The setup
The core is a single bare-metal Proxmox host carved into a mix of VMs and LXC containers — everything from network security tooling to internal apps to the monitoring stack that watches all of it. Nothing here is a toy deployment: DNS filtering, credential storage, and file sync all run real workloads that other services and people depend on daily.
The guiding principle is treating a home lab with the same operational discipline as a client environment: things get monitored, backed up, and documented, not just switched on and forgotten.
What's actually running
Metrics, logs, and dashboards for every node in one place, with retention tuned to fit a fixed disk budget.
Rule-based intrusion detection running thousands of signatures against live traffic, tuned to stop flagging noise as incidents.
A password/secrets manager plus Ansible Vault for anything that needs to be read by automation instead of a human.
Replaced a commercial cloud storage subscription with a hard-capped, self-hosted alternative — capacity is a constraint that's managed, not ignored.
Network-wide ad/tracker/malware-domain blocking upstream of every client on the network.
Scheduled patch windows across the fleet, with logging so a "what changed" question always has an answer.
The discipline that actually matters: capacity
Home labs die from disk pressure more often than from anything exotic. The fix here wasn't a bigger disk — it was a policy: keep every volume under 80% utilization, enforced by daily automated cleanup, log rotation tuned per-service, and retention windows on the metrics/log stack that are short enough to matter (days, not months) without losing the ability to diagnose a recent incident.
It's unglamorous work, but it's the difference between a lab that runs quietly for months and one that pages you at 2am because a log directory filled the root partition.
Recovering from a real outage
Connectivity to the network doesn't fail gracefully when the physical link underneath it is consumer-grade satellite internet. When a full connectivity break took the lab offline, recovery followed a repeatable runbook rather than improvisation: re-establish the mesh VPN identity, clear an emergency disk-pressure condition that had built up while things were down, bring all nodes back one layer at a time (network → storage → compute → services), and only then declare it resolved.
The follow-up mattered more than the fix: a 72-hour monitoring window with explicit success criteria and escalation triggers, so "it's back up" and "it's actually stable" weren't treated as the same claim.