Homelab
One small box doing a lot: a Proxmox VE host that runs my day-to-day services in Docker, with a disposable lab next door for security work. Small footprint on purpose — low power, quiet, and everything rebuildable.
Hardware & Hypervisor
NUC7i7BEH RAM: 32 GB Storage: 2 TB Why a NUC: it idles low, fits on a shelf, and 32 GB is enough to keep the services VM and a couple of lab boxes up at the same time. Proxmox on top means I can wipe a VM and clone a fresh one in minutes.
Second Node — Windows 11
A second Intel NUC NUC7i7BEH runs Windows 11 standalone — bare metal, no hypervisor. It covers the things that only make sense on a real Windows install: native tooling, Windows-side testing, and anything that does not virtualise cleanly. Kept as its own node so the Proxmox host stays a single-purpose hypervisor.
Edge & Network
The box sits behind an enterprise-grade UniFi Network ecosystem that handles routing, firewalling and wireless. Multi-tier VLANs keep IoT, guest, lab compute and core infrastructure apart, nothing is port-forwarded to the internet, and remote admin only happens over an encrypted WireGuard tunnel. Full breakdown on the security page.
Dual-Layer Ad & Tracker Blocking
Ad, tracker and telemetry blocking runs at two independent layers, so neither one is a single point of failure:
Why both: the UniFi blocker is always-on at the edge and survives anything happening inside the lab; AdGuard Home does the heavy lifting with custom filter lists, encrypted upstream resolution and query visibility. Devices that will never take a browser extension — TVs, IoT, phones on the guest SSID — get covered either way. See the security page for the DNS hygiene detail.
Core Services (Ubuntu Server VM)
A single Ubuntu Server VM runs everything I actually use day to day, as a Docker stack:
- Glance — dashboard; the landing page for the whole lab.
- Portainer — container management, logs and quick restarts without SSH.
- Immich — self-hosted photo storage; the reason the 2 TB matters.
- This site — the portfolio you are reading, served from the same stack.
- Discord bot — a custom bot of mine; small, always-on, easy to iterate on.
Why one VM: keeping the services in Docker on a single guest means one thing to back up, one thing to snapshot before an upgrade, and no service state scattered across the host.
Virtual Lab / Security
- Offensive — dedicated pentesting VMs, snapshot-heavy so a box can be reverted after every run.
- Defensive — Security Onion for monitoring and detection against lab traffic.
- Distro bench — assorted Linux VMs and containers for testing, comparing and breaking things.
Why it stays separate: the lab is meant to be broken. Keeping it off the services VM means an experiment can't take down the photos, the dashboard, or this page.