Every service containerised, every entry-point proxied, every failure logged. Domain management via Cloudflare with AAAA records and tunnels. Built to enterprise patterns at personal scale.
+
+ Started with a single Proxmox node — my first real server, and the one that taught me virtualisation and LXC.
+ When file storage and parity-protected array management outgrew that setup, I built Nargothrond:
+ a dedicated UNRAID box, named after the hidden fortress from The Silmarillion.
+ Every service containerised, every entry-point proxied, every failure logged.
+
Pangolin (WireGuard-based, identity-aware tunnel) publishes services externally with zero open inbound ports; Traefik routes by hostname and handles automatic TLS. Cloudflared runs a second outbound tunnel for select services.
+
PangolinTraefikWireGuardCloudflaredAuto-TLS
02
-
DNS & Cloudflare
+
AdGuard Home + Unbound
-
Domain managed through Cloudflare with AAAA records for IPv6, Cloudflare Tunnels for zero-open-port external access, and AdGuard Home for internal DNS resolution and ad-blocking.
Network-wide DNS filtering on its own macvlan (br0) IP so it’s visible to every LAN device. Unbound handles recursive resolution, keeping DNS queries private end-to-end.
+
AdGuard HomeUnboundmacvlanSplit DNS
03
-
Pangolin + Traefik
+
CrowdSec + Gluetun
-
Pangolin (Traefik-based) handles all inbound HTTPS with automatic TLS, subdomain routing, and middleware. Newt tunnel enables access without exposing raw ports. Authelia adds SSO/2FA.
CrowdSec watches logs and bans malicious IPs in real time using community threat intel. Gluetun routes the download client through an encrypted VPN tunnel with a kill switch, so it never touches the LAN directly.
+
CrowdSecGluetunKill switchIntrusion detection
04
-
Fail2Ban + Security
+
Jellyfin + *Arr Stack
-
Fail2Ban monitors SSH and auth logs, auto-banning brute-force IPs. Crowdsec adds community threat intelligence with real-time blocklist sync. UFW provides host-level firewall rules on each node.
-
Fail2BanCrowdsecUFWiptablesSSH hardeningAuthelia
+
Jellyfin streams the library with iGPU transcoding. Seerr lets family request titles, which flow into Sonarr/Radarr; Jackett and Byparr proxy indexers; qBittorrent (VPN-locked via Gluetun) handles downloads.
+
JellyfinSeerrSonarrRadarrJackettByparrqBittorrent
05
-
Jellyfin + Media
+
Navidrome + Music
-
Jellyfin handles hardware-transcoded streaming with per-user OAuth authentication and Authelia SSO. Sonarr/Radarr auto-manage TV and film libraries; Bazarr handles subtitles; Prowlarr indexes trackers.
Navidrome serves a lossless personal library Spotify-style. Lidarr tracks favorite artists and new releases; slskd taps the Soulseek network for rare or indie finds.
+
NavidromeLidarrslskdSubsonic API
06
-
Music Pipeline
+
Immich + Vaultwarden
-
Lidarr monitors for releases → Prowlarr indexes → Beets normalises tags → Navidrome streams via Subsonic API. Scrobbling to Listenbrainz. Mobile playback via Symfonium and Explo apps.
Immich (with dedicated PostgreSQL + Redis) is a self-hosted Google Photos replacement for phone backups. Vaultwarden syncs passwords across every device. Both live on an isolated network alongside the reverse proxy and IDS.
+
ImmichPostgreSQLRedisVaultwarden
+
+
+
+
07
+
Network Segmentation
+
+
Six Docker networks isolate containers by sensitivity — bridge, tunnel, explo_default, a dedicated pangolin network for the security-critical core, macvlan for AdGuard, and a Tailscale overlay for Jellyfin/Immich remote access.
+
Docker networkingTailscaleVLANsZero-trust
Zero open ports via Tailscale + Cloudflare Tunnels
-
All services reachable remotely through a combination of Tailscale mesh VPN (for trusted devices) and Cloudflare Tunnels (for public-facing services). No port-forwarding. MagicDNS handles internal name resolution. Pangolin’s Newt agent tunnels external traffic into the private LAN.
+
All services reachable remotely through a combination of Tailscale mesh VPN (for trusted devices) and Cloudflare Tunnels (for public-facing services). No port-forwarding. Pangolin’s Newt agent tunnels external traffic into the private LAN.
+
+
+
—
Traffic Flow
+
+
+
+
+
+
Request out, response back the same way
+
A phone outside the house requests a photo backup → it passes through the Cloudflare/Pangolin tunnel (no open inbound ports) → Traefik routes it by hostname to the target app (e.g. Immich), which loads the photos and responds back along the same path.
+
+
+
+
Spun up on demand, not left running
+
A Satisfactory game server, FileFlows for media re-encoding, and an sftp-server for bulk transfers stay fully configured but stopped until a specific project or game night needs them — keeping idle power draw down.
@@ -356,7 +477,7 @@ export default function Home() {
Personal Workstation
-
Daily driver and dev machine. Built around AMD’s 3D V-Cache architecture for a blend of high single-threaded performance and serious GPU compute doubles as a gaming rig, 3D modelling workstation, and 3D printing controller.
+
Daily driver and dev machine. Built around AMD’s 3D V-Cache architecture for a blend of high single-threaded performance and serious GPU compute doubles as a gaming rig, 3D modelling workstation, and 3D printing controller.
Component
Spec
@@ -514,7 +635,7 @@ export default function Home() {
Open Source Contributions
-
External pull requests and issues resolved in other maintainers’ codebases work landed in repos I don’t own.
+
External pull requests and issues resolved in other maintainers’ codebases work landed in repos I don’t own.
@@ -552,7 +673,7 @@ export default function Home() {
My Projects on GitHub
-
The complete repository list including the projects featured above, plus the smaller tools and documentation that support them.
+
The complete repository list including the projects featured above, plus the smaller tools and documentation that support them.