The FabLab.
A two-host Proxmox cluster running 30+ self-hosted services for my AI, my finances, my media, my workflows, my family. From a closet in Manitoba. With production-grade SSO, SIEM, secrets management, and backups.
Most “home labs” run a Plex box and call it a day. The FabLab is what happened when I decided to actually own my stack — identity, monitoring, secrets, backups, the AI assistant that runs my work — instead of paying twelve different SaaS companies to know me. It’s not impressive because it’s big. It’s impressive because it’s boring on purpose. It just runs.
- 30+Self-hosted services
- 2Proxmox hypervisors
- 2Segmented VLANs
- 17Endpoints reporting to SIEM
- 3Tier backup
- 1Closet
What it runs
Personal AI Infrastructure
The lab runs a multi-agent AI system I use daily. Specialized assistants for infrastructure, design, research, security, and writing — each with their own context, memory, and tools. Backed by a self-hosted LLM gateway, a TTS engine for narration, and a notification fabric for human-in-the-loop approvals.
Includes: LLM gateway, voice synthesis, agent orchestration, capture pipeline.
Workflow & Productivity
Automation, task management, personal finance, knowledge base. The boring middle layer of a life, owned and operated.
Includes: n8n, Vikunja, Firefly III, Seafile.
Media & Family
Streaming server, photo library, offline knowledge archive (Wikipedia, Stack Overflow, medical and survival references — for when the internet isn’t there).
Includes: Jellyfin, Immich, Kiwix.
Identity & Security
Single sign-on across the lab. SIEM watching every host. Centralized secrets vault. Defense-in-depth that wouldn’t embarrass a small enterprise.
Includes: Authentik (OIDC), Wazuh (XDR), Infisical (vault), Cloudflare Access.
How it’s built
Network
Two VLANs — production and management — segmented at the firewall, with explicit allow rules between tiers. OPNsense handles routing, DNS (Unbound), DHCP, and a WireGuard tunnel that selectively routes specific containers through a commercial VPN while leaving everything else on the home connection. Split-DNS means the same hostnames work locally and remotely; no tunnel-DNS fuckery.
Identity & Access
Authentik as the OIDC provider. Single sign-on into the hypervisors, the VDI gateway, and the workspace platform. Tailscale subnet router for remote access — no port forwarding to the internet, ever. Cloudflare Access in front of anything that does need to be public.
Observability
Wazuh manager with agents on every host, container, and the firewall itself. File integrity monitoring, log correlation, vulnerability detection. Uptime monitoring with push alerts to a self-hosted notification server. Real metrics, real alerts, real on-call (of one).
Backups
3-tier backup strategy: daily VM/container snapshots to the primary NAS, weekly snapshots to an off-host NAS in a different room, encrypted file-level backups via restic. Tested. Annoying to set up once. Boring forever after.
Deployment
Every service has a runbook. Most have a docker-compose file in git. Secrets injected at deploy time from the vault, never written into compose files. New services follow a documented pattern: allocate IP, clone container template, push compose, register DNS, done.
Why
I built this because I got tired of renting my own life from twelve companies that change their pricing every quarter, harvest my data, and decide my “personal” data is theirs to train on. I wanted to know exactly what my stack was doing, and I wanted to be the one who fixed it when it broke.
It’s also a hell of a teacher. There’s no learning curve like running production infrastructure that your wife will notice if it’s down. Every service in the lab taught me something I now know cold — TLS, DNS, identity, observability, backup, network segmentation, container orchestration. The lab is the curriculum.
If you’re an engineer thinking about building something like this, I’m happy to compare notes. The build log is over here and I’m reachable through the contact page. If you’re a hiring manager wondering whether I can run your stack — yeah, I can run your stack.