Done. And appreciate the guidance.

Rasputin will let you take a bunch of random hardware (Pi, TuringPI, LattePanda, an old laptop, etc), homogenize them, and allow you to run apps like Home Assistant, Vault Warden, etc. on them. It takes a few minutes to get up and running and has built in DNS, Certificate Authority, Tailnet, Docker deployment, an observability stack, and supports a/b updates. AGPL license.

Basically, I was sick of always having to recreate that stack every time I rebuilt the home lab. Now it’s all baked in and flashes machines with a single bash script - managed through the control plane ui.

And my first post and I already forgot the disclosure: https://github.com/geekdojo/rasputin-os/blob/main/AI_DISCLOSURE.md

I use Azure Storage Accounts - costs about $0.76 for 37GB per month. I’m still using an old Synology DS918+ but it backs up automatically to the Storage account every day. If you go that route, be sure to edit the network configuration, set it to only access from “selected networks”, and then put in your home IP or CIDR. Use that and an access token so you have at least two controls preventing the internet from accessing it.

Agree with all the comments here - old iPads make a great dashboard for Home Assistant (and most other home automation systems). If you want to wall mount it there are several vendors that offer surface or flush mount. Get yourself a poe to usb convertor and you’re done.

I might get in trouble for saying this on this channel ;) - BUT - If memory serves, Proxmox has native support for backing up to an AWS S3 bucket. I think I paid something like $3/month for it when it was setup - very minimal. While not really “self hosting”, I would argue backups are the one thing you should actually do offsite, ideally with some resiliency.

Honestly, OPNSense has some fairly decent reporting that can take you a fair ways. https://docs.opnsense.org/manual/reporting_traffic.html

Watching the traffic in those tools can highlight a lot of concerns. Is outbound wide open from all networks?

In general, I wouldn’t recommend doing auth at the network layer. You could do radius, AD, or something similar if that’s a concern. You could use Tailscale and create a mesh overlay - I’d do that before VPN. Going down this road can, of course, cause a lot of challenges with phones and other iot devices. I tend to keep the iot vlan barebones for that reason.

I’ve honestly had decent luck with APC but also ran a lot of Tripp Lite. Eaton is decent. Using their calculator, this model (https://www.eaton.com/us/en-us/skuPage.5S1500LCD.html) would run for 71 minutes on a 100W load. It’s going to be hard to get below $300 for an hour of runtime. You’re going to want to target 1000VA or above.

At a minimum, I always do trusted, guest, and iot. I used to do “family” but, honestly everyone just ended up on iot because it was easier to control everything from their phones. Management is done from trusted. My current setup also includes DMZ and DC vlans for the homelab. I added a gaming vlan for one gaming PC the other day and moved that machine to it since games always have a bunch of port forwarding needs.