Skip to content

Documentation for the savethemall.eu homelab

Machine translation of the French original.

This documentation describes the current state of the homelab: six Docker hosts, approximately three hundred containers (as of 2026-10-06), a two-stage reverse proxy, and an identity directory that manages access.

What this documentation is, and isn't

This is the revised and publishable version of the homelab's knowledge: what you need to know to operate without causing problems.

It is not a working memory. Incident reports, decision logs, and FAQs are stored in the Obsidian vault and are accessible via the wiki. A published page here represents a page that has been deemed stable; a note in the vault represents the state of knowledge at a given point in time.

The precise definition of roles, and the test that clarifies everything in one sentence: Where to write what.

Where to start

  • Infrastructure

    The hosts, their addresses, what is running on them, and where the data is stored.

  • Stacks

    The Compose conventions used in the homelab, and the lifecycle of a stack, from creation to decommissioning.

  • Network

    The path of a request from the internet, DNS resolution, and its double-hop.

  • Procedures

    Step-by-step instructions: publishing a service, patching a host, reading a secret.

The five key things that prevent most errors

  1. The WAN edge is the NAS, not vm-docker. A Layer 3 filter placed on vm-docker does not block anything: the source it sees is always nas. See Reverse proxy.
  2. curl https://<fqdn> from the LAN does not test the WAN. The DNS is in a dual-homed configuration. See DNS and resolution.
  3. In the vault, 10-stacks/<nom>/compose.yml is a dead symbolic link. The actual file resides on the host. See Conventions.
  4. On vm-docker and vm-compute-01, restart: on-failure:5, not always. docker-staggered.service is the only authority for booting.
  5. Two vaults: OpenBao for machine secrets, Vaultwarden for human secrets. Vaultwarden is already unlocked: never run bw unlock. See Reading a secret from the vault.

Editing this documentation

The content is written manually in docs/ from the repository homelab-docs. The process is in the README.md of the repository, and the mechanics are in Continuous Integration.

This site does not have an update frequency

It is rebuilt only on a push to main: event-driven, never periodic. No cron, no scheduled rebuild.

This is different from the wiki (Wiki.js), which is resynchronized every night because it derives from the vault — the vault moves on its own, so the wiki needs to catch up. Here, nothing can change without a commit, and a scheduled rebuild would rebuild it exactly the same.

Consequence: editing a note in the vault does not update this documentation. The two are not linked — see the role sharing below.

Dernière vérification de cette page : 2026-10-06