Labs
Practice infrastructure work in a controlled environment.
Rehearse a deployment, recovery, validation, automation, or troubleshooting workflow before the real change window. These projects are useful for home and learning environments, but the goal is operator practice: prerequisites, steps, evidence, validation, and what to try next.
Choose A Practice Path
Start with the kind of system or workflow
01Network and DNSPi-hole, split DNS, DHCP, VLAN-aware services, network visibility, and practical edge services.7 labs02Storage and BackupNAS patterns, snapshot verification, backup hygiene, and family-safe storage systems.6 labs03Virtualization and ContainersProxmox, Docker, lightweight Kubernetes, dev environments, and reproducible service platforms.6 labs04Monitoring and ObservabilityDashboards, health checks, logs, alert routing, and operational visibility for homelab services.4 labs05Remote Access and SecurityWireGuard, Tailscale, identity, access controls, hardening, and low-friction remote administration.3 labs06PowerShell and Admin AutomationReusable scripts, reporting tools, endpoint automation, and repeatable operator workflows.6 labs07Home Automation and IoTHome Assistant, MQTT, Zigbee, Raspberry Pi utility nodes, and practical household automation.4 labs08Self-Hosted Services and ProductivityDocumentation portals, dashboards, media utilities, note systems, and practical family or team services.6 labs
Lab Library
Browse every hands-on guide by path
Network and DNS
Pi-hole, split DNS, DHCP, VLAN-aware services, network visibility, and practical edge services.
Create a WireGuard plus Split DNS Lab for Secure Remote Access to Self-Hosted ServicesBuild a two-client WireGuard lab with split DNS, explicit routing, resolver selection, firewall/NAT boundaries, and deterministic failover/teardown tests.Build a Small Office Network Monitoring Stack with LibreNMS, Syslog, and Alert RoutingBuild a small-office monitoring path that proves one SNMP device, one syslog event, and one routed alert end to end instead of installing three disconnected products.PowerShell Health-Check Pack for Active Directory, DNS, DHCP, and Certificate ExpirationBuild a parameterized PowerShell health-check pack with testable AD, DNS, DHCP, and certificate functions, structured results, and controlled negative tests.Build a Home Network Visibility Dashboard with ntopng, Syslog, and VLAN Traffic SummariesBuild an ntopng visibility dashboard around one explicit traffic-observation topology, then prove traffic from the intended VLANs actually reaches the sensor and is attributed correctly.Small Office DHCP and DNS Evidence Audit with PowerShellCollect DHCP scopes/leases and DNS records read-only, then run explicit stale/conflict checks instead of changing execution policy or treating raw exports as an audit conclusion.Create a Secondary Pi-hole DNS Node and Test Resolver ResilienceBuild an independent secondary Pi-hole resolver, align the settings that should match the primary, and test both resolvers before advertising them together to clients.Creating a WireGuard Jump Host with MFA-Friendly Access PatternsBuild a WireGuard transport to a hardened jump host, then enforce MFA at the administrative login boundary instead of implying that WireGuard itself provides MFA.
Storage and Backup
NAS patterns, snapshot verification, backup hygiene, and family-safe storage systems.
Build a Backup Verification Workflow for Hyper-V or Proxmox VMs with Scheduled Restore ChecksBuild a repeatable VM backup-verification workflow that proves a selected recovery point can be restored into an isolated test target and records evidence before the restored VM is removed.Build a TrueNAS Replication Lab with Snapshot Schedules and Rollback ValidationUse a disposable ZFS dataset to prove snapshot, replication, retention, destructive-change recovery, and rollback between two TrueNAS systems.Plan and Prove a Family NAS Backup with Snapshots and Offsite CopiesTurn a vendor-neutral NAS idea into a completion-oriented backup exercise: define protected data and RPO/RTO, configure versioned local snapshots plus one concrete offsite target, and prove a file restore.Build a Proxmox Backup Server Lab with Retention Policies and Monthly Recovery DrillsBuild a Proxmox Backup Server lab around a current datastore/repository integration and a safe manual recovery drill, then turn the drill into a repeatable monthly procedure.PowerShell Home Lab Toolkit for Backup Freshness, Service Health, and Daily StatusBuild a small PowerShell operations toolkit that records backup-file freshness, checks selected Windows services, writes durable daily evidence, and runs on a controlled schedule.Windows File-Share Backup Artifact Freshness Audit with PowerShellAudit the freshness and completeness of known backup artifacts for a Windows file share without pretending file timestamps prove backup-job success.
Virtualization and Containers
Proxmox, Docker, lightweight Kubernetes, dev environments, and reproducible service platforms.
Build a Homelab CI Pipeline for Docker Services with Rollback SupportBuild one complete GitHub Actions pipeline for a disposable Docker service: test, build, publish a versioned image, deploy it, deliberately fail the new version, and roll back to the previous digest/tag.Raspberry Pi MQTT and Zigbee2MQTT Utility Node for Home AssistantUse a Raspberry Pi as a dedicated Mosquitto and Zigbee2MQTT utility node, with Home Assistant as a separate consumer, explicit authentication, stable Zigbee device mapping, and end-to-end message validation.Proxmox Starter Cluster Lab with Quorum, Templates, Backups, and Placement DecisionsBuild a disposable three-node Proxmox cluster, verify quorum and network requirements, create one reusable guest template, back it up, restore it, and document placement decisions...Raspberry Pi Rack Temperature and Service Alert MonitorBuild a Raspberry Pi monitor with a supported digital temperature sensor, explicit wiring/calibration checks, durable readings, and a controlled service-alert test.Create a Docker Reverse Proxy Lab with Nginx Proxy Manager and TLSDeploy Nginx Proxy Manager with persistent data, route one disposable backend through a real hostname, and validate HTTP-to-HTTPS behavior plus certificate issuance without exposing the admin interface unnecessarily.Build a Raspberry Pi Container Host with Docker ComposeBuild a maintainable Raspberry Pi container host with Docker Engine, the current Compose plugin, service health checks, and a controlled update workflow.
Monitoring and Observability
Dashboards, health checks, logs, alert routing, and operational visibility for homelab services.
Build a Targeted Windows Event Log Collector with PowerShellCollect a defined set of Windows events incrementally with PowerShell and Task Scheduler, prove the collector with a known test event, and avoid presenting raw CSV export as a complete log-management platform.Build a Loki Log Aggregation Starter Lab with Grafana AlloyRun Grafana's current Loki quickstart as an evaluation Lab, collect generated logs with Grafana Alloy, query them through Grafana, and capture the exact downloaded configuration...Create a Homelab Uptime Dashboard with Prometheus, Blackbox Exporter, and GrafanaBuild a small service-health Lab where Prometheus sends HTTP probes through Blackbox Exporter, Grafana visualizes probe_success and latency, and a disposable web service provides...Create an Uptime Kuma and Grafana Homelab Monitor with Prometheus MetricsDeploy Uptime Kuma v2 for endpoint checks and status pages, scrape its supported /metrics endpoint with Prometheus, and visualize response-time/status metrics in Grafana without...
Remote Access and Security
WireGuard, Tailscale, identity, access controls, hardening, and low-friction remote administration.
Build a Restricted Tailscale RDP Administration PathCreate one explicit Windows remote-admin path where RDP is reachable only over the intended Tailscale network and identity policy, then prove both allowed and denied access paths.Build a Small Identity Lab with Authentik or KeycloakCreate one small identity-provider Lab using either Authentik's official Compose bundle or Keycloak's current development container, then validate a realm/application/user flow...Build a Raspberry Pi Split-Tunnel Travel Gateway with WireGuardBuild one concrete two-interface Raspberry Pi travel-gateway topology, route only home-lab subnets through WireGuard, and prove behavior from a genuinely external network.
PowerShell and Admin Automation
Reusable scripts, reporting tools, endpoint automation, and repeatable operator workflows.
Build a Repeatable Dev Container for PowerShell, Terraform, and Azure CLIDefine PowerShell, Terraform, and Azure CLI as Dev Container Features on an Ubuntu 24.04 base so the toolchain can be rebuilt from configuration instead of hand-installed scripts.Idempotent Windows Workstation Onboarding with PowerShell and wingetBuild an onboarding script around explicit package IDs, idempotent settings, reboot handling, logging, and a rerun-safe validation report.Windows LAPS and Local Administrator Membership Audit LabUse Windows LAPS for supported local administrator password management and PowerShell for read-only local Administrators-group drift reporting instead of inventing a password-rotation secret store.Build a Reusable Windows Software Inventory Script from Registry EvidenceInventory machine-wide installed applications from 64-bit and 32-bit uninstall registry views, normalize duplicate records, and document what registry inventory does not cover.Build a Read-Only SMB and NTFS Permission Evidence Report with PowerShellCollect SMB share ACLs, NTFS ACLs, inheritance/ownership, and group-membership evidence without auto-remediating permissions or pretending one ACL layer equals effective access.Build a Windows Patch Evidence Reporting Workflow with PowerShell and Scheduled ScansBuild a scheduled Windows patch-evidence report with PowerShell and Get-HotFix, then validate the generated CSV and scheduled task.
Home Automation and IoT
Home Assistant, MQTT, Zigbee, Raspberry Pi utility nodes, and practical household automation.
Build a Frigate to MQTT to Home Assistant Event PipelineBuild one observable event path from a disposable camera/test stream through Frigate and MQTT into a Home Assistant automation, with pinned configuration and payload-level validation.Build a Home Assistant Power and Energy Monitoring LabUse one known-compatible metering device to distinguish instantaneous power (W) from accumulated energy (kWh), validate Home Assistant statistics, and prove a threshold automation safely.Build a Home Assistant Starter Lab with Dashboards, Backups, and Room-by-Room Entity OrganizationBuild a current Home Assistant starter environment on a Raspberry Pi with Home Assistant OS, room-based Areas, a useful dashboard, and automatic backups stored beyond the device.Build a Home Assistant Family Notification Hub with Quiet HoursConnect one current calendar/event source to one notification target, implement explicit quiet-hours logic and escalation exceptions, and prove behavior before, during, and after the quiet window.
Self-Hosted Services and Productivity
Documentation portals, dashboards, media utilities, note systems, and practical family or team services.
Build a Lightweight Internal Git and Script Catalog with GiteaRun a small Gitea instance from the current rootless container image, keep the web service behind an internal HTTPS boundary, and prove the catalog by creating, cloning, and...Create a Paperless-ngx Document Workflow with OCR and Restore ValidationDeploy a small Paperless-ngx Lab from the project's maintained Docker Compose files, ingest and OCR a test document, then use the supported document exporter/importer workflow to...Create a Lightweight k3s Lab for Self-Hosted ServicesBuild a small k3s lab using the bundled Traefik ingress controller and local-path storage, then validate a complete service path before adding real self-hosted workloads.Build a Self-Hosted Homepage Dashboard for Homelab ServicesDeploy the current Homepage project with Compose v2, configure real service links and built-in URL health checks, and keep Docker-socket access out of the first Lab so the...Build a Vaultwarden Lab with HTTPS, Backups, and Recovery ValidationDeploy Vaultwarden behind an HTTPS reverse proxy, keep the application bound to localhost, disable open signup after bootstrap, and create a consistent backup of the vault data...Build a Jellyfin Media Server with Verified Configuration BackupsInstall Jellyfin on a supported Debian or Ubuntu host using the current signed repository workflow, validate playback and metadata, and prove that the server configuration and...