Start with four services, not forty. A media server, a photo library, a password vault, and a DNS-level ad blocker. Add backups the same week you add those four. Everything else — dashboards, single sign-on, automation, local AI — belongs to phase two.
That order is the whole answer. The mistake almost everyone makes is the opposite one: they find a list of forty self-hosted applications, install all of them in a weekend, and then can't understand why the box feels unstable. More containers does not mean a better home lab. It means more things that can break, and more places for a quiet failure to hide. Start with services you will actually open every week — ones that replace something you already pay for or fix a problem you actually have.
| Role | App | Why it wins | The catch |
|---|---|---|---|
| Media | Jellyfin | Free and open source; hardware transcoding, live TV and DVR are not paywalled | Remote access for non-technical family takes setup |
| Media (alternative) | Plex | Polished UI, the widest device support, easiest sharing | Remote streaming now needs a paid pass |
| Photos | Immich | Google Photos–style library on your own hardware, with automatic phone backup, face grouping and a map view | Young and moving fast; read release notes before upgrading |
| Files | Nextcloud | A real Drive/Docs replacement: sync, calendar, contacts, office, video calls | Much heavier to maintain than plain file sync |
| Passwords | Vaultwarden | A drop-in Bitwarden-compatible server, so the official Bitwarden apps connect to it | Community-maintained and unofficial |
| Ad blocking | Pi-hole or AdGuard Home | Point your router's DNS at it and every device on the network loses ads and trackers, with nothing installed on the devices | You have to get DNS right, and DNS problems are painful |
| Uptime | Uptime Kuma | Dead-simple service checks with notifications | The default database store gets fragile as you scale |
| Local AI | Ollama + Open WebUI | Run models on your own hardware and skip API keys | Larger models want real VRAM |
| Monitoring | Beszel | Lightweight host and container stats with alerts, far simpler than a full Prometheus/Grafana build | Fewer metrics and less retention than the heavy stack |
If you only take one thing from this page: the first four rows are the ones that make a server feel worth owning. The bottom four rows are what keeps it alive.
| Jellyfin | Plex | |
|---|---|---|
| Licence | Free, open source | Proprietary; free tier plus paid features |
| Remote streaming | Free, but you build it (reverse proxy or VPN) | Requires a paid pass — the Remote Watch Pass runs about $1.99 a month |
| Hardware transcoding | Included | Behind Plex Pass |
| Live TV / DVR | Included | Behind Plex Pass |
| Device support | Good, with gaps on older TVs | Very broad |
| Behaviour with no internet | Keeps serving your library | Connecting can be hit or miss |
Both do the same job: they turn a folder of files into a proper streaming library with posters, metadata and watch history. The split is philosophical. Plex is the easier on-ramp and the better choice if you are sharing with relatives who will never configure anything — they sign in and it works. Jellyfin asks more of you and then asks nothing again: no account on anyone else's server, no paywall on transcoding or tuners, and it keeps working when your internet does not.
This is the part the listicles skip, because it is uncomfortable. Run three or four of these setups side by side and they disagree on basics.
Is Plex's remote access free or paid? All three answers are circulating. One camp says the Remote Watch Pass costs about $2 a month and that music streaming stays free. Another describes Plex as having a free tier with "some features" behind a subscription. A third points at the specifics: hardware transcoding and live-TV tuners sit behind Plex Pass. None of them is lying — they are describing different pieces of the same paywall. If remote access matters to you, price it yourself before you commit, because the free/paid line has moved more than once.
Jellyfin or Plex? One long-time host runs both, deliberately: Plex for the family and the old TVs, Jellyfin pointed at the same media folders as a fallback for the day Plex changes the rules again. Another runs both because Plex's offline behaviour is unreliable. A third picks Jellyfin on principle and admits Plex is simply easier to share. The honest answer is that the "best" one depends on whether you are optimising for your own control or for other people's convenience — and it is perfectly reasonable to run both against the same library and decide later. Two ports, one media folder, no downside.
Is Uptime Kuma actually reliable? Most guides recommend it without a second thought. One operator abandoned it entirely because the bundled SQLite database "would get corrupted all the time", and only came back once version 2 added a MySQL/MariaDB backend. That is the kind of caveat that never makes the top-ten list, and it is exactly the kind you need when you are monitoring hundreds of checks instead of five.
Which reverse proxy? Two of the setups here use Nginx Proxy Manager; one uses Traefik. Nginx Proxy Manager wins on approachability — a clean web UI for pointing hostnames at IPs and ports. Traefik wins once you are comfortable in config files and want certificates and routing to be declarative. Pick by temperament, not by benchmark.
Which dashboard? Three different answers, no consensus. One setup moved from Heimdall to Homarr and settled on Glance. Another settled on Homepage, configured entirely through a single YAML file. A third suggests Homarr, Heimdall or Homepage interchangeably and says it takes twenty to thirty minutes either way. A dashboard is not load-bearing. Treat it as cosmetic and don't agonise.
The most useful things are the small, specific ones.
Your media server may need the internet. One setup keeps Jellyfin running precisely because Plex's ability to let you connect without internet access is inconsistent. If your library has to work during an outage, that single fact decides the choice for you.
Don't run Frigate's object detection on the CPU. The default CPU detector is explicitly not recommended. The fix is a Coral TPU, which offloads detection so a handful of cameras barely touch the CPU. If you want cameras with AI detection, budget for the accelerator, not just the software.
Nginx Proxy Manager only shines if you own a domain. Without one, the "pretty URLs" story falls apart — which is why this belongs in phase two, after you have a domain. A non-competitive domain runs roughly $10 a year, and Cloudflare is the usual place to point it.
Deduplication is where the maths gets interesting. Proxmox Backup Server deduplicates and only sends the delta between backups. The illustration worth internalising: at a 30× deduplication factor, 100 GB on disk represents roughly 3 TB of logical backup data. That is the difference between a backup strategy you can afford and one you can't.
Your ebook server is picky about folders. Kavita wants books laid out by author name in the file structure, which gets awkward the moment a title has two authors or you forget who wrote what. Once imported it looks like a proper library, but the import step is where people give up. On Android there is a strong third-party reader; on iOS there isn't.
Uptime Kuma's database is the weak link at scale. The default embedded store is fine for a home lab and painful at hundreds of checks, where you see slow responses, write delays and eventually corruption. Version 2's external MySQL/MariaDB support is the fix.
Object storage has a new default. MinIO stopped developing its open-source version, which pushed at least one long-time user toward RustFS — S3-compatible, better licensed, and actively developed. If you rely on S3-compatible storage for backups or caching, plan the migration before you need it.
Plex accepts exactly one live-TV source. You get XML or M3U, not both. People work around it with tools that generate virtual channels from their own library — ErsatzTV turns a media folder into scheduled, channel-surfing-style streams — but the limitation itself is Plex's, and it forces an extra moving part into the stack.
Put the failover VIP on the primary DNS, not the secondary. This one is subtle and genuinely useful. Most applications prefer the primary resolver and will wait for it to time out before trying the secondary. So if your primary DNS goes down, everything stalls on the timeout before failing over. Load-balancing two servers behind the primary address, and leaving the secondary as a single instance, removes that stall. Most guides do the opposite.
OCR alone isn't a document system. A searchable archive needs more than OCR: Paperless-ngx leans on Tika for text extraction and Gotenberg to convert Office and HTML into PDFs. Skip those two and half your documents quietly fail to index.
Cameras that don't speak HomeKit can be made to. Scrypted acts as a bridge, so unsupported cameras show up in HomeKit (and similar ecosystems) as if they were native. If your camera brand and your smart-home platform don't talk, this is the translator.
Back up the workstations too, not just the server. When you don't have a first-party NAS, UrBackup is the under-discussed option for image and file backups of Windows, macOS and Linux machines, running quietly in the background.
Snapshots are not backups, and RAID is not a backup. Snapshots lock your data at a point in time and make rollback trivial — enable them if your filesystem supports it. But RAID only protects against a drive dying. It does nothing about accidental deletion, ransomware, misconfiguration or a corrupted filesystem. You still need real backups, ideally somewhere else.
Remote access is where beginners stall. WireGuard and OpenVPN both require port forwarding, which means they don't work behind double NAT or carrier-grade NAT — the situation you get when your ISP controls the router. If that's you, a mesh VPN like Tailscale sidesteps it entirely: no port forwarding, fast to set up. If you want to go further, zero-trust tools such as Twingate flip the model — instead of putting a user on your network and letting them reach everything, you grant access to specific services and ports for specific users. That is the direction the space is moving, and it is friendlier to a home setup than a traditional VPN tunnel.
Single sign-on has a learning curve. The temptation is to give every service the same admin password. Don't. Give each service its own strong password and multi-factor auth first; consolidate later. When you do want one login across everything, Authentik is the common answer, but it is a real learning curve and a bad day-one project. Add it once you have a stable base of services.
Smart-home gear may need extra hardware. Home Assistant consolidates devices from different manufacturers into one place, and it is one of the best reasons to run a home lab at all. But devices on different wireless protocols — Zigbee, Matter — often need an additional adapter, and the setup can feel like a part-time job if you let it.
The best home lab isn't the one with the most services running. It's the one with a few services you actually trust, actually use, and understand. That is worth more than a full dashboard of containers quietly doing nothing.