John Maguire

My Homelab in 2026

Who am I?

Before you read about my homelab, you might wonder .

Networking

I work for Defined Networking building managed Nebula networks, so naturally that is what I use at home. I make extensive use of Nebula’s default-deny firewall, using tags in DN to configure rules. I use these same tags for service discovery.

For example, Prometheus builds a list of scrape targets using the DN API.

[image?]

Hosting Services

Ansible / Terraform

I have a love-hate relationship with Ansible and Terraform. Writing infrastructure as code has some major benefits: it creates a record of environmental and configuration changes over time, it allows you to rebuild from scratch in the event of disaster, and it allows you to abstract and reuse patterns across hosts or other resources. On the other hand, writing Ansible playbooks is often slower and more error-prone than simply performing a task by hand. While this tradeoff certainly makes sense for production applications, I’m not entirely sure it makes sense for homelabs.

However, one of the primary reasons I run a homelab is to exercise and develop my skills as an engineer as well as to test and experiment with new tools in an active environment.

Incus

I am a big fan of Incus. I know that Proxmox is very popular in the homelab space, but the few times I tried using it I ran into a number of frustrations:

I tend to prefer keyboard-driven workflows, so when I discovered Incus, it looked like a perfect fit: a well-designed interface, resembling Docker, around both VMs and LXC containers (and now OCI too!) with support for remote servers and clustering.

After a bit over two years of using Incus at home, and recommending it to multiple friends and coworkers who now also singe its praises, I am happy to report that it has been a glowing success.

I started using Incus when I rebuilt my home server a couple years ago. A couple of months ago I also started renting a dedicated server in a local datacenter for improved uptime and latency to critical services - I run Incus here too.

Docker

While I like to run Incus on my physical servers as a “first layer of separation” for provisioning, I do still run most of my services in one kind of Docker container or another. This is mostly a legacy thing: my first server, Acheron, was just an Arch Linux-based server running Docker.

DNS

For my domain’s nameservers, I use Cloudflare DNS. It updates fast and has a decent Terraform provider.

I do not “proxy” my personal domains through Cloudflare - while I used to setup all of my websites to funnel through Cloudflare, out of a fear of DDOS (and perhaps greater availability in the event of an outage), a friend of mine eventually convinced me that the benefits are not worth the privacy tradeoff that comes with funneling the majority of the Internet’s traffic through Cloudflare’s servers.

That said, Cloudflare DNS is very fast and they have a decent Terraform provider, so I do still use them as my domain’s nameserver. (And full disclosure: I do use some Cloudflare services in some specific projects, where it makes sense to do so. For example, my personal image host.)

Hosted Services

SSO

I am currently using Authentik. I previously worked on SSO at Duo Security, so I have some opinions on this. Authentik is fulfilling my needs nicely. While there are some small annoyances to the UX of admin workflows via the UI (e.g. creating Application, Provider, and Outpost associations takes many clicks; or passkeys not automatically prompting when I first load the login page), I have found it to be remarkably feature-complete.

I usually integrate Authentik with OIDC authentication to any app which supports it, or using its built in proxy mode in conjunction with Traefik to restrict access to unauthenticated applications. Soon, I plan to investigate using its LDAP connector for Stalwart.

Traefik

Traefik is a crucial piece of my homelab infrastructure. Any Docker host exposing a public website gets a Traefik service in my homelab. Traefik is invaluable for hosting many services from a single IP and applying authorization controls (e.g. OIDC proxy auth and IP allow lists.)

In my environment Traefik listens on two IPs independently, each backing a separate Traefik “entrypoint”:

For highly sensitive infrastructure applications (such as Traefik itself, Prometheus, Grafana, etc.) I have the router listen only on the Nebula entrypoint

Komodo / Dokploy / Coolify / etc.

Coolify: UI/UX was kind of confusing. Seems to work pretty well. Dokploy: Tried this after seeing many people on Reddit, etc. had tried it and were moving from Coolify. Dokploy has a freemium model, and some of the features were lacking - for example, no auto-updates for Docker images. Trying to use this with Forgejo workflows, I had to manually call webhook URLs to kick off updates. Dockge: So maybe I just want visibility into my stacks and a simple editor. I tried Dockge, but similar to how I sometimes feel about Uptime Kuma, it’s almost too simple. Komodo: Then I heard about Komodo. Written in Rust, just released v2, support for multiple config stiles including “Files on Disk”, etc. [more detail]

Plex / Media Server

Immich

Linkding

Forgejo

Personal image host

Umami

Hardware

Demeter

Demeter is my home server / NAS. As much as I would love to run a fancy 4U rackmount server with ECC RAM, my drives alone are eye-wateringly expensive, so I have stuck with consumer-grade hardware for now.

This hardware was all purchased around 2023. The drives were $ X and the rest of the computer was $ X.

Hyperion

Hyperion is a dedicated server I rent in local datacenter. While services like Plex don’t need to be online 24/7, and it’s probably not a big deal if Immich or Linkding go down every now and then, I do really want to be able to count on my SSO, monitoring stack, and personal websites (such as this blog) being online.

I absolutely do not need such a beefy server for this, but running it this way is a lot of fun. Here are some beefy applications I have used it for:

Filesystem Choice

Fresh out of high school, I got a job at Barracuda Networks working on their Backup appliances. There, we generally ran xfs on mdadm - so when I built my first RAID array at home (on a server called Acheron), I leaned on mdadm for RAID. And I must say, it served me well for 7 years. mdadm has some nice properties:

These properties actually made it very attractive for my initial home RAID: I grew from a single disk in RAID 0, to a mirrored RAID 1, then to a 4-disk RAID 5, and finally an 8-disk RAID 6.

After my first disk failure, as I was going through the rebuild process, I was glad to have moved to RAID 6 after I saw Unrecoverable Read Errors (UREs) on a second disk! (Protip: You can run a home server in a closet with poor airflow, but if you do, you absolutely must keep an eye on your drive temperatures, especially in the heat of the summer…)

It was about this time in 2022 that I realized my server’s CPU was 10 years old, I could expect more drives to fail, and I was nearly out of space.

Why not btrfs for Incus?

I do wish ZFS (a) was better for DBs, and (b) could restore a snapshot that wasn’t the most recent, but [ bug link ] has improved the situation for SQLite and [… explain work around for (b)]

Backups