Hardware
BOSGAME Mini PC
AMD Ryzen 7 5825U — 8 cores, 16 threads — with 32GB of RAM and a 1TB NVMe boot drive. Small, quiet, and low enough power draw to leave running.
2 × 4TB over USB-C
A pair of WD40EFZZ drives in an ORICO 4-bay enclosure, mounted on the Proxmox host and passed into containers as bind mounts. One drive holds media, the other holds photos and documents.
Dual 2.5GbE
Everything sits on a single flat bridge behind the house router. DNS and DHCP are handled inside the lab rather than by the ISP-supplied box.
Containers
LXC 100
Media
Media library, photos, documents and the metrics agent.
LXC 101
Sentinel
Network services and observability for the whole lab.
LXC 102
Workshop
The data engineering stack behind the pipeline projects.
LXC 103 · 104
Automation & Edge
Home automation, plus the tunnel that puts this site online.
How traffic gets here
Public
Cloudflare
DNS + TLS
Named tunnel
No open ports
Edge
cloudflared
Outbound only
Ingress rules
systemd service
Route
nginx
Static site
Per-host routing
Serve
FastAPI
Pipeline endpoints
CORS for this site
Watch
Prometheus
node_exporter
Grafana panels
Piped into HA
What it taught me
Most of what I know about Linux permissions I learned by getting them wrong. Toggling an unprivileged container to privileged and back once corrupted the UID mapping across an entire filesystem — apt, dpkg and Docker all stopped working at the same time. Recovering it meant mounting the disk from the host, understanding what the 100000 offset actually does, and rebuilding the container storage from scratch. Nothing in a tutorial teaches that as well as an evening of fixing it.
The same goes for DNS. A VPN client quietly rewrote resolv.conf and every service that touched the internet failed at once — indexers, image caches, API lookups. The symptom looked like six unrelated bugs; the cause was one line.
Those two incidents are why there are now scheduled backups, memory limits on containers that leak, and a nightly job that resets ownership on the media mounts. Operating something is a different skill from building it, and the only way to practise it is to run something you care about.