My Home Lab Journey: Start Here

By Anas Semesmieh · April 12, 2026

Anas in a cyberpunk home server room surrounded by holographic Docker containers and matrix code

My homelab: where weekend curiosity meets production-grade thinking.

As a platform engineering leader, I spend my weekdays designing cloud architectures and scaling teams. On weekends, I run a homelab — not because I have to, but because it keeps my hands dirty and my instincts sharp. This series documents everything I've built, broken, and automated along the way.

Every config, script, and runbook referenced in this series is open source in my homelab repo.

What I Run

Cyberpunk home server room with Docker, Traefik, Plex, Home Assistant and Grafana holographic dashboards

The full stack — 9 services, one host, zero compromises.

My homelab is a single Ubuntu Server host running everything via Docker Compose. Here's the full stack:

Traefik — Reverse proxy with a self-signed wildcard TLS certificate (*.homelab) from a local CA
Pi-hole — DNS server and ad blocker, serving as the network's primary DNS
Plex — Media server for movies and TV
Tautulli — Plex monitoring and analytics
Arr Stack — Prowlarr, Radarr, Sonarr, qBittorrent, and Gluetun (WireGuard VPN) for media acquisition
Immich — Self-hosted photo backup with PostgreSQL
Home Assistant — Home automation hub
Homepage — Dashboard with live widgets pulling stats from every service
Glances — System metrics (CPU, memory, network, disk)

The Backup-First Philosophy

Cyberpunk vault with matrix data streams, glowing backup drives, and redundant storage nodes

Three copies, two media types, one offsite — always.

Before I ran a single container, I set up backups. Everything in my homelab follows the 3-2-1 rule: the centerpiece is an automated backup system where my repo is the source of truth for all configuration. Every day at 03:25 UTC, a cron job:

Syncs allowlisted config files from ~/ into configs/ using an inventory file
Redacts every password, API key, and token automatically via regex patterns
Scans for any unredacted secrets — and blocks the push if anything slips through
Commits and pushes the sanitized snapshot to GitHub

Every Sunday, a weekly snapshot tag (backup-YYYY-MM-DD) is created for point-in-time recovery. The entire setup can be rebuilt from zero using the repo's fresh-install and restore runbooks.

Why This Matters for My Career

Platform engineer in a neon-lit command center reviewing architecture diagrams with matrix code streams

Battle-testing at home so the real systems don't become the test.

Running this lab forces me to practice what I preach: infrastructure as code, automated pipelines, secret management, disaster recovery, and documentation-first operations. When I advise teams on platform engineering practices at work, I've already battle-tested those patterns at home — on my own weekends, with my own hardware.

What This Series Covers

Automated Config Backup with Secret Redaction — The daily/weekly backup pipeline that keeps my configs safe and secrets out of Git
Docker Compose All The Things — Running 10+ services on a single host with Traefik, Pi-hole, and internal TLS
Disaster Recovery in Under an Hour — Fresh-install and compose-based restore workflows
Secrets Management for Homelabs — Redaction, scanning, rehydration, and rotation practices
Single Sign-On with Authentik — Forward-auth, OIDC, MFA, and Cloudflare Tunnel for external access