Skip to content

🏠 Hasaam's Homelab

Documentation for everything I self-host: a NAS appliance (ShiNAS), a repurposed laptop (ShineoriServer), and lab VMs on my Windows PC.

flowchart LR
    subgraph ShiNAS
        A[Identity & security]
        B[Media]
        C[Apps]
        D[Game servers]
    end
    subgraph ShineoriServer
        E[Minecraft]
        F[Local AI]
        I[Immich ML]
        J[Monitoring & dashboard]
        K[Light apps]
    end
    subgraph Windows PC
        G[Security labs]
        H[The Forest]
    end

Full write-ups with architecture, security decisions, troubleshooting and lessons learned:

Write-up Highlights
🌐 Cloudflare Tunnel Zero open ports, a security audit of my own setup (5 findings, all fixed), Zero Trust gate on the NAS admin panel
🔐 Authentik SSO Self-hosted identity provider, passwordless passkeys, OIDC into my apps
🛡️ auditd + Discord alerts Kernel-level audit rules mapped to attacker goals, real-time alerting through an auditd plugin I wrote
🔑 Vaultwarden Self-hosted password manager with a zero-knowledge design; found and closed open public sign-ups, now invite-only
🚚 Moving services off the NAS Diagnosed a RAM-starved NAS and moved 6 services to a second server, including Docker volume migrations, a broken host VPN, a dead image registry and a damaged image
📸 Immich Multi-container photo platform: ML face recognition, vector smart search, SSO through Authentik

Services

Status legend

Status Meaning
🟢 Running Live and in daily use
🟡 In progress Being built or still being configured
🔵 Planned Researched and on the roadmap, not built yet
⚫ Retired Shut down, kept here for the write-up and lessons learned
⏸️ On demand Installed and working, but only started when I need it

Security & identity

Service Host Status What it does
Authentik ShiNAS 🟢 Single sign-on and identity provider for the lab
Vaultwarden ShiNAS 🟢 Self-hosted Bitwarden server for passwords, TOTP and passkeys
auditd + Discord alerts ShiNAS 🟢 Host-level audit logging with real-time Discord webhook alerts

Networking & monitoring

Service Host Status What it does
Cloudflare Tunnel ShiNAS 🟢 Publishes selected services to the internet with no open ports
Omada Controller ShiNAS ⏸️ Manages TP-Link Omada network gear
Homarr ShineoriServer 🟢 Dashboard / home screen for every service
Diun ShiNAS + ShineoriServer 🟢 Watches every container image and pings Discord when a new stable version ships
Uptime Kuma ShineoriServer 🟢 Uptime monitoring and alerts for every service

Media

Service Host Status What it does
Jellyfin ShiNAS 🟢 Media server for movies and shows
Immich ShiNAS 🟢 Self-hosted Google Photos replacement
*arr stack ShiNAS 🟢 Prowlarr + arr apps + qBittorrent routed through gluetun/ProtonVPN
qBittorrent (standalone) ShiNAS ⏸️ Separate qBittorrent instance with tracker-specific rules
Audiobookshelf ShiNAS 🟢 Audiobook and podcast server

Apps

Service Host Status What it does
Dawarich ShineoriServer 🟢 Self-hosted location history (Google Timeline replacement)
Flowcase ShiNAS ⏸️ Browser-based isolated workspaces (Kasm-style), routed through ProtonVPN
Ghiro ShineoriServer ⏸️ Image forensics web app
Paperless-ngx ShiNAS 🟢 Scans, OCRs and organizes documents so they're searchable
Karakeep ShineoriServer 🟢 Self-hosted bookmark and read-it-later manager

Game servers

Service Host Status What it does
Terraria (tModLoader) ShiNAS ⚫ Modded Terraria server for friends, public via playit.gg
Minecraft + playit ShineoriServer 🟢 Minecraft server with playit.gg tunnel
The Forest dedicated server Windows PC ⚫ Vanilla The Forest dedicated server reached over Tailscale

AI

Service Host Status What it does
Ollama + Open WebUI + SearXNG ShineoriServer 🟢 Local LLM stack with private web search
Hermes Agent ShineoriServer 🟢 Local AI agent that reads release notes and posts update verdicts in Discord, behind layered guardrails

Security labs

Service Host Status What it does
Pentesting lab Windows PC 🟢 Attacker/target lab for practicing offensive security legally
OPNsense router lab Windows PC 🟢 Virtual OPNsense router in VMware Workstation Pro, rehearsal for a NUC router
EVE-NG Windows PC 🟡 Network emulation lab (Community Edition)

Web

Service Host Status What it does
Terminal resume site ShiNAS 🟢 Interactive terminal-style resume served from NGINX in Docker

Infrastructure