Back in February, I wrote about simplifying my homelab. Since then I bought the MacBook, changed how all my files sync, redid the backups, and deleted a few services I had just set up. Pretty standard for me.

Network

Unifi everything. This part is basically unchanged.

• Firewall: UDM Pro
• Switch: USW-24-PoE
• APs: U6-LR, U6-Lite
• Living room: USW-Flex Mini

The VLANs haven’t changed:

I’ve never exposed services directly from home. The blog and Matrix still live on a Hetzner VPS, and the home network stays home.

Services

I tried a few more things, but somehow the list got shorter:

• Pi-hole/Unbound - DNS ad-blocking and recursive DNS, still running as an HA pair with Keepalived.
• Traefik - Reverse proxy for the few local services that remain.
• Grafana + Prometheus - General monitoring and Unbound statistics. I still use the dashboard I built with unbound-dashboard all the time.
• Homepage - Simple dashboard for getting to everything.
• Nebula-Sync - Keeps the two Pi-holes in sync.
• Matrix - Still on the Hetzner VPS, mostly because one friend still uses it. Its days may be numbered.

Bitwarden Lite, which was the shiny new thing in the February post, is already gone. I moved to 1Password. Bitwarden itself worked fine, I just didn’t want my password manager depending on my own infrastructure staying up.

Immich and Navidrome also came and went. Both are cool, I just wasn’t really using either of them. No reason to keep containers around so I can look at them on Homepage.

Hardware

• Arch Workstation (9900X3D, 9070XT, 64GB RAM) - Still my main machine. I never did switch to NixOS because Arch isn’t giving me a reason to.

• MacBook Pro - I finally bought the laptop I was rambling about. I use it as a real second computer instead of remoting into the desktop. macOS has annoying shit, but the hardware and battery life are stupidly good.

• Synology DS218+ (2x 12TB shucked drives, SHR1) - Still doing backups and cold storage. I don’t work from network shares anymore, so it doesn’t need to be fast.

• Intel NUC 14 Pro (32GB RAM, 2TB NVMe) - Still the only Proxmox host. I encrypted the ZFS root since the last post. More work than I expected, but it works.

• Raspberry Pi 4 (4GB) - Backup Pi-hole/Unbound server and Keepalived peer. DNS survives if the NUC is down.

• Hetzner VPS - Blog and Matrix. The blog lives in Git, so I don’t back up the whole VPS or care much about rebuilding it.

• iPhone 14 Pro Max - Still here. Still too heavy. Still just works. Ugh.

The OVH dedicated server from the previous post is gone. The Monero node was neat, but I wasn’t using the rest of the server enough to justify keeping it.

Data and sync

My Arch workstation and MacBook sync four boring folders directly over the LAN:

notes
records
pics
inbox

Syncthing moves those folders directly between the two computers. There’s no mounted NAS share and no always-on sync server in the middle anymore.

I did briefly build a Debian LXC to act as that middlebox. It gave me another copy of the data, but also another machine and backup job to care about just so two computers could sync. I destroyed it and connected them directly.

Code moves through Git, dotfiles through chezmoi and GitHub. Photos land in iCloud. Old dormant stuff sits in an encrypted archive on the NAS, and junk goes in ~/dl or /tmp where it belongs.

The Mac keeps normal macOS paths and Arch keeps my lowercase Linux layout. I originally tried making the paths identical, which was pointless. Syncthing matches the folder IDs and doesn’t care where they live.

Backups

The February setup copied the workstation to the NAS with rsync, then relied on the NAS to send everything offsite. I changed that quite a bit:

Arch $HOME ──Restic──→ NAS
          └──Restic──→ B2

NAS archive ──Restic──→ B2

Proxmox guests ──vzdump──→ NAS

Resticprofile runs the workstation jobs with systemd user timers. Missed runs catch up after boot, and healthchecks.io complains if a job goes quiet. The workstation’s B2 credentials are limited to its own bucket, with file versioning behind it in case something gets deleted or pruned.

I also restored and compared a real file from all three Restic paths. I used to run restic snapshots, see a list, and call that verified. That only proves it can read the repository metadata.

The Mac’s machine-specific state is the weak spot right now. The synced folders make it into the Arch backups, but local-only files still need Time Machine to the NAS.

What’s next?

Time Machine to the NAS is next. I also need to export iCloud Photos into the NAS-to-B2 path and fix the DNS failover check. Keepalived currently knows whether Pi-hole is running, not whether it is actually answering DNS, which is how I already managed to have “HA DNS” and a full DNS outage at the same time. Lovely.

I’m trying not to invent any new projects until those are done. No Kubernetes cluster, second Proxmox node, or random storage migration because I got bored on a Sunday.

This is a snapshot of July 2026. I’m not going to quietly rewrite it every time I delete another container. :)

Last updated: July 2026