Homelab Setup Guide: Building Your Self-Hosted Infrastructure from Scratch

A homelab is your personal playground for learning, experimenting, and running services that you control. Whether you want to host your own media server, run a personal cloud, learn enterprise networking, or simply stop paying monthly fees for services you could run yourself, a homelab is the answer. This guide walks you through every decision from the first hardware purchase to a fully operational self-hosted infrastructure.

The homelab community has exploded in recent years, driven by affordable used enterprise hardware, mature container orchestration tools, and growing privacy concerns. What once required a dedicated server room can now run quietly under a desk on a single mini PC drawing 15 watts.

Choosing Your Hardware

Your hardware choice depends on three factors: budget, noise tolerance, and power consumption. Here is a realistic comparison of common homelab platforms:

RAM and Storage Considerations

RAM is typically the first bottleneck in a homelab. Each container uses relatively little, but it adds up quickly when you are running databases, monitoring stacks, and media services:

• 8GB: Tight but workable. You can run 10-15 lightweight containers. Skip memory-hungry services like Elasticsearch.
• 16GB: The sweet spot. Comfortable for 20-30 containers including a database or two.
• 32GB+: Required if you plan to run virtual machines alongside containers, or heavy services like GitLab or Nextcloud with full-text search.

For storage, start with a single SSD. Spinning disks are fine for bulk media storage, but your operating system and container volumes should live on solid-state storage. A 500GB NVMe SSD is sufficient for most homelabs:

# Check your current disk performance
sudo hdparm -Tt /dev/sda

# Monitor disk I/O in real time
iostat -xz 1

# Check disk health with SMART
sudo smartctl -a /dev/sda

Networking Fundamentals

Proper networking is the backbone of a reliable homelab. At minimum, you need to address three things: static IP assignment, DNS resolution, and VLAN segmentation (optional but recommended).

Static IP Assignment

Your homelab server needs a consistent IP address. You can set this on the server directly or via DHCP reservation on your router (preferred):

# Option 1: Static IP via netplan (Ubuntu/Debian)
# /etc/netplan/01-static.yaml
network:
  version: 2
  ethernets:
    enp0s3:
      dhcp4: false
      addresses:
        - 192.168.1.100/24
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses:
          - 192.168.1.1
          - 1.1.1.1

# Apply the configuration
sudo netplan apply

DNS Resolution for Your Services

Instead of remembering IP addresses and port numbers, set up local DNS so you can access services by name. Pi-hole or AdGuard Home double as ad blockers and local DNS servers:

# Add local DNS entries in Pi-hole
# Navigate to Local DNS > DNS Records
# Map your services:
# server.home.lab     -> 192.168.1.100
# grafana.home.lab    -> 192.168.1.100
# nextcloud.home.lab  -> 192.168.1.100

# Alternatively, use dnsmasq directly
# /etc/dnsmasq.d/home.lab.conf
address=/home.lab/192.168.1.100

VLAN Segmentation

If your router and switch support VLANs, isolating your homelab on a separate VLAN improves security. IoT devices, guest networks, and lab equipment should not share a broadcast domain with your personal devices:

• VLAN 1: Management / personal devices (192.168.1.0/24)
• VLAN 10: Homelab servers (10.10.10.0/24)
• VLAN 20: IoT devices (10.10.20.0/24)
• VLAN 30: Guest network (10.10.30.0/24)

Choosing a Hypervisor (Or Not)

A hypervisor lets you run multiple virtual machines on a single physical host. Whether you need one depends on your goals:

Recommendation: If you are primarily running Docker containers, skip the hypervisor. Install a minimal Debian or Ubuntu Server directly on the hardware and run Docker on bare metal. You get better performance, simpler management, and one fewer abstraction layer to troubleshoot. If you need VMs for Windows, network appliances, or true isolation, Proxmox VE is the clear choice for homelabs.

Operating System Installation

For a Docker-focused homelab, Debian 12 (Bookworm) or Ubuntu Server 24.04 LTS are the most reliable choices. Install the minimal server variant without a desktop environment:

# After installing Debian/Ubuntu minimal server:

# Update the system
sudo apt update && sudo apt upgrade -y

# Install essential packages
sudo apt install -y \
  curl wget git htop iotop ncdu \
  ufw fail2ban \
  unattended-upgrades \
  net-tools dnsutils

# Enable automatic security updates
sudo dpkg-reconfigure -plow unattended-upgrades

# Configure firewall
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Docker Installation and Setup

Docker is the engine that will power most of your homelab services. Install it from the official repository, not the distribution packages:

# Install Docker using the official convenience script
curl -fsSL https://get.docker.com | sudo sh

# Add your user to the docker group (log out and back in)
sudo usermod -aG docker $USER

# Verify installation
docker --version
docker compose version

# Configure Docker daemon for production use
sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json <<EOF
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  },
  "default-address-pools": [
    {"base": "172.17.0.0/12", "size": 24}
  ],
  "storage-driver": "overlay2",
  "live-restore": true
}
EOF

# Restart Docker to apply settings
sudo systemctl restart docker

# Enable Docker to start on boot
sudo systemctl enable docker

Docker Compose Project Structure

Organize your services into logical directories. Each service gets its own directory with a Compose file and any associated configuration:

# Recommended directory structure
/opt/docker/
  |- traefik/
  |    |- docker-compose.yml
  |    |- traefik.yml
  |    |- acme.json
  |- monitoring/
  |    |- docker-compose.yml
  |    |- prometheus.yml
  |    |- alertmanager.yml
  |- media/
  |    |- docker-compose.yml
  |    |- .env
  |- nextcloud/
  |    |- docker-compose.yml
  |    |- .env
  |- pihole/
  |    |- docker-compose.yml
  |- backups/
       |- scripts/
       |- data/

Essential Services to Deploy First

Do not try to deploy everything at once. Start with these foundational services in order:

1. Reverse Proxy (Traefik or Nginx Proxy Manager): Routes traffic to your services by hostname, handles TLS certificates automatically.
2. Pi-hole or AdGuard Home: Network-wide ad blocking and local DNS resolution for your services.
3. Monitoring (Prometheus + Grafana): Visibility into resource usage, container health, and alerting.
4. Backup solution (restic or borg): Automated backups of volumes and configurations before you have data worth losing.
5. Dashboard (Homarr or Homepage): A single page with links to all your services.

Here is a starter Compose file for a reverse proxy with automatic TLS:

# /opt/docker/traefik/docker-compose.yml
services:
  traefik:
    image: traefik:v3.0
    container_name: traefik
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/etc/traefik/traefik.yml:ro
      - ./acme.json:/acme.json
    networks:
      - proxy

networks:
  proxy:
    external: true

Power Management and UPS

A UPS (Uninterruptible Power Supply) is not optional for a homelab that stores data you care about. Even a basic 600VA UPS gives you 10-15 minutes of runtime on a mini PC, enough to shut down gracefully during a power outage:

# Install NUT (Network UPS Tools) for UPS monitoring
sudo apt install -y nut

# Configure NUT for a USB-connected UPS
# /etc/nut/ups.conf
[myups]
  driver = usbhid-ups
  port = auto
  desc = "CyberPower 1000VA"

# /etc/nut/upsmon.conf
MONITOR myups@localhost 1 admin secret master
SHUTDOWNCMD "/sbin/shutdown -h +0"
POWERDOWNFLAG /etc/killpower

# Start NUT services
sudo systemctl enable nut-server nut-monitor
sudo systemctl start nut-server nut-monitor

# Check UPS status
upsc myups

Remote Access

You will want to access your homelab when you are away from home. There are several approaches, ranked from most to least secure:

1. WireGuard VPN: The gold standard. Connects you directly to your home network from anywhere. Fast, lightweight, and extremely secure.
2. Tailscale / Headscale: WireGuard under the hood with zero-config networking. Tailscale is a managed service; Headscale is the self-hosted control server.
3. Cloudflare Tunnel: Exposes specific services without opening ports. Free tier available. Good for sharing services with others.
4. SSH with key-only auth: Good for terminal access. Use with a non-standard port and fail2ban.

# Quick WireGuard setup with wg-easy (Docker)
docker run -d \
  --name wg-easy \
  --cap-add NET_ADMIN \
  --cap-add SYS_MODULE \
  -e WG_HOST=your-dynamic-dns.example.com \
  -e PASSWORD=your-admin-password \
  -e WG_DEFAULT_DNS=192.168.1.100 \
  -v ~/.wg-easy:/etc/wireguard \
  -p 51820:51820/udp \
  -p 51821:51821/tcp \
  --restart unless-stopped \
  ghcr.io/wg-easy/wg-easy

Monitoring Your Infrastructure

You cannot manage what you cannot see. A basic monitoring stack with Prometheus and Grafana gives you real-time dashboards, historical data, and alerting:

# /opt/docker/monitoring/docker-compose.yml
services:
  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    restart: unless-stopped
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.retention.time=30d'
    ports:
      - "9090:9090"

  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    restart: unless-stopped
    volumes:
      - grafana_data:/var/lib/grafana
    environment:
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD}
    ports:
      - "3000:3000"

  node-exporter:
    image: prom/node-exporter:latest
    container_name: node-exporter
    restart: unless-stopped
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    command:
      - '--path.procfs=/host/proc'
      - '--path.sysfs=/host/sys'
      - '--path.rootfs=/rootfs'

  cadvisor:
    image: gcr.io/cadvisor/cadvisor:latest
    container_name: cadvisor
    restart: unless-stopped
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro

volumes:
  prometheus_data:
  grafana_data:

Tools like usulnet integrate container monitoring directly into the management interface, giving you a unified view of container health, resource usage, and logs without deploying a separate monitoring stack.

Cost Breakdown

Here is a realistic budget for a beginner homelab:

Monthly running costs are minimal. An N100 mini PC running 24/7 draws about 15 watts, which translates to roughly $1.50-3.00/month in electricity depending on your rates. Compare that to $5-20/month per cloud service you would otherwise be paying for.

Progression Path: Beginner to Advanced

Growing a homelab is a journey. Here is a roadmap from your first container to a production-grade infrastructure:

Phase 1: Foundation (Week 1-2)

• Install Linux and Docker on a single machine
• Deploy Pi-hole for DNS and ad blocking
• Set up a reverse proxy (Nginx Proxy Manager is beginner-friendly)
• Deploy a dashboard to keep track of your services

Phase 2: Core Services (Week 3-4)

• Add monitoring with Prometheus and Grafana
• Deploy Nextcloud for personal cloud storage
• Set up automated backups with restic
• Configure WireGuard for remote access

Phase 3: Hardening (Month 2)

• Implement proper TLS with Let's Encrypt
• Set up fail2ban and firewall rules
• Add a log aggregation solution (Loki + Grafana)
• Implement infrastructure as code with Ansible

Phase 4: Advanced (Month 3+)

• Add a second node and explore multi-node Docker management
• Implement high availability for critical services
• Set up CI/CD pipelines (Gitea + Woodpecker or Drone)
• Explore Kubernetes (k3s) if you want to learn container orchestration

The most important rule of homelab: Do not skip backups. You will break things. You will misconfigure services. You will accidentally delete volumes. Backups are the safety net that lets you experiment fearlessly.

Common Mistakes to Avoid

• Buying too much hardware too soon. Start small, scale when you hit actual limits.
• Exposing services directly to the internet. Always use a reverse proxy and VPN.
• Not documenting your setup. Write down what you did. Future you will thank present you.
• Running everything as root. Use a dedicated non-root user for Docker management.
• Ignoring updates. Enable automatic security updates. Unpatched services are compromised services.
• No backup strategy. A backup you have not tested is a backup you do not have.

Conclusion

A homelab does not have to be expensive or complicated. A $200 mini PC running Docker can replace dozens of cloud subscriptions while giving you complete control over your data and valuable hands-on experience with real infrastructure. Start with the basics, build good habits around backups and security, and grow your lab organically as your needs evolve.

The self-hosting community is one of the most helpful and passionate groups in technology. Resources like r/selfhosted, r/homelab, and the various Discord communities are invaluable when you get stuck. And you will get stuck. That is the entire point: every problem you solve in your homelab makes you a better systems administrator.