// homelab-docs

One NAS, four VMs, nineteen containers, all configured as code and written up publicly.

Three things worth a look:

1. Defence in depth, tested nightly. Internet-facing services live on a DMZ VLAN. Each VM carries a packet filter enforced at the hypervisor, has no SSH server and no accounts, and is managed over the QEMU guest agent with no network path at all. Every night a job proves the isolation still holds, from the host, from inside the guest and against the router, and pulls the plug if it doesn't. The security model is written up on its own.

2. An AI agent with root, made safe structurally. A Claude Code agent runs 24/7 and maintains the lab. What it must never touch is enforced by missing routes and missing credentials, not by instructions. Every task it's given and every push it makes is reported to Discord and Home Assistant, with a kill switch.

3. Backups it can't reach. Pull-only snapshots to the NAS, then to a second NAS that keeps copies the first one can't see.

Also in there: a self-hosted VPN (headscale), Home Assistant with local voice, a media stack with a custom travel encoder, and the lessons it took to get there.