Why I run my home lab like enterprise infrastructure

I'm an IT Systems Administrator / Service Desk Team Lead L2 in Torino, Italy. During the day I manage endpoints and infrastructure for a large public-sector IT provider. At night I run PolarisCore, a home lab built with the same standards I use at work: VLAN segmentation, a real reverse proxy, internal DNS, ZFS storage with redundancy, and monitoring - not just a pile of Docker containers on a single box.

Here's the actual current state of it, pulled live via SSH, not marketing copy.

The compute layer - Proxmox

One node left after a migration earlier this year moved the old primary host over to dedicated NAS duty (more on that below).

• pve-manager/9.2.3 (kernel 7.0.12-1-pve)
• Uptime: 10 days
• RAM: 4.7 / 7.5 GiB used
• ZFS rpool (NVMe mirror): 45.9 GB / 236 GB (19%)
• Containers: 14 running / 16 total (LXC)
• Load average: 0.05, 0.08, 0.14

14 LXC containers handle: a Caddy reverse proxy, internal DNS (PowerDNS + Pi-hole), a self-built deployment tool (more below), a Next.js search frontend, and a handful of smaller services. Everything sits behind VLANs - management, services, IoT, gaming, guest, and VPN are all separated, with the services VLAN carrying most of the public-facing traffic.

The storage layer - TrueNAS SCALE

The hardware that used to run Proxmox now runs TrueNAS SCALE full-time:

• TrueNAS 25.10.4 (Fangtooth)
• Uptime: 10 days
• RAM: 28 / 31 GiB (ZFS ARC, expected)

Pool DATA (RAIDZ1, 4x8TB): 13.4 TB / 21.8 TB used (61%)
Pool APPS (mirror): 23.5 GB / 460 GB used (5%)
Pool boot: 3.47 GB / 236 GB used (1%)
All pools: ONLINE

22TB isn't there for the sake of it - it holds a media library (Jellyfin + the *arr stack, running as native TrueNAS apps, not VMs), backups for a few side projects, and a dedicated encrypted share. RAIDZ1 across 4 drives gives me a single-drive failure buffer, which for a home setup with real data on it (not just test VMs) matters more than raw speed.

The network layer

FTTH 10Gbps from TIM into a UniFi Cloud Gateway Max, distributed over a 2.5GbE backbone to switches and clients. The 10Gbps WAN isn't about single-stream throughput to the internet - it's headroom so the internal 2.5GbE backbone never bottlenecks against the uplink when multiple services (backups, streaming, syncs) are active in parallel.

TLS is wildcard, issued via DNS-01 against DuckDNS, auto-renewing, with zero inbound ports open for cert issuance.

The lightweight cloud piece - Oracle Always Free

Not everything lives on-prem. Site analytics run on Umami (self-hosted, replaced GA4 across 5 sites) on an Oracle Cloud Always Free VM:

• Ubuntu 20.04.6 LTS
• VM.Standard.A1.Flex - 1 OCPU / 6 GB RAM
• RAM used: 631 MiB (11%)
• Load average: ~0.00 (idle)
• Stack: Umami + Postgres 15 + Caddy, Docker Compose

It's been up for a couple of days since the last restart and barely registers on CPU. For a low-traffic analytics backend, the free tier is more than enough - no reason to spend money on a VPS for this.

A side project that came out of daily frustration

The one piece of software here that isn't just infra glue is NovaSCM - an open-source, self-hosted alternative to Microsoft SCCM for zero-touch Windows deployment (PXE boot, autounattend generation, network scanning, WiFi 802.1X certificate management, workflow-based software deployment). I wrote about it in more detail in a separate post - it's MIT-licensed, on GitHub, and it runs as one of the 14 containers above.

Why bother with all this at home

The honest answer: because building it the "enterprise" way - with segmentation, real cert automation, redundant storage, and a reverse proxy instead of exposed ports - is the best way I know to actually understand those patterns instead of just reading about them at work. When something breaks at 11pm on my own network, I'm the only one who can fix it, which is a different kind of pressure than a ticket queue.

More on the project (and a few more services I haven't written up yet) at polariscore.it.