NAS & Homelab

Underneath this site, and most of what I run at home, is a Synology NAS running a Docker and Portainer estate: currently 29 containers across 13 stacks, covering media, monitoring, home automation, and network services. Every service is git-tracked as Compose-via-Portainer-Stack, with real secrets kept out of the repo in favor of environment placeholders and the macOS Keychain.

A Prometheus and Grafana stack, cAdvisor, node-exporter, and half a dozen service-specific exporters replaced an older all-in-one monitoring tool, feeding six dashboards across roughly nine scrape jobs. Every container runs with a restart-always policy, a rule written into the estate after a Docker daemon crash took down everything that wasn't self-healing, since documented as a postmortem.

The perimeter is hardened end to end: SSH is key-only on a non-standard port, WAN access is closed, and the firewall runs a default-deny, LAN-only policy since a legacy hypervisor and virtual switch were retired. Exposed credentials get rotated on discovery, and internal traffic between services runs over HTTPS via a reverse proxy with a real certificate.

It's less a product than an ongoing exercise in operating infrastructure the way I'd want a team to: inventoried, monitored, and reconciled toward Git as the source of truth, one stack at a time.