Homelab Essential Services (2026): Build Your Full Stack

I run over 30 self-hosted services across my homelab, on Proxmox and a handful of small machines. Most of them I could lose tomorrow and not notice for a week. This is the list I would rebuild first, in the order I would rebuild it, with the tool I actually use for each layer and the one I would tell you to skip.

I also run Azure for a living, so every layer here is picked partly for what it teaches you about the job, not just what it replaces at home.

---

What Services Should a Homelab Run? (Short Answer)

Ten layers: a hypervisor (Proxmox), files (Nextcloud), identity (an AD domain plus SSO), host security (UFW and CrowdSec), remote access with no open ports (NetBird or Tailscale), Docker Compose, backups you have tested, monitoring (Uptime Kuma first), a Windows Server lab, and a scanner plus SIEM (Wazuh). Add a reverse proxy, DNS ad blocking and a dashboard on top and you have a stack that looks like a small company’s.

Homelab Services List: My Pick for Each Layer

The whole list on one screen. The sections below explain each pick.

Layer	My pick	Easier alternative	Skip
1. Hypervisor	Proxmox VE	Ubuntu Server, containers only	TrueNAS SCALE, unless storage is the point
2. Files and office	Nextcloud	Syncthing for plain file sync	Self-hosted email, until everything else is boring
3. Identity	An AD domain, plus Authentik or Authelia for SSO	Entra ID free tier	Keycloak, unless you need it for work
4. Host security	UFW and CrowdSec	Fail2Ban on its own	Anything you would have to switch off to get work done
5. Remote access	NetBird or Tailscale	Cloudflare Tunnel for public sites	Port forwarding, ever
6. Containers	Docker Compose, with the files in Git	Portainer to look around	Kubernetes as your first platform
7. Backups	One tool, a second box, one copy off-site	Proxmox’s built-in backup jobs	Any backup you have never restored
8. Monitoring	Uptime Kuma, then Grafana and Prometheus	Netdata	Dashboards nobody gets alerted from
9. Windows lab	Windows Server evaluation, AD DS, DNS, DHCP	A single domain controller VM	Nothing. This is the CV layer
10. Scanning and SIEM	Wazuh and OpenVAS	Nessus Essentials	Wazuh on a box with under 8 GB of RAM

If You Only Have a Weekend: The First Five

1. Proxmox on whatever box you have. Everything else lives on it.
2. Docker Compose in one VM, with a Git repo for the compose files from day one. See Docker Compose for beginners.
3. Tailscale or NetBird, so you can reach it from anywhere without opening a port.
4. Uptime Kuma, so you find out something is down before someone in your house tells you.
5. Pi-hole. The first service everyone else in the house notices, for the right reasons.

That is a working lab. Layers 2, 3 and 6 to 10 are where it starts to look like a real IT estate, which is the bit employers pay for.

---

Pt1 – Foundations

1. Hypervisor & Host OS

The hypervisor or host OS is the foundational layer of your homelab, responsible for running your virtual machines and containers. Whether you choose Proxmox VE for its enterprise-grade clustering features, TrueNAS SCALE for unified storage and virtualization, or a lightweight Ubuntu Server for container-only use cases, this decision impacts performance, flexibility, and learning outcomes. A robust foundation lets you experiment with virtualization technologies such as KVM, ZFS snapshots, and live migration. Understanding this layer mirrors real-world data center operations and prepares you for enterprise infrastructure roles.

Popular Options:

• Proxmox VE: Industry-aligned hypervisor with built-in backup and clustering.
• TrueNAS SCALE: Combines NAS and virtualization for a storage-first approach.
• Raspberry Pi OS / Ubuntu Server (64-bit): Lightweight host for container-only setups.

✅ Pro Tip: Add Proxmox Backup Server to snapshot and secure your VMs for free.

My pick: I run Proxmox on mini PCs. Clustering, live migration and a snapshot before every risky change are the reasons to pick it, and they are also exactly what a VMware or Hyper-V admin does at work. TrueNAS SCALE is a good NAS that can run VMs; if you want a hypervisor, pick a hypervisor.

2. Nextcloud & Office-equivalents

Hosting your own Nextcloud or productivity suite teaches you how SaaS alternatives work under the hood and gives you full control over your data. You’ll learn about secure web server configuration, SSL certificate management, database optimization, and user permissions , all critical skills for web and application administrators. Self-hosted solutions also introduce you to concepts like federation, add-on app ecosystems, and collaborative document editing via Collabora or OnlyOffice. By understanding these platforms, you’ll gain valuable experience in deploying and scaling business-critical applications.

Popular Options:

• Nextcloud with Collabora or OnlyOffice integration
• CryptPad for privacy-focused collaborative docs
• Mailcow or Mail-in-a-Box for self-hosted email and mail flows

🔒 Why It Matters: Running your own productivity tools teaches real-world SSL, secure mail flows, and troubleshooting web app performance.

My pick: I run Nextcloud and it is the pick on this layer. I also run Mailcow, and it is the one service here I would tell you to leave until last. A mail server takes an afternoon to install. Getting its mail delivered to Gmail and Outlook is a separate job, with reverse DNS, SPF, DKIM and blocklists, and it is a poor first project.

---

Pt2 – Identity & Security Baseline

3. Identity & Access Management

Managing identities and permissions is at the heart of IT operations. Implementing Active Directory and Entra ID gives you insight into domain controllers, DNS, DHCP, Group Policy Objects, and cloud identity synchronization. You’ll learn how SSO solutions like Authelia or Keycloak integrate with multiple applications, enforcing centralized authentication and authorization. Hands-on experience in IAM is essential for roles in system administration, security engineering, and cloud architecture, where controlling access securely is paramount.

Key Components:

• Active Directory (Windows Server): Domain controller for DNS, DHCP, GPOs.
• Entra ID (Azure AD Free Tier): Hybrid identity and user synchronization.
• Authelia / Keycloak: Open-source identity providers for SSO.
• Vaultwarden: Self-hosted password manager (a Bitwarden-compatible server reimplementation, not a fork).

👥 Real-World Skill: Domain join a Windows 11 VM and apply GPOs to enforce security baselines.

My pick: My lab runs a real Active Directory domain, and it serves my internal DNS, so it is not a toy. For single sign-on across the web apps I am building towards Authentik. If you are starting, pick Authentik or Authelia. Keycloak is powerful, and it is worth learning only if your employer runs it.

4. Host & Container Security

Even a home lab mimics a production environment, so you need to protect it. Host and container security involves eliminating default credentials, enabling SSH key authentication, and configuring firewalls like UFW or nftables. Container best practices include using official images, avoiding privileged mode, and setting resource limits. Tools like Wazuh provide endpoint detection and response, while Nessus Essentials scans for vulnerabilities. Mastering these measures prepares you for cybersecurity roles and ensures your lab remains reliable and safe.

Baseline Tools:

• UFW + Fail2Ban: Firewall configuration and brute-force protection for Linux hosts.
• Wazuh: Host-based intrusion detection and SIEM platform.
• Nessus Essentials: Vulnerability scanner for up to 16 IPs.

🛡 Why It Matters: These hardening techniques translate directly to securing production servers and passing security assessments.

My pick: UFW on every host, restricted to your LAN, plus CrowdSec. I run CrowdSec because it shares blocklists across everyone using it, so an IP hammering someone else’s SSH is already blocked on yours. Fail2Ban only learns from your own logs.

---

Pt3 – Remote Access

5. Secure Remote Access (Zero Trust)

Traditional port forwarding exposes your entire network to risk; Zero Trust solutions mitigate this by only allowing authenticated and authorized connections. Cloudflare Tunnel offers a simple, free reverse proxy that secures traffic over TLS. Twingate provides granular access controls, while Tailscale uses WireGuard to create a secure mesh VPN. By adopting Zero Trust, you’ll learn modern network security paradigms used in enterprises around the world.

Options:

• Cloudflare Tunnel: Encrypted reverse proxy without open firewall rules.
• Twingate: Enterprise-grade Zero Trust network access (free for small teams).
• Tailscale: Peer-to-peer mesh VPN with minimal setup.

🌐 When To Use: Ideal for remote management, development, and accessing sensitive dashboards without exposing ports.

My pick: I use NetBird, self-hosted, because I wanted the control plane on my own kit. Tailscale is easier and the free tier is plenty for a homelab, so start there if you are unsure. Cloudflare Tunnel is for the things you want the public to see, like a blog. What I would not do is forward a port.

---

Pt4 – Containers

6. Docker & Container Management

Containers encapsulate applications with their dependencies, ensuring consistency across environments. Learning Docker teaches you about image creation, networking, volumes, and orchestration beginnings. Portainer offers a GUI to manage containers, networks, and storage, while alternatives like Podman show you diverse container runtimes. These skills are foundational for DevOps, software development, and cloud-native roles.

Core Tools:

• Docker Engine: Industry-standard container runtime.
• Portainer: Web-based management UI.
• Podman (optional): Docker-compatible alternative.

💪 If you’ve made it this far, you’re already ahead of most homelabbers. This foundation gives you the flexibility to run dozens of isolated services seamlessly.

My pick: Compose files in Git, every one of them. Mine live in a self-hosted Gitea, and rebuilding a service is a clone and a docker compose up -d. Portainer is useful for looking, not for editing: a change made by clicking is a change you cannot rebuild. I also run a K3s cluster, and it is deliberately not on this list. Learn it after Compose is boring.

---

Pt5 – Advanced & Career Simulations

7. Backups & Disaster Recovery

Data protection is non-negotiable in any environment. Understanding backup strategies , from snapshot-based solutions like Proxmox Backup Server to file-level tools like Restic and Veeam Community Edition , teaches you about retention policies, encryption, and restore procedures. Regularly testing restores builds confidence and ensures you can recover from hardware failures or accidental deletions.

Options:

• Proxmox Backup Server: Deduplicated VM backups and restores.
• Veeam Community Edition: Agent-based backups for Windows/Linux.
• Restic / BorgBackup / Duplicati: Lightweight, encrypted backups.
• Rclone: Cloud sync to B2, Wasabi, or Google Drive.

🔄 Real-World Task: Automate scheduled backups and validate restoration processes monthly.

My pick: Pick one tool and do three things with it: back up to a second machine, keep one copy somewhere other than your house, and restore something before you trust it. A backup you have never restored is a hope, not a backup. The tool matters far less than the test.

8. Monitoring & Alerting

Without monitoring, you’re flying blind. Tools like Prometheus collect metrics, Grafana visualizes them, and Uptime Kuma checks service availability. Netdata provides real-time performance insights, while enterprise options like PRTG Free or WhatsUp Gold Free simulate large-scale monitoring setups. Learning to configure alerts and dashboards equips you for roles in system reliability engineering and IT operations.

Options:

• Grafana + Prometheus: Time-series monitoring and alerting.
• Netdata: Instant performance metrics.
• Uptime Kuma: Simple uptime monitoring.
• PRTG Free / WhatsUp Gold Free: Sensor-based enterprise monitoring.

📊 Skill Boost: Set up email or webhook alerts for critical thresholds and test failure scenarios.

My pick: Uptime Kuma first. It takes ten minutes and tells you when something is down. Grafana and Prometheus come second, when you want to know why. Send alerts somewhere you will see them; mine go to Telegram. A dashboard nobody is alerted from is a screensaver.

9. Windows Server & Enterprise Lab

Many businesses rely on Windows Server for directory services, DNS, and file sharing. Building a Windows Server lab with Active Directory, DNS/DHCP roles, and Group Policy gives you practical experience for system administration positions. Integrating Microsoft Entra Connect (formerly Azure AD Connect) introduces hybrid identity concepts, essential for modern enterprise environments.

Essentials:

• Windows Server Eval: AD DS, DNS, DHCP roles.
• File Server: NTFS permissions and share management.
• Microsoft Entra Connect (formerly Azure AD Connect) or Entra Cloud Sync: Sync on-prem AD to Entra ID.
• Group Policy: Automate security baselines and configurations.

🏢 Goal: Join multiple Windows VMs to AD, manage via GPO, and experiment with Intune in a dev tenant.

My pick: This is the layer that ends up on a CV. In the UK Skills Radar this month, job ads asking for Active Directory have a median salary of £46k and ads asking for Entra ID £56k. The homelab version of that climb is a Windows Server domain at home, then syncing it to a free Entra tenant.

10. Vulnerability Management & SIEM

Enterprises continuously scan and monitor their networks to stay ahead of threats. Deploying Nessus Essentials or OpenVAS and aggregating logs with Wazuh gives you a sandbox to practice vulnerability assessment and incident detection. Learning these workflows prepares you for roles in cybersecurity analysis and compliance.

Options:

• Nessus Essentials: Up to 16 host vulnerability scans.
• Wazuh: Log collection, alerting, and threat detection.

🔍 Practice: Automate weekly scans, review findings, and apply remediations as if in production.

My pick: I run Wazuh and OpenVAS. Wazuh is the heaviest thing on this list: give it its own VM with at least 8 GB of RAM, and check that it is still receiving logs. Mine once went quiet for over two weeks and nothing told me, which is a better lesson in monitoring the monitor than any course.

---

Three Services the Ten Layers Miss

• A reverse proxy. One place for TLS certificates and one front door for every web app. I run plain Nginx; Nginx Proxy Manager or Caddy get you there faster.
• DNS ad blocking. Pi-hole or AdGuard Home. The comparison is in Pi-hole vs AdGuard Home; either is fine.
• A dashboard. I use Homepage. Once you pass ten services you will forget which port is which, and a dashboard is where you find out what is running.

---

Next Steps

• Secure Your Homelab Network
• Scripting Fundamentals: Bash and PowerShell
• Ansible Fundamentals: Agentless Configuration Management
• 10 Raspberry Pi 5 projects that advance your career

---

Planning which layer to build next? The homelab quiz maps your goals to a build path in two minutes, and the rest of our free tools live in the RTM Toolbox.

Related Guides

If you found this useful, these guides continue the journey:

• 5 Containers Every Homelab Should Run: a focused starting list
• Build Your First Homelab in 2026: getting the hardware sorted
• Docker Compose for Beginners: deploy these services with Compose
• Why Self-Host in 2026?: the case for owning your stack

Frequently Asked Questions

What services should every homelab run?

Every homelab should run: a reverse proxy (Nginx Proxy Manager or Traefik), monitoring (Uptime Kuma + Grafana), a dashboard (Homepage or Homarr), container management (Portainer), DNS (Pi-hole or AdGuard Home), file storage (Nextcloud), and backups (Proxmox Backup Server or Borg). Add media (Plex/Jellyfin) and password management (Vaultwarden) as you grow.

What is the best Docker stack for a homelab in 2026?

A solid 2026 homelab Docker stack includes: Nginx Proxy Manager (reverse proxy + SSL), Portainer (container management), Uptime Kuma (monitoring), Pi-hole (DNS + ad blocking), Nextcloud (files/calendar/contacts), Homepage (dashboard), and Grafana + Prometheus (metrics). All can run on a single mini PC with 16GB RAM.

How much RAM do I need for a homelab server?

For Docker containers only: 8GB minimum, 16GB comfortable, 32GB ideal. For Proxmox with VMs: 32GB minimum, 64GB recommended. Most homelab services use 200-500MB each, but monitoring stacks (Grafana, Prometheus) and databases are heavier. Start with 16GB and upgrade when you hit limits.