Hey r/homelab ,

I spent the last few weeks rebuilding my media server, and drew the result. Everything runs on a single N100 mini-ITX board with Debian and Docker Compose, plus a small Proxmox box on the side for monitoring and DNS.

The short version

443 is the only open port. Port 80 is closed, UPnP is off, IPv6 inbound blocked at the router.

Pangolin (Traefik inside) as the single entry point, with PocketID as identity provider: passkeys only, groups mapped to roles.

Two access policies: "Family" (requests (seerr), files) and "Admins" (the *arr stack, qui…). Apps with their own TV/phone clients (Plex, Jellyfin) skip SSO and use their own login.

Admin tools (Arcane, Backrest, CrowdSec Manager) have no public DNS record at all. They only resolve on my LAN, and over the VPN.

Cloudflare in front of the web apps: restricted to two countries, cloud-hosting networks challenged, AI crawlers blocked.…