Charlie HarmanCH3
Project indexPrivate system

Case study · 2026–present

Homelab

A 24/7 Ubuntu server at home running nearly 30 Docker containers, including a media server for family and friends and the backend for Howie Helper.

No public source or live link
~30
Docker containers on one server
0
open router ports
Nightly
backups, kept for 30 days

01 · Overview

Role
Hardware, networking, and operations; scripts AI-assisted with Claude Code
Status
Running 24/7 · since Jan 2026
Privacy
Private system

From real constraint
to working system.

The challenge

I wanted to run real services for real people (a media server for my family and friends, file sync for me, and the backend for my store's scheduling app) without paying for cloud hosting or opening my home network to the internet.

The response

I run everything on one Ubuntu server, a Ryzen 7 3700X with 64 GB of RAM and an RTX 2080 Super, with services grouped in Docker. Monitoring and backups are in place, so I usually hear about a problem from my phone before anyone else notices it.

  • Ubuntu
  • Docker
  • Tailscale
  • Cloudflare Tunnel
  • Pi-hole
  • Ollama
  • MLX
  • Uptime Kuma
How it's laid outAn illustration of the layout. No real hostnames, addresses, or services are shown.

02 · Build

What the system needed.

Homelab features and engineering decisions

01

Services

What actually runs on it

About a dozen containers make up the media stack, with GPU transcoding for family and friends. A dozen more run the self-hosted Supabase backend behind Howie Helper. The rest are personal and operational tools.

  • Jellyfin media server with GPU transcoding
  • Self-hosted Supabase (Postgres, auth, REST API) and PowerSync for Howie Helper
  • Nextcloud, Pi-hole DNS for the home network, and Ollama with 4–8B models on the GPU
  • Separately, my M1 Pro MacBook runs larger models and Qwen image generation through MLX
02

Access

No open ports

Admin pages listen only on the server and get HTTPS through Tailscale. The two things that need to be public go out through Tailscale Funnel and a Cloudflare Tunnel, so the router has no ports forwarded.

  • Tailscale with MagicDNS and HTTPS for admin and personal access
  • Cloudflare Tunnel for howiehelper.app
  • Tailscale Funnel for the media server
03

Operations

Monitoring, backups, and runbooks

Uptime Kuma checks services and sends phone alerts, Scrutiny checks disk health every hour, and the server alerts my phone when it shuts down or boots. Backups run nightly. I've done one partial restore test (the Nextcloud database); a full-server restore hasn't been tested yet, and there's no offsite copy yet.

  • Uptime Kuma with ntfy phone alerts, plus Scrutiny for disk health
  • Nightly backups kept 30 days on two separate drives
  • 14 written runbooks for routine fixes
04

Fixes

Problems I actually hit

Most of what I've learned came from things breaking. These are a few of the fixes.

  • A start-up script crashed partway through, so 7 of 12 service groups silently never came up after a reboot
  • My phone lost DNS away from home because Tailscale was sending it to Pi-hole, which only works on the home network
  • Moved the data drives from USB to SATA and combined them into one pool, keeping databases off it

03 · System

Boundaries before boxes.

Sanitized system architecture

Conceptual architecturesanitized / not to scale
  1. 01Tailscale & Cloudflare Tunnel
  2. 02Docker service groups
  3. 03Ryzen 7 / 64 GB / RTX 2080 Super
  4. 04Monitoring & alerts
  5. 05Nightly backups
This intentionally high-level view communicates system boundaries without exposing infrastructure details.

04 · Views

Designed representations.

Health at a glanceAn illustration of the monitoring view. No real metrics are shown.

05 · Outcomes

A stronger operating baseline.

  1. 01

    Family, friends, and my store's app depend on it every day.

  2. 02

    I get problems from phone alerts and runbooks instead of from people telling me something is down.

  3. 03

    Next steps are an offsite backup and a full restore test.