Applications

The application environment is intentionally modular rather than being built around one all-purpose server.

Proxmox provides the virtualization layer, Docker provides the application-container layer for many services, the UNAS Pro provides persistent storage, and the segmented UniFi network controls how applications communicate with users and with one another.

This separation makes it possible to rebuild or move an application without treating the physical server hosting it as the application itself.

Where practical, application runtime is treated as replaceable while persistent data, configuration, databases, and media are kept on appropriate storage and protected independently.

Proxmox VE provides the virtualization platform for the environment and hosts the virtual machines and Linux containers used throughout the lab.

Docker provides the application-container layer for many self-hosted services, allowing application dependencies and runtime environments to be packaged separately from the underlying operating system.

Portainer provides centralized visibility and management for Docker environments and containerized workloads.

This creates a layered model in which physical hardware provides capacity, Proxmox provides virtualization, Linux hosts provide operating-system services, and Docker provides the application runtime.

UniFi Network provides centralized administration of routing, switching, wireless networking, VLANs, firewall policy, connected clients, and network topology.

UniFi Protect provides the camera and video-surveillance platform used within the dedicated security-camera network segment.

AdGuard Home provides DNS filtering, local DNS services, client visibility, and DNS rewrites.

Unbound provides recursive DNS resolution behind AdGuard Home, allowing DNS resolution to remain under local control rather than depending entirely on a third-party recursive resolver.

WireGuard provides secure remote access into the environment. Remote clients are placed into the dedicated VPN VLAN and are then subject to firewall policy controlling which internal resources they may reach.

Traefik provides reverse-proxy and application-routing services, allowing web applications to be accessed through consistent DNS names and HTTPS endpoints instead of raw IP addresses and port numbers.

Authentik provides centralized identity and authentication services for supported internal applications.

Vaultwarden provides self-hosted password and credential management.

SSL/TLS certificate management is integrated with the reverse-proxy architecture so supported internal web applications can use HTTPS and consistent certificate handling.

Apache Guacamole provides browser-based remote access to supported systems, creating a centralized administrative access path rather than requiring every management protocol to be exposed directly to endpoint devices.

Plex provides the primary self-hosted video-media experience for the local movie and television library.

Jellyfin provides an additional open-source media-streaming platform and an alternative path for accessing locally stored video content.

Both platforms consume centrally stored media rather than tying the media library directly to the lifecycle of the virtual machine or container running the application.

Separating the application from the media library makes application rebuilds, upgrades, migrations, and experimentation less disruptive to the underlying content.

Navidrome provides self-hosted music streaming and personal music-library access.

The service provides a private streaming experience similar in concept to a commercial music platform while keeping ownership and storage of the underlying music collection inside the home environment.

Lidarr complements the music environment by helping manage and organize the underlying music library.

The music library remains separate from the Navidrome application itself so the application can be maintained or rebuilt without making the media collection dependent on that specific runtime instance.

Immich provides self-hosted photo and video backup, organization, browsing, and library management.

It is used as the local replacement for a cloud photo platform such as Google Photos, keeping personal photos and videos under local storage and infrastructure control.

The application is separated from the underlying photo and video data so the media library remains independent from the lifecycle of the Immich application host.

This also makes backup, capacity planning, storage monitoring, and recovery part of the broader infrastructure design rather than leaving them entirely to a third-party cloud service.

Sonarr manages television-series library automation.

Radarr manages movie-library automation.

Lidarr manages music-library automation.

Prowlarr centralizes indexer management for the media-automation stack.

qBittorrent provides download-client functionality for supported automated workflows.

NZBGet provides Usenet download-client functionality.

Gluetun provides a dedicated VPN networking layer for selected download-related containers so their traffic can be isolated from the rest of the application stack.

Together, these services reduce repetitive manual library-management work while keeping each function separated into a distinct service.

Overseerr provides request-management workflows for the Plex ecosystem.

Jellyseerr provides similar request-management capabilities for Jellyfin-oriented workflows.

Tautulli provides Plex usage history, activity monitoring, and statistics.

Jellystat provides usage statistics and analytics for Jellyfin.

These applications separate media consumption from media administration and provide visibility into usage without requiring routine administration directly inside the primary streaming applications.

Home Assistant serves as the central smart-home integration and automation platform.

Apple HomeKit provides the primary Apple-facing user experience for supported devices and automations.

Homebridge extends HomeKit compatibility to selected devices and services that do not provide native Apple Home support.

Scrypted provides camera and video integration between supported camera systems and Apple HomeKit.

Zigbee2MQTT provides integration for Zigbee-based devices and exposes those devices through MQTT.

Mosquitto provides the MQTT messaging broker used by Zigbee2MQTT and other event-driven integrations.

These services operate within the same segmented network architecture as the rest of the lab rather than placing all smart-home devices on an unrestricted trusted network.

PostgreSQL provides relational database services for applications that require structured persistent data.

Redis provides an in-memory data store and caching layer for applications and supporting services that benefit from fast temporary data access.

Running data services as distinct infrastructure components creates clear dependencies that can be monitored, backed up, secured, and maintained separately from the applications that consume them.

Prometheus collects time-series metrics from infrastructure and application targets.

Grafana provides dashboards and visualization for operational metrics and other telemetry.

Loki provides centralized log aggregation and allows logs to be explored alongside other operational data.

Alertmanager provides alert-routing and notification capabilities for conditions identified by the monitoring stack.

Uptime Kuma provides straightforward service and endpoint availability monitoring.

Blackbox Exporter performs endpoint probes to measure reachability and response behavior.

Node Exporter exposes Linux host metrics such as CPU, memory, filesystem, and operating-system information.

SNMP Exporter allows SNMP-capable infrastructure devices to provide metrics to the monitoring platform.

VictoriaMetrics provides a time-series metrics storage and query backend for longer-term operational data.

Homarr provides a centralized dashboard and launch point for commonly used self-hosted services.

Portainer provides operational administration for containerized workloads.

Guacamole provides centralized browser-based access to systems that require interactive remote administration.

These tools reduce the need to remember individual IP addresses, ports, or management entry points and provide more consistent administration across the environment.

n8n provides workflow automation across applications, APIs, infrastructure services, alerts, and future AI-driven operational workflows.

It acts as an orchestration layer capable of connecting otherwise independent systems without requiring every integration to be custom-coded from scratch.

The long-term design is to use controlled automation layers such as n8n between AI systems and infrastructure services rather than granting an AI agent unrestricted administrative access.

The application platform is built around separation of concerns.

Identity, DNS, remote access, media, smart home, monitoring, storage, databases, automation, and user-facing applications remain separate services with defined responsibilities.

This adds more components than an all-in-one server, but it creates clearer dependencies, smaller failure domains, and better opportunities for monitoring, automation, backup, and security controls.

The objective is not to run the largest possible number of applications. It is to build an environment where services are intentionally placed, understood, secured, monitored, and recoverable.