Skip to main content
The homelab runs a self-hosted Netflix: a media library served from LXCs on a dedicated VLAN, managed by Ansible, provisioned by tofu-proxmox. The VLAN is defined in tofu-unifi alongside every other service tier, and follows the same per-service segmentation pattern.

​
Container choice

LXC, not Docker — consistent with the LXC vs Docker decision tree. Native packages where they exist; Ansible manages config.

​
Storage layout

The whole stack shares one ZFS dataset bind-mounted at /data into every container, so a single quota bounds the whole footprint and every service sees the library at the same path. The dataset uses recordsize=1M, which suits the large sequential files a media server streams.

​
Personal backup on the same footprint

The same self-hosted footprint replaces two cloud subscriptions with services that keep the data at home:
  • Immich — a self-hosted photo and video library, the iCloud Photos alternative. Phones and Macs back up automatically to it. It’s the one workload here that runs Docker-in-LXC (an official multi-container stack), with the photo library living on a ZFS dataset bind-mounted into the container.
  • Time Machine — the Macs back up to an SMB share on the homelab NAS, presented as a native Time Machine target (Samba’s vfs_fruit advertises it as an Apple Time Capsule). The same NAS serves read-only media shares for Infuse on Apple TV.
These are backup targets, and they are themselves protected: their datasets ride the ZFS snapshot + replication layers like everything else — a backup that isn’t backed up is a single point of failure.

​
Insights dashboard

A dashboard service reads the *arr stack’s own APIs and surfaces cross-app health and activity in one view — no separate data store, no ingest pipeline of its own. It rides the same VLAN, the same Ansible-managed LXC pattern, and the same persistent-appdata layout as the rest of the stack.

​
VPN-locked egress

One workload in this stack keeps its traffic off the local network entirely: its egress is locked to a WireGuard tunnel to a VPN provider, enforced by a fail-closed killswitch — no tunnel, no route out, no silent fallback to the LAN. That path recently gained sticky automatic failover between two upstream VPN endpoints, plus a hard-won lesson on a gateway IDS/IPS false-positive against encrypted VPN traffic — see VPN-locked egress reliability.

LXC vs Docker

Why the decision tree lands on LXC for this stack.

UniFi networking

Where the media VLAN itself is defined.

VPN-locked egress reliability

Sticky VPN-endpoint failover, and an IDS/IPS false-positive lesson.

Homelab

What the full cluster looks like.