Current Software — baobab.band Homelab
A snapshot of deployed software as of April 2026. Purpose: inform design decisions for V5 by documenting what has been proven in service.
All containerised services use Docker Compose. A shared Ansible role (baobab.container_base) handles Compose generation and Traefik wiring. Each app has its own role (baobab.container_<name>).
fisi — Main Application Server
Reverse Proxy & DNS
| Software |
Notes |
| Traefik |
HTTPS reverse proxy for all LAN services; DNS-01 via Cloudflare for *.baobab.band |
| Technitium DNS |
Authoritative for baobab.band; wildcard *.nyumbani.baobab.band → 10.20.10.17; ad blocking |
Media
| Service |
URL |
Notes |
| Jellyfin |
jellyfin.nyumbani.baobab.band |
Video streaming; Intel Quick Sync (GPU passthrough) |
| Audiobookshelf |
abs.nyumbani.baobab.band |
Audiobooks and podcasts |
| Calibre Web |
books.nyumbani.baobab.band |
Ebook library |
Media Automation
| Service |
URL |
Notes |
| Sonarr |
sonarr.nyumbani.baobab.band |
TV series automation |
| Radarr |
radarr.nyumbani.baobab.band |
Movie automation |
| Lidarr |
lidarr.nyumbani.baobab.band |
Music automation |
| Prowlarr |
prowlarr.nyumbani.baobab.band |
Indexer manager |
| Lazylibrarian |
lazylibrarian.nyumbani.baobab.band |
Book and comic automation |
| qBittorrent |
qbit.nyumbani.baobab.band |
Torrent client; runs inside Gluetun VPN container (NL exit) |
| Gluetun |
(internal) |
VPN container wrapping qBittorrent; PIA, Netherlands |
| ytdl |
ytdl.nyumbani.baobab.band |
YouTube downloader; integrated with Jellyfin |
| FlareSolverr |
port 8191 |
Cloudflare bypass for indexers; no Traefik route |
| Recyclarr |
(internal, no UI) |
Sonarr/Radarr quality profile sync |
Files & Productivity
| Service |
URL |
Notes |
| Nextcloud |
nextcloud.nyumbani.baobab.band / nextcloud.baobab.band |
Files, calendar, contacts; MariaDB backend |
| Nextcloud Exporter |
port 9205 |
Metrics for Prometheus |
| Vaultwarden |
vaultwarden.baobab.band |
Bitwarden-compatible password manager |
Communication
| Service |
URL |
Notes |
| conduwuit |
(Matrix server, no public web UI) |
Matrix homeserver |
| Element Web |
element.matrix.baobab.band |
Matrix web client |
| ntfy |
ntfy.baobab.band |
Push notification broker |
| Poste.io |
mail.baobab.band |
SMTP/IMAP/webmail; DKIM managed post-deploy |
Development & Admin
| Service |
URL |
Notes |
| Forgejo |
forgejo.nyumbani.baobab.band |
Home Git forge; SSH on port 7577 |
| SnipeIT |
snipeit.nyumbani.baobab.band |
IT asset management; MariaDB backend |
| Homepage |
homepage.nyumbani.baobab.band |
Service dashboard |
| Laser course |
laser.baobab.band |
Static course website |
| Rullemenu |
rullemenu.baobab.band |
Menu display (shared facility context) |
| Minecraft |
(port-forwarded) |
Java+Bedrock via Geyser + Floodgate plugins |
Observability
| Software |
Notes |
| Grafana Alloy |
Docker log forwarding to Loki on tembo; also ships Technitium DNS logs as file source |
| Node Exporter |
port 9100; system metrics scraped by Prometheus on tembo |
| rsyslog |
Forwards syslog to tembo |
tembo — Monitoring Stack + Kiosk
Observability Stack
| Software |
URL |
Notes |
| Prometheus |
prometheus.nyumbani.baobab.band (port 9090) |
15s scrape, 15-day retention; scrapes: node-exporter, traefik, nextcloud, backup-clients, snmp, loki, grafana, prometheus, alloy |
| Grafana |
grafana.nyumbani.baobab.band |
Dashboards; Matrix bot for alerts |
| Loki |
port 3100 |
Log aggregation for all hosts |
| Grafana Alloy |
port 12345 |
Syslog hub (UDP relay from EAP610 APs → Alloy TCP → Loki) |
| SNMP Exporter |
port 9116 |
WiFi APs (tai1/tai2) and Punda switch |
| Node Exporter |
port 9100 |
|
Kiosk
| Software |
Notes |
| GNOME kiosk |
Chromium-based display cycling through: Deezer, Home Assistant, DSB departures, laundry booking, Jellyfin music, Rullebiler.dk car booking, Rullemenu |
| kiosk-control |
kiosk.nyumbani.baobab.band — web UI to switch kiosk tabs |
| button handler |
USB button device input; test mode enabled |
Photo Management (migrated from fisi)
| Service |
Notes |
| PhotoPrism |
photo.nyumbani.baobab.band; Intel Quick Sync GPU; MariaDB backend |
| MariaDB 11 |
PhotoPrism database |
papa — NAS
| Software |
Notes |
| NFS server |
Exports /storage/baobab_media to fisi; subdirectory structure for movies, TV, music, books, audiobooks, downloads |
| Samba |
SMB share on baobab_media; guest/public access; no auth required |
| Borg (server) |
Receives Borg backups from: fisi, tembo, kuku, faru, baobab.band, rullebiler.dk, laptops |
| rclone |
Syncs pCloud accounts for 4 family members (EU datacenter); stores clones under /storage/cloud-clones |
| ClamAV |
Targeted antivirus scan of /storage/baobab_media/downloads; alert email via Fastmail SMTP |
| Node Exporter |
port 9100 |
| rsyslog |
Forwards syslog to tembo |
| HAOS config |
Deploys automations to twiga (Home Assistant) |
| Simba/AP/Switch backup |
Pull backups of OPNsense config.xml, EAP610 /etc, Punda system.cfg via SSH/SCP into Borg |
kuku — WireGuard VPN Gateway
| Software |
Notes |
| WireGuard (server) |
Native kernel WireGuard; port 51194/UDP; public hostname kuku.baobab.band; hub for laptops + VPS spokes |
| Node Exporter |
--collector.wireguard enabled; requires NET_ADMIN cap |
| rsyslog |
Forwards syslog to tembo |
Peers: paka, mamba, swala (managed laptops), sjat-phone, tais-work-laptop (non-managed), baobab.band, rullebiler.dk (VPS spokes), ash-linux, ash-phone, ash-windows.
simba — Firewall
| Software |
Notes |
| OPNsense |
Firewall, router, DHCP, NAT; native os-node_exporter plugin |
faru — Management Pi
| Software |
Notes |
| Node Exporter |
port 9100 |
| Borg client |
Backs up to papa |
| rsyslog |
Forwards syslog to tembo |
twiga — Home Automation
| Software |
Notes |
| Home Assistant OS |
Automation platform; Ansible manages automation config (not the OS) |
kobe — Backup Server
| Software |
Notes |
| rsnapshot |
Pull-mode backup server; pulls /home/* dirs and Docker volumes from mamba |
| ZFS |
Backup pool on mirror; compression lz4 |
VPS: baobab.band
| Software |
Notes |
| Traefik |
HTTPS entry point |
| Uptime Kuma |
External uptime monitoring; public at status.baobab.band |
| Grafana Alloy |
Docker log forwarding to Loki on tembo (via WireGuard) |
| Node Exporter |
port 9100 (publicly exposed; scraped from tembo) |
| WireGuard (client) |
Spoke to kuku; tunnel IP 10.8.0.10 |
VPS: makerfloss
| Software |
URL |
Notes |
| Traefik |
— |
Gandi DNS-01 for makerfloss.eu |
| Forgejo |
forgejo.makerfloss.eu |
MakerFLOSS community Git forge; SSH on port 7577 |
| SnipeIT |
snipeit.makerfloss.eu |
MakerFLOSS asset management; MariaDB backend |
| Poste.io |
mail.makerfloss.eu |
Mail server for makerfloss.eu |
| Node Exporter |
port 9100 (publicly exposed) |
|
Note: No WireGuard tunnel yet — isolated from homelab network. No Borg backup currently.
VPS: rullebiler.dk
| Software |
URL |
Notes |
| Traefik |
— |
Cloudflare DNS-01 for rullebiler.dk |
| Rullebiler.dk site |
rullebiler.dk |
Static website |
| MRBS |
booking.rullebiler.dk |
Room/resource booking; MariaDB backend; billing enabled |
| Poste.io |
mail.rullebiler.dk |
Mail server for rullebiler.dk |
| Uptime Kuma |
status.rullebiler.dk |
Uptime monitoring |
| Grafana Alloy |
— |
Docker log forwarding to Loki on tembo (via WireGuard) |
| Node Exporter |
port 9100 |
|
| WireGuard (client) |
— |
Spoke to kuku; tunnel IP 10.8.0.11 |
Laptops (paka, mamba, swala, mbuzi)
All four run Debian + XFCE. Per-user multi-user configuration managed by Ansible.
Common to all laptops
| Software |
Notes |
| XFCE desktop |
Ansible-managed config (xfconf, panel, autostart); dark theme (Adwaita-dark) |
| Node Exporter |
port 9100 |
| WireGuard client |
Automatic endpoint switching (LAN vs. remote) via VPN toggle script; mbuzi excluded |
| Borg backup client |
Backs up /home, /etc, /srv to papa; excludes pCloud, caches, Downloads |
| Nextcloud desktop client |
Per-user (kine on paka, ash on swala, sarah on mbuzi, sjat on mamba) |
| pCloud |
AppImage; auto-started for all 4 family users |
| Thunderbird |
Pre-seeded profiles for all family baobab.band accounts; CalDAV calendars via Fastmail |
| LibreOffice |
Managed by Ansible role |
| VirtualBox |
Installed for sjat and kine |
| PIA VPN |
Private Internet Access GUI client; sjat install user |
| Claude Code |
Latest version |
| Gemini CLI |
Via npm |
| Neovim |
Config managed via Ansible (lazy.nvim; LSP, treesitter, telescope, git plugins) |
| rsyslog |
Forwards syslog to tembo |
| fcitx5 + Pinyin |
paka only, for kine |
Per-user Flatpaks
| App |
Users |
| SpeedCrunch |
all |
| Joplin Desktop |
all |
| Signal |
all |
| FreeCAD |
all |
| VS Code |
sjat only |
| Lunar Client (Minecraft) |
mamba (sjat+ash), swala (ash) |
| Riot/Element |
mamba |
Cross-cutting: Infrastructure Patterns
Observability
- Metrics: Prometheus on tembo scrapes all hosts via node_exporter, plus Traefik, Nextcloud, Loki, Grafana, Prometheus, Alloy self-metrics, and SNMP for APs/switch.
- Logs: rsyslog on all hosts → tembo; Docker logs forwarded via Grafana Alloy → Loki; EAP610 AP syslog → tembo rsyslog UDP relay → Alloy.
- Dashboards: Grafana on tembo. Grafana Alloy bot posts alerts to Matrix.
- External uptime: Uptime Kuma on baobab.band VPS (public) and rullebiler.dk VPS.
Backup
- Borg (primary, push): all servers and laptops push to papa over SSH. Pre-dump: MariaDB databases (PhotoPrism, Nextcloud) dumped to
/var/backups/borg-prep before Borg runs. Status reported via node_exporter textfile collector → Prometheus.
- rsnapshot (secondary, pull): kobe pulls
/home dirs + Docker volumes from mamba.
- Cloud sync: pCloud (EU) for 4 family members via rclone on papa.
- Network device configs: papa pulls OPNsense
config.xml, EAP610 /etc, Punda system.cfg into Borg.
DNS
- Technitium on fisi is authoritative for
baobab.band (LAN-internal split-horizon).
- Wildcard
*.nyumbani.baobab.band → 10.20.10.17 (fisi) with explicit overrides for tembo services.
- Public DNS (
*.baobab.band) via Cloudflare; managed declaratively via Ansible Cloudflare role.
makerfloss.eu via Gandi DNS, managed by Ansible Gandi role.rullebiler.dk via Cloudflare, managed by Ansible.
IaC
- Ansible (AnsibleBaobabV4); all config in
host_vars/<host>.yml.
baobab.container_base role: Compose template generation + Traefik label wiring.- Secrets in Ansible Vault (
group_vars/all/90-secrets.vault.yml).
- Two inventory environments:
prod and lab.
