Motivation

I always wanted an environment to experiment with the same tools I use professionally. A homelab with HashiCorp Stack lets me iterate fast, break things without fear, and learn in depth.

Architecture

┌─────────────────────────────────────────────────┐
│                 Traefik (Ingress)                │
├─────────────────────────────────────────────────┤
│              Consul Cluster                      │
│         (Service Discovery + Mesh)              │
├─────────────────────────────────────────────────┤
│              Nomad Cluster                       │
│         (Workload Orchestration)                │
├─────────────────────────────────────────────────┤
│              Vault Cluster                       │
│         (Secrets + PKI)                         │
├─────────────────────────────────────────────────┤
│   Prometheus + Grafana + Loki (Observability)   │
├─────────────────────────────────────────────────┤
│         NixOS Nodes (x4) - Bare Metal           │
└─────────────────────────────────────────────────┘

Nodes

The cluster consists of 4 NixOS nodes, each with its declarative configuration:

  • homelab-0: Primary server (Nomad server + Consul server + Vault)
  • homelab-1: Worker node (Nomad client + Consul client)
  • homelab-2: Worker node (Nomad client + Consul client)
  • homelab-3: Worker node (Nomad client + Consul client)

Each node is managed with a dedicated .config.nix file, allowing exact system state reproduction at any time.

Management with NixOS

The entire operating system is managed declaratively:

# Apply complete node configuration
nixos-rebuild-switch.sh

# Update and apply
nixos-rebuild-switch-upgrade.sh

# Garbage collect to free space
nixos-gc.sh

With Ansible, you can rebuild all nodes simultaneously:

# ansible-playbook -i inventory.yaml nixos-rebuild-switch.yaml
- hosts: homelab
  tasks:
    - name: NixOS rebuild switch
      command: nixos-rebuild switch

Deployed Services (30+)

Services are organized by category as Nomad jobs:

Category Services
AI LLMs, embeddings
Media Plex, Sonarr, Radarr, Jellyfin
Monitoring Prometheus, Grafana, Loki, Alertmanager
DB PostgreSQL, Redis, MariaDB
Productivity Nextcloud, Vaultwarden
Networking Traefik, Pi-hole, WireGuard
Gaming Game servers
Backup Restic, rclone
SSO Authelia, LDAP
Finance Firefly III

Service Discovery with Consul

Every service automatically registers in Consul. This enables:

  • Internal DNS (service.service.consul)
  • Automatic health checks
  • Service mesh with Consul Connect (mTLS between services)

Secrets with Vault

Vault manages all cluster secrets:

  • Database credentials (dynamic secrets)
  • TLS certificates (PKI backend)
  • API keys and tokens
  • Native Nomad integration for secret injection into jobs

Result

A homelab that works like a mini-datacenter: resilient, observable, secure, and fully reproducible. Every change is versioned in git and can be applied with a single command.