Introduction

This is my Unraid home lab. The server runs on hardware sourced from used components. It functions as a Network Attached Storage (NAS) over SMB for file access. It also doubles as my server that hosts a plethora of services and some custom solutions I built for my daily tooling, which I show in my other guides.

Hardware

  • Motherboard: ASRock Z370M-ITX/ac
  • CPU: Intel i3-8100
  • RAM: 32 GB
  • Storage: a couple of multi-terabyte hard disks, with one drive for parity
  • Cache: a cache drive used for quick intermediary file storage before files are saved to the HDDs

Docker containers

ContainerWhat it does
Gluetun
Gluetun logo		I use Gluetun to route my containers over a VPN. This helps me to virtually isolate them from the rest of my network. For example, I have a Claude Code development container built on Node, and Gluetun functions as its network interface, allowing connection to the Internet over VPN.
Stirling PDF
Stirling PDF logo		I use this docker to edit, annotate, remove pages, change the orientation, and perform other PDF related functions locally on my machines.
NGINX Proxy Manager
NGINX Proxy Manager logo		My gateway for internal services (see below).
Custom Tooling
⚡		I run multiple custom dockers for internal tooling which I get into in depth in my other writeups.

Reverse proxy and internal SSL

I proxy my internal services through NGINX Proxy Manager, which becomes my gateway, and allows me to provision SSL certs for my internal services. Every domain has a DNS record pointing to my Unraid server, and each Docker container’s host name is given to the proxy manager, one per Duck DNS subdomain. The details are as below.

For how exactly it’s done, you can refer to this video. Essentially, Duck DNS provides a token that satisfies Let’s Encrypt’s (the cert issuer’s) challenge before issuing the cert. This token is to be input in NGINX Proxy Manager. For any subdomain requested from Duck DNS (e.g. <name>.duckdns.org), it is given a corresponding Docker hostname (e.g. StirlingPDF). Once the subdomain is input, the DNS record set earlier leads the request to go to the server IP, targeting the port at 443 / 80, usually given this by default. Then NGINX checks which subdomain the request has been made from and forwards accordingly.

Plugins

PluginWhat it does
Tailscale
Tailscale logo		I also use Tailscale to remotely connect into the server securely while not on the same network. This allows me to carry out my workflows externally, as I would at home.
Appdata BackupAn Unraid plugin for backing up appdata folders and the files containing Docker information.
User ScriptsA plugin to run commands on Unraid over a certain time interval.

Final thoughts

I am aware that this is kind of short, but I wanted to keep it brief as I would like to explore each service and each tool in its own writeup.

References