Skip to content
Back to Projects
Maintained
Tools
Open Source
Feb 2026

pi-lab

A self-hosted homelab running 37 Docker Compose services on a Raspberry Pi 5 — DNS ad-blocking, VPN, media, documents, passwords, and intrusion detection behind wildcard TLS.

Private repo
37
Services
Pi 5, 8 GB
Hardware
aarch64
Arch
Wildcard
TLS
pi-lab project visual

The constraint

Self-hosting advice is either a single-service tutorial or a rack-mounted enterprise build. There was no honest middle: what can one 8 GB Raspberry Pi actually carry, and what does it cost in complexity to run the services that would otherwise be a dozen subscriptions?

The approach

Thirty-seven services on one Pi 5, each a Docker Compose stack in its own directory, all reachable behind Nginx Proxy Manager with wildcard TLS on a real domain. DNS resolves through Pi-hole to Unbound to DNSCrypt, so there is no upstream resolver watching the queries either.

Process
  1. 1
    One stack per directory

    Kept each service self-contained so a single broken image can be rebuilt without touching the other thirty-six.

  2. 2
    Own the resolver

    Chained Pi-hole to a local Unbound recursive resolver rather than a public upstream, so ad-blocking does not just relocate the surveillance.

  3. 3
    One front door

    Put everything behind Nginx Proxy Manager with wildcard certificates instead of exposing ports per service.

  4. 4
    Assume it will be attacked

    Added Authelia in front and CrowdSec underneath, on the assumption that anything reachable will eventually be probed.

Outcomes

  • 37 services covering DNS, VPN, media, documents, passwords, automation, and monitoring
  • Recursive DNS chain — Pi-hole to Unbound to DNSCrypt — with no upstream dependency
  • Wildcard TLS on *.lscaturchio.xyz via Nginx Proxy Manager and Let's Encrypt
  • Authelia for single sign-on and CrowdSec for intrusion detection across the estate
What I'd do next
  • Move the compose sprawl to K3s and reuse the Helm work from the homelab repo.
  • Add automated restore drills — backups that have never been restored are not backups.
  • Publish per-service memory ceilings so the 8 GB budget is legible to anyone copying this.
Details

Deployed and maintain a 37-service self-hosted homelab on a Raspberry Pi 5 (8 GB, aarch64) covering DNS ad-blocking, VPN, media streaming, document management with OCR, password management, workflow automation, and intrusion detection.

Fronted the estate with Nginx Proxy Manager and wildcard Let's Encrypt TLS, with Authelia for SSO and a Pi-hole to Unbound to DNSCrypt resolver chain that removes the upstream DNS dependency.

Related projects