Self-hosted infrastructure

Self-Hosted VPS Stack

A robust, dockerized environment running on a VPS RHEL (AlmaLinux 9). Features Nextcloud, Syncthing, Glances monitoring, WireGuard, and Cloudflare Tunnel. Built with security and maintainability in mind.

DockerLinuxApacheNextcloud

How I run it, in short:

  • Proxmox and Docker: GPU VM for media and sync, NAS (Samba), OpenWrt with AdGuard on the LAN.
  • Anything public goes through Cloudflare on the AlmaLinux VPS — not the home router.
  • Remote access over Tailscale; no SSH from the open internet.
  • The diagram is simplified; the next section is the honest zero-trust trade-offs.

Zero-trust posture and trade-offs

The home router does not terminate Cloudflare Tunnel for what I publish. Tunnel, Access policies, cloudflared and the Glances endpoint I expose all run on the remote VPS. Homelab traffic stays on Tailscale between PCs, the Proxmox GPU VM and the VPS. Syncthing uses that path instead of advertising on the public WAN.

Stateful services run in Docker per stack, including WireGuard on the GPU VM and the VPS. Recovery is mostly volumes and compose again, not bespoke local-only services. Backups land on the NAS VM and are copied to the VPS, so one site loss does not erase everything.

Pros and cons (honest)
ProsCons
No SSH or admin UIs on the home public IP — Tailscale is the gate.If Tailscale and Cloudflare both fail at once, remote admin and public ingress pause until one path is back.
Public HTTP(S) uses Cloudflare on the VPS with Access; home WAN stays closed.You trust two vendor control planes instead of classic public ports — a deliberate trade.
Docker stacks plus NAS and VPS copies keep restores predictable.Wrong Access rules or ACLs can lock you out until you fix them from a trusted device.
Split VMs shrink blast radius versus one big appliance.When the LAN is down, direct LAN access to some services stops too.