🏠 Hasaam's Homelab

Documentation for everything I self-host: a NAS appliance (ShiNAS), a repurposed laptop (ShineoriServer), and lab VMs on my Windows PC.

flowchart LR
    subgraph ShiNAS
        A[Identity & security]
        B[Media]
        C[Apps]
        D[Game servers]
    end
    subgraph ShineoriServer
        E[Minecraft]
        F[Local AI]
        I[Immich ML]
        J[Monitoring & dashboard]
        K[Light apps]
    end
    subgraph Windows PC
        G[Security labs]
        H[The Forest]
    end

Loading

⭐ Featured write-ups

Full write-ups with architecture, security decisions, troubleshooting and lessons learned:

Write-up	Highlights
🌐 Cloudflare Tunnel	Zero open ports, a security audit of my own setup (5 findings, all fixed), Zero Trust gate on the NAS admin panel
🔐 Authentik SSO	Self-hosted identity provider, passwordless passkeys, OIDC into my apps
🛡️ auditd + Discord alerts	Kernel-level audit rules mapped to attacker goals, real-time alerting through an auditd plugin I wrote
🔑 Vaultwarden	Self-hosted password manager with a zero-knowledge design; found and closed open public sign-ups, now invite-only
🚚 Moving services off the NAS	Diagnosed a RAM-starved NAS and moved 6 services to a second server, including Docker volume migrations, a broken host VPN, a dead image registry and a damaged image
📸 Immich	Multi-container photo platform: ML face recognition, vector smart search, SSO through Authentik

Services

Status legend

	Status	Meaning
🟢	Running	Live and in daily use
🟡	In progress	Being built or still being configured
🔵	Planned	Researched and on the roadmap, not built yet
⚫	Retired	Shut down, kept here for the write-up and lessons learned
⏸️	On demand	Installed and working, but only started when I need it

Security & identity

Service	Host	Status	What it does
Authentik	ShiNAS	🟢	Single sign-on and identity provider for the lab
Vaultwarden	ShiNAS	🟢	Self-hosted Bitwarden server for passwords, TOTP and passkeys
auditd + Discord alerts	ShiNAS	🟢	Host-level audit logging with real-time Discord webhook alerts

Networking & monitoring

Service	Host	Status	What it does
Cloudflare Tunnel	ShiNAS	🟢	Publishes selected services to the internet with no open ports
Omada Controller	ShiNAS	⏸️	Manages TP-Link Omada network gear
Homarr	ShineoriServer	🟢	Dashboard / home screen for every service
Diun	ShiNAS + ShineoriServer	🟢	Watches every container image and pings Discord when a new stable version ships
Uptime Kuma	ShineoriServer	🟢	Uptime monitoring and alerts for every service

Media

Service	Host	Status	What it does
Jellyfin	ShiNAS	🟢	Media server for movies and shows
Immich	ShiNAS	🟢	Self-hosted Google Photos replacement
*arr stack	ShiNAS	🟢	Prowlarr + arr apps + qBittorrent routed through gluetun/ProtonVPN
qBittorrent (standalone)	ShiNAS	⏸️	Separate qBittorrent instance with tracker-specific rules
Audiobookshelf	ShiNAS	🟢	Audiobook and podcast server

Apps

Service	Host	Status	What it does
Dawarich	ShineoriServer	🟢	Self-hosted location history (Google Timeline replacement)
Flowcase	ShiNAS	⏸️	Browser-based isolated workspaces (Kasm-style), routed through ProtonVPN
Ghiro	ShineoriServer	⏸️	Image forensics web app
Paperless-ngx	ShiNAS	🟢	Scans, OCRs and organizes documents so they're searchable
Karakeep	ShineoriServer	🟢	Self-hosted bookmark and read-it-later manager

Game servers

Service	Host	Status	What it does
Terraria (tModLoader)	ShiNAS	⚫	Modded Terraria server for friends, public via playit.gg
Minecraft + playit	ShineoriServer	🟢	Minecraft server with playit.gg tunnel
The Forest dedicated server	Windows PC	⚫	Vanilla The Forest dedicated server reached over Tailscale

AI

Service	Host	Status	What it does
Ollama + Open WebUI + SearXNG	ShineoriServer	🟢	Local LLM stack with private web search
Hermes Agent	ShineoriServer	🟢	Local AI agent that reads release notes and posts update verdicts in Discord, behind layered guardrails

Security labs

Service	Host	Status	What it does
Pentesting lab	Windows PC	🟢	Attacker/target lab for practicing offensive security legally
OPNsense router lab	Windows PC	🟢	Virtual OPNsense router in VMware Workstation Pro, rehearsal for a NUC router
EVE-NG	Windows PC	🟡	Network emulation lab (Community Edition)

Web

Service	Host	Status	What it does
Terminal resume site	ShiNAS	🟢	Interactive terminal-style resume served from NGINX in Docker

Infrastructure

• Hardware
• Network & remote access
• Single sign-on
• Backups
• Alerting & email

---

📖 Rendered docs site: https://shineori.github.io/homelab/