Two boxes, one private mesh

• Nothing at home is exposed. I live on a managed apartment network with no port forwarding, and I don't trust it anyway. The home server only ever dials out.
• It survives a move. No static IPs, no DHCP reservations, no router settings. Plug the home box in anywhere with internet and it comes back on the same mesh address.
• Set and forget. The OS, the containers and the mesh client patch themselves. Reboots are scheduled around people playing.
• As little attack surface as possible. One public VM, four ports, two public apps. Everything else needs a mesh connection first.

The mesh

NetBird builds a WireGuard mesh between every device. The control plane runs on cloud01; peers connect outbound to it and then talk to each other directly when they can. At home my laptop reaches onprem01 peer-to-peer over the LAN at around 5 ms. On networks that block it, such as campus Wi-Fi, traffic falls back to the relay on cloud01, still end-to-end encrypted.

Mesh-only hostnames without split DNS

Every admin hostname has an ordinary public DNS record, but it points at a mesh address in 100.64.0.0/10. Anyone can look it up; only a mesh peer can route to it. There's no local resolver to run and nothing to configure per device or per network.

Traefik then checks the source address of every request with an ipAllowList middleware. For that to work Traefik runs with network_mode: host. With normal published ports Docker rewrites every source to its bridge gateway, and the allow-list would see one internal IP for the whole internet.

Certificates

Each box gets one wildcard certificate through a Cloudflare DNS-01 challenge, so services inside the mesh still have real, trusted TLS. The Cloudflare token can edit DNS on one zone and nothing else. One wildcard instead of a cert per hostname keeps restarts from tripping Cloudflare's rate limits.

Home box specifics

Game servers, SFTP and the metrics exporters bind to onprem01's mesh IP rather than 0.0.0.0, because Docker-published ports go around the host firewall. Docker is set to wait for the mesh interface at boot so those binds never race it. The Panel reaches Wings through Traefik over the Docker bridge, which needs both an INPUT and a FORWARD firewall rule for the bridge subnet.

Logging in to the mesh goes through Google. The OAuth app is kept in testing mode, so only accounts on its test-user list can sign in at all. That list is the allow-list, and adding a friend is one entry. Every allowed account has 2-Step Verification turned on. A local admin account in NetBird's own store is the fallback if Google is unavailable.

What each device can reach is decided by NetBird groups and policies. The default allow-all policy is deleted.

I'm the only member of admins. Anyone else who logs in lands in All and gets exactly one port. Shell access on the home server uses NetBird SSH, so it's tied to the same login and policies as everything else.

Prometheus on cloud01 scrapes node-exporter and cAdvisor on both machines, plus Traefik and CrowdSec, reaching the home box over the mesh. Grafana holds 90 days of history and emails me when a disk passes 85 %, memory or CPU stays above 90 %, or a target stops reporting. Uptime Kuma checks every service each minute and alerts on its own. Dozzle shows container logs for both boxes in one page. Homepage is the start page that ties it together, with live CPU, RAM and disk for each server pulled from Prometheus.

Because all of that runs on cloud01, cloud01 also checks in with an outside service every five minutes. If the check-ins stop, or the public front door stops answering, I get an alert from outside my own infrastructure.

Each box backs up nightly at 03:30 with restic to its own Backblaze B2 bucket, a different provider from the VPS, before Watchtower's update window. Backups are encrypted before they leave the machine and kept for 14 days, 8 weeks and 12 months, with a weekly integrity check and a dead-man ping that alerts if a night is missed. They include the Vaultwarden database, NetBird's encryption key together with its data, the Pelican database, the Wings node token and every game server's files.

Threat model

I'm defending against the background noise of the internet (scanners, credential stuffing, CVE probes), an untrusted apartment network, a friend's account being compromised, and my own mistakes. A well-resourced targeted attacker, physical access to the home box, and a breach of Linode, Cloudflare or Google are out of scope.

Attack surface

Layers, outside in

Accepted risks

The full list is in the repo. These cost the most time:

• A Docker network you create by hand ignores your configured address pool. Mine came up as 172.18.0.0/16 instead of the 172.20 in daemon.json, and every firewall rule I'd written silently matched nothing. Inspect, don't assume.
• Containers talking to a host-networked proxy need two firewall rules, one for INPUT and one for FORWARD. With one, you get timeouts that look like a routing bug.
• "does not match node token_id" was a CORS problem. The Pelican console talks to Wings straight from the browser, so Wings needs the Panel in allowed_origins, and the Panel has to be stopped from overwriting that file.
• NetBird's apt repository calls itself "Artifactory". With the obvious name in unattended-upgrades, clients never updated.
• Make Docker wait for the mesh on the home box, never on the cloud box. On cloud01 the mesh server itself runs in Docker, and the boot deadlocks.
• Turn on the firewall only after a second way in exists. I locked myself out of the home box once and fixed it with a monitor.

• Run Ethernet to the home server; it's on a Wi-Fi extender today.
• Move from debrid streaming to local media: Proxmox on the home box plus a second Proxmox storage server, mergerfs and SnapRAID over XFS data disks, a ZFS mirror for VMs, Jellyfin with Intel Quick Sync, downloads behind a VPN container. All mesh-only.

Every compose file, proxy config, firewall script and update policy described here is in the homelab repo on GitHub. Domains are replaced with example.com, and keys, tokens and IP addresses are left out; each secret has an .example file showing its shape.