Hello, how do you document your home lab? Whether it’s a small server or a big one with firewall and more nodes. I have a small pc with Proxmox and there I have a VM with OpnSense. After I’ve entered my VPN as a interface in OpenSense, I noticed that I slowly lose the overview with the different rules that I have built in my firewall. And I know that my setup is relatively easy in comparison to others here in this community. I want to have a quick Overview at the various VMs, like the Lxc container, Docker containers that I have in this and the IP addresses that I have assigned to them. I search for a simple an intuitiv way for beginners.
You must log in or register to comment.
Jokes aside, I do keep some harder to remember stuff written down in a README.md in my repo, but mainly most things are undocumented
I operate on the philosophy that it is better for me to relearn things than lean on old documentation that may no longer be accurate/relevant.
The best way to implement a safe connection to my home lab today might not be the safest way tomorrow.
Old dog, new tricks, etc.
Also! Your documentation is an attackers wet dream.
NB: this philosophy doesn’t scale.
Security by obscurity, baby!
What I don’t know, no phisher can get out of me!
I’m gonna try this neat trick at work
I do this continually for work as well, I approach every new project assuming best practice or approach options have changed. It doesn’t matter how experienced I am in what I’m doing, I still loop back and check.
It’s such an automatic thing I don’t even think about it, but honestly not sure if it’s because of interest or because of fear of being called out for doing something wrong lol
while security might be compromised if an attacker found your documentation, it could equally be compromised by having zero documentation
the easier it is for you to get things back up and running in the event of a data loss / corrupted hard drive / new machine / etc, the less likely you are to forget any crucial steps (eg setting up iptables or ufw)
Having 0 documentation doesn’t mean you have no DLP strategy. That’s amateur hour.
And again, NB: this does not scale.
“Shit, i hope i remeber the key words i searched for”
My wife was mentioning the other day that if something happened to me she’d have absolutely no idea how to work any of this shit and that convinced me to actually start documenting it LMAO
Good time to start doing it too. Aside from setting up a NAS this weekend and figuring out an audiobook solution (not something I’ve ever dabbled with but I really should start reading some communist theory), I’ve got this project right where I want it for a long while.
Guilty too. There are names on router- and switch interfaces. Servers get fixed IP from dhcp so is in the note field there too. That’s about it
I download the YouTube tutorials I followed, upload them to my UAT Jellyfin server, and then when my server is having issues I can’t get to the videos!
A flawless system really
Lol.
I build my infrastructure with the terraform, Ansible and helm charts. The code is it’s own documentation as well as comments in that code explaining why I’ve done things if it’s not obvious.
This really is the way.
It goes beyond documentation too - it allows me to migrate to new hosts or to easily automate upgrading the OS release version.
I have a docusaurus site for my homeland and I have ansible and terraform generate files for the docs so I don’t have to record anything. Some of the stuff I note down:
- DNS leases
- General infra diagrams
- IP info
- Host info
I am fortunate enough to only manage a homelab and not an enterprise sized network. So I don’t document anything just like at work.
Brill. One of us.
I have NixOS running on mine and I write everything in comments in my
configuration.nix. Usually I’ll write notes about why I set a certain option above the line where I do it but I also have a section at the start that describes anything to be aware of if I’m moving this configuration to another machine. For example “This assumes a drive is mounted on/mnt/backup0”95% of my homelab lives on a single server, and everything I do is within containers. So, my documentation is just keeping all my compose files in a git repo and writing in comments when necessary. It’s fairly self-documenting, and I haven’t found the need to break out of just using containers for everything, besides a couple things like setting up mergerfs or cockpit, but that’s all plug and play nowadays with stuff like https://projectucore.io/
Of course, I don’t have any other things set up in my physical layout or network stack… but all that stuff would probably just go into an entry in my notes (obsidian/wiki.vim).
I just created a note in Obsidian with the Excalidraw plugin.
I use obsidian and ezcalidraw also, I didn’t realize we can put one in the other
I generally just make notes in Obsidian, mostly about switch ports, VLANs, IP assignments and that kind of thing.
Also try to save snippets of commands or config edits I needed to get something obtuse working in case I need to do it again later.
A combination of Logseq (what, why, how) and KeePass for IPs and passwords (obviously)… I use the heirarchy in Keepass to show a device and then the services on it and then their configs, ie
- Hypervisor1
- VM1
- root user details
- that webUI details
- VM2 (Etc)
- VM1
I used to do Visio drawings, but they were always out of date.
- Hypervisor1
I don’t, and I know that I’m fucked one day.
It’s really a wild growth over the years. My current approach is twofold. Netbox to manage devices/VMs and associated info with service deployments using Ansible. You can use the info from Netbox as an Ansible inventory directly.
Previously I tried network diagrams (too low detail) and spreadsheets (terrible to modify) to document machines. And for serviced I’d have an install page on my wiki (apologies, the codeblocks are somewhat broken atm)
I run Netbox for documentation only. But your approach is what I actually wanted to do, if I just had plenty of time.
I use netbox too - and if you’re careful about it, you can actually use terraform to create the netbox details. I use one manifest file to handle deployment to Proxmox, set up DNS in PowerDNS, and create the relevant netbox entries.
The way you go about it on your wiki, is almost the same process/format, tho not as fancy . I’ll even throw in a couple links to tuts I found useful for that particular segment in the notes.
I have it in a git repo, broken down by the nodes and vps names. In each of these folders is a mixture of Ansible playbooks, docker compose or just markdown files with the descriptions. Some is random stuff - my VPS allows the export of the cloud firewalls as JSON for instance. All the secrets needed by Ansible are in an Ansible vault, the rest in KeePass.
I just try to make everything as self documented as possible. Eg. no stray scripts, everything is either implemented in other software (eg. my main wireguard peer in systemd-networkd, without any non-obvious external dependencies) or tracked as a part of an arch pkg with a simple PKGBUILD. I usually either have very simple nets (eg. my VPN’s net only consists of four peers, in the order main - secondary - laptop - phone) or leave it to DHCP and SLAAC. I try to avoid using ports for local servers as much as possible and use unix sockets. Stuff like LVM/Luks pretty much documents itself.
I use the notes sections in proxmox preeettty heavily. Lots of links to the helper scripts, youtube videos and other resources i used to get er’ goin’.
In the near future I’m really hoping I can set up Netbox to help me document the network and equipment I’m putting in my homelab. a nice thing is that I went through a divorce a while ago and I’m getting to start from scratch. You’d be surprised at just how much you’ve learned since starting to self host and I think there’s this sunk cost fallacy that gets a lot of us to keep going with what we’ve got already set up because we’ve “already put so much work into it” and the concern of what we might lose by scrapping it and starting over.
Also, not what you asked… but if you’re still relatively new with proxmox you should check out the ProxmoxVE helper scripts. Lots of good automated scripts from doing a post-install to setting up various LXC containers and VM’s
RIP Tteck! (not sure if i spelled it right)
