrastructure, services, clients, DMZ and IoT
• No open ports at home — external services pass through a VPS (Pangolin with Traefik as reverse proxy, CrowdSec as WAF) and from there through an encrypted WireGuard tunnel; internally, Caddy distributes the traffic
• Dedicated firewall (OPNsense) with strict rules between segments
• Two paths, one repo: Debian hosts run their services as Docker Compose stacks rolled out by Ansible — NixOS hosts are declared entirely as a flake and rebuild themselves on every push
• Updates by a fixed policy: operating systems unattended in the maintenance window, app updates batched after approval
• AI agents as team members: planning, implementation and review in separate roles, every change traceable as a commit
• Secrets stored encrypted only (SOPS / age)
• Monitoring & alerting for services, disks and backups — alerts arrive as push notifications on my phone

Three short excerpts from my homelab repository — rewritten and anonymized for publication, but true to structure and style. Expand to read.

- name: Update LXC containers in controlled batches
  hosts: lxc_all
  serial: 5
  tasks:
    - name: Apply pending upgrades
      ansible.builtin.apt:
        update_cache: true
        upgrade: dist

    - name: Health check — compose stack still running?
      ansible.builtin.command: docker compose ps --status running -q
      args:
        chdir: /opt/{{ service_name }}
      register: health
      changed_when: false
      failed_when: health.stdout == ""

    - name: Hold host for manual review instead of rolling on
      ansible.builtin.file:
        path: /var/lib/updates/hold/{{ inventory_hostname }}
        state: touch
      when: health is failed

# hosts/webapp01.nix — the whole host, declared in one file
{ config, ... }:
{
  imports = [ ../modules/lxc-base.nix ];   # hardening, SSH keys, updates

  networking.hostName = "webapp01";
  networking.interfaces.eth0.ipv4.addresses = [
    { address = "192.0.2.10"; prefixLength = 24; }   # documentation range
  ];

  services.nginx = {
    enable = true;
    virtualHosts."webapp.example.org".root = "/srv/webapp";
  };

  # only what is declared is open — everything else is dropped
  networking.firewall.allowedTCPPorts = [ 80 ];

  # secrets are decrypted on the host at activation, never stored in git
  sops.secrets."webapp/token".owner = "nginx";
}

endpoints:
  - name: webapp
    group: services
    url: "https://webapp.example.org/health"
    interval: 2m
    conditions:
      - "[STATUS] == 200"
      - "[RESPONSE_TIME] < 1500"
      - "[CERTIFICATE_EXPIRATION] > 168h"   # a week's warning
    alerts:
      - type: ntfy
        failure-threshold: 3    # one hiccup is not an incident
        success-threshold: 2
        send-on-resolved: true

alerting:
  ntfy:
    url: "https://ntfy.example.org"
    topic: "homelab-alerts"
    priority: 4

1. 01 Simple beats clever

   At work

   The simplest solution that actually solves the problem is the most stable one — fewer moving parts means less that can break at 3 a.m.

   In the homelab

   Only a stable homelab is a good homelab. A simple solution that runs every day beats the clever one that covers a niche and breaks every week — or that I no longer understand myself a year later.

2. 02 Consistent, not one-off

   At work

   Identical systems are built identically: clients and servers get their settings centrally via Group Policy, and the network is rolled out from uniform templates through the LANCOM Management Cloud. That way everyone on the team understands every device, and deviations stand out immediately.

   In the homelab

   Fixed conventions for names, networks and deployments; an exception is a deliberate, documented decision, never something that just grew.

3. 03 Emergency plans get rehearsed

   At work

   An emergency plan is only worth something once it has been tested — I push for that, even when it takes a discussion.

   In the homelab

   A change only counts as done once it's proven to work live. I try out backups and failover instead of trusting them.

4. 04 Every change needs a way back

   At work

   Patches and changes go through testing, approval and a documented rollback plan.

   In the homelab

   A snapshot or backup before every intervention — and every change is a Git commit that can be reverted.

5. 05 Security from the start

   At work

   Firewalls, segmentation, DMZ and SIEM are part of the design for me, not an afterthought.

   In the homelab

   No open ports at home, minimal privileges per service, secrets encrypted only.

6. 06 Stay calm when things break

   At work

   During an incident: overview first, then priorities, then communication — things get hectic on their own.

   In the homelab

   Alerts arrive as push notifications; solved problems become a troubleshooting entry so they only hurt once.