It started with a Raspberry Pi.
I wanted somewhere to run a couple of small services at home - nothing ambitious. A Pi on a shelf, a few containers, the usual "this will only take an evening" energy. Then the evening became a weekend, the weekend became another machine, and before long I was thinking about power, cabling, and whether guests on the Wi-Fi should be able to see any of it. Why? Who even cares… until they do, and then you care a lot.
That is how you end up with a home lab - not with a grand plan, but with one more useful box, then one more dependency, until looking after it is part of the weekly rhythm. Disks need watching, certs expire, something updates and quietly breaks auth. You are no longer tinkering; you are operating a small private cloud that happens to live in a garage.
And now here we are - too far in to pretend it is still a Pi on a desk, and far enough along that the physical layout actually matters. This is a high-level look at how that layout hangs together today, from the broadband connection down to the rack and the little bit of cloud that sits beside it.
Network, kept deliberately simple
The broadband router is still the front door, and I have kept the design boring on purpose. DHCP and DNS are not treated as precious global services that everything collapses without - clients largely look after themselves. The less clever the core network tries to be, the fewer ways a bad day takes the whole house with it.
What does matter is separation. Everyday devices live on a guest-style network; servers, network kit, and the more sensitive home automation sit on a private one. Guests can get online without wandering into the bits that run the place, and that alone removes a surprising amount of worry.
Nothing useful is left open on the router firewall. If a service needs to be reached from outside the house, it does not get a forwarded port and a hope - it goes through the controlled paths below.
Getting in without punching holes
Remote access is Tailscale. It gives the machines a private mesh they can talk on without opening the home firewall to the world. Most of the apps run in Docker on the main server, sharing a network with the reverse proxy rather than advertising ports onto the LAN.
From there, Traefik terminates TLS and routes requests, and Pocket ID sits in front for login, with MFA (TOTP, a YubiKey, or a passkey). The pattern is always the same - you only see the app after you have proved who you are, and only while you are on the VPN.
That mesh model is why this feels safer than the old "VPN into one box and hope" diagram. Everything that needs to talk can, without the house becoming a public ingress point.
The garage rack
Once the Pi stopped being enough, the hardware had to leave the living room. A 19U cabinet now lives on the garage wall, with its own power and a long outdoor Ethernet run from the house router. It is not glamorous - tidy enough that I can find things, and isolated enough that the noise and heat are someone else's problem (mostly the garage's).
Inside there is a small surge-protected PDU and a short list of working parts rather than a data-centre fantasy:
- a TerraMaster DAS holding the Unraid disk array
- a couple of compact PCs doing the real compute
- a Raspberry Pi again, this time as a PiKVM for out-of-band access when something refuses to boot politely
- a tiny unmanaged switch and a pair of fans pretending this is all very professional
The DAS is USB-attached to the main server and stuffed with the drives that actually hold the data. The Pi that started all of this never really left - it just changed job.
A little cloud on the side
Not everything stays in the garage. Two small London VPS boxes (one Oracle, one OVH) sit in a mirrored layout for a simple DNS failover path - mostly there for media streaming when the home link has a bad afternoon.
Everything else that needs a public face goes through Cloudflare Zero Trust tunnels. Same idea as the VPN story: prefer a tunnel you control over a hole in the router.
Too far in
Looking back, the jump from "a Pi that runs a couple of containers" to "a rack, a mesh, auth everywhere, and cloud failover" was never a single decision - it was dozens of small ones that each felt reasonable at the time.
Would I start again with only a Pi? Probably, for a weekend. Would I go back to only a Pi now? Not really. The services are useful, the habits are formed, and the garage already has the cable hole.
So this is the home DC as it stands - high level on purpose. The interesting part was never the subnet numbers. It was noticing that a hobby had quietly become infrastructure, and deciding to arrange that infrastructure so it is still boring enough to live with.