Edge & network
One front door. A hardened router and firewall, a reverse proxy with automatic TLS, and network intrusion detection that blocks known-bad addresses.
Self-hosted · Declarative · Open
A small constellation of servers, built in the open.
Hager Homelab is a personal lab of rack servers and small nodes that hosts apps, media, game servers and experiments for a household and a few friends. Every machine is described in code, every login goes through one identity, and nothing private faces the internet.
100%of hosts built from one Nix flake
1 loginwith MFA for every member service
0admin panels reachable from the internet
24/7metrics, alerts and outside probes
How it's put together
Six layers, one config repository
The lab is small, but it is built like production: layered, reproducible and watched. Here is the general shape. The specifics stay inside.
Identity
A single sign-on provider for apps and server shells. Accounts are invite-only, multi-factor is required, and access is granted by group.
Private access
Member and admin services answer only to the home network and the VPN. Members get a WireGuard tunnel and can add their own devices.
Compute
A mix of refurbished rack servers and small-form-factor nodes. Services run as containers; an app platform handles deploys and a panel runs game servers.
Storage & backups
Shared storage on the LAN, nightly database dumps, and secrets encrypted at rest in Git and rotated on a schedule.
Observability
Metrics and dashboards for every host, alerts that only fire when something needs fixing, and probes from outside the network to catch what the inside can't see.
Architecture
public traffic member traffic (VPN + SSO)
Principles
How the lab is run
Declarative everything
Hosts, services, firewall rules, dashboards and alerts are Nix code. If it isn't in the repo, it doesn't exist.
Private by default
A service is LAN- and VPN-only until there's a reason for it to be public. Public names don't mean public access.
One identity
One account and one second factor open everything a member is allowed to use, and removing access happens in one place.
Upgrade with a safety net
Nightly dependency updates, rehearsals on test instances for big jumps, and rollbacks that are one reboot away.
Watched, quietly
Lots of signals, few pages. Alerts are reserved for things a human actually needs to fix.
Built in the open
The configuration is public. Secrets are encrypted in a separate repository and never land in the public one.
The stack
Standing on open-source shoulders
The lab is glue around excellent upstream projects. Go give them a star.
Foundation
Edge & access
Identity & ops
Open source
Read the source, borrow the ideas
Everything that makes the lab tick is public on GitHub. Fork it, learn from it, or tell us what we did wrong.
nixos-configs
The flake behind every host: services, reverse proxy, identity, monitoring, dashboards and runbooks.
pterodactyl-wings-nix-overlayA Nix overlay that packages the game-server daemon for NixOS nodes.
ace-k80-stackBringing a vintage datacenter GPU back to life for local AI: drivers, CUDA and model serving as a flake.
blueprint-dns-recordsGame-panel extension that gives each server a friendly DNS name automatically.
blueprint-port-forwardGame-panel extension that opens and closes router port forwards as servers come and go.
blueprint-minecraft-toolsMinecraft helpers for the game panel.
Got an invite?
Set up your VPN and sign in for the first time in about ten minutes. The member guide walks you through every step.