Software candidates
This page tracks the software considered for each need of the home lab, keyed by
need rather than by tool, so it answers "what do we use, or could use, for X".
It complements the todo list in the specs index: only active
evaluations become todo items there, and the rows below link to them.
The Decision column uses these values:
settled: the tool in use is the choice; candidates stay as alternatives.open: an active todo item exists, linked from the row.backlog: no current need; options parked.deferred: blocked on a prerequisite named in the row.conditional: depends on a stated condition.
| Need |
In use |
Candidates |
Decision |
| Hypervisor |
Proxmox VE |
Incus |
settled; Incus if Proxmox is reviewed |
| Guest backups |
restic for data |
Proxmox Backup Server |
backlog |
| Multi-node management |
Proxmox cluster |
Proxmox Datacenter Manager |
backlog |
| Host operating system |
NixOS, Debian |
gokrazy for appliances |
settled |
| Workloads on Debian hosts |
Docker Compose |
Dockge, Dozzle |
backlog |
| Kubernetes distribution |
none |
Talos Linux, Cozystack |
deferred: no cluster |
| Kubernetes GitOps and storage |
none |
Argo CD, Flux, Longhorn, MetalLB |
deferred: no cluster |
| Kubernetes extras |
none |
KubeVirt, Knative, kube-fledged, git-sync, Score, LitmusChaos, External Secrets Operator |
deferred: no cluster |
Provisioning, automation, and CI
| Need |
In use |
Candidates |
Decision |
| Host provisioning |
Terraform, Ansible, nixos-anywhere, disko |
none |
settled |
| NixOS deployment and fleet tooling |
nixos-rebuild from the operations shell |
deploy-rs, Clan, Home Manager, nix-topology |
backlog |
| NixOS ephemeral root |
none |
impermanence, preservation |
backlog: the hl02 VM |
| Ansible execution and reporting |
manual runs |
Semaphore, ansible-pull, ARA Records Ansible, Telegram module for run notifications |
backlog |
| Workflow orchestration |
systemd timers |
Kestra |
deferred: evaluate a self-hosted CI runner first |
| CI and dependency updates |
GitHub Actions, Dependabot, Renovate |
Gitea, Forgejo, act |
backlog |
| Infrastructure tests |
NixOS integration tests, Molecule |
Testinfra, Monkeyble |
backlog |
| Dynamic DNS |
none |
ddns-updater, cloudflare_dns module, community.dns collection |
backlog |
| Documentation |
MkDocs |
BookStack |
settled |
Networking and remote access
| Need |
In use |
Candidates |
Decision |
| Router and firewall OS |
Asus stock firmware with scripts |
OPNsense, pfSense, VyOS |
open: detailed review pending |
| Recursive and authoritative DNS |
Unbound, CoreDNS |
Technitium |
settled |
| DNS filtering |
none |
Pi-hole, AdGuard Home, Technitium |
open: ad blocking todo |
| Upstream resolver |
none |
1.1.1.1 |
backlog |
| Remote access and mesh |
Tailscale |
NetBird, Yggdrasil, Pangolin for public exposure |
settled |
| Reverse proxy |
none; the Traefik image is pinned |
Traefik, Caddy, Nginx, TsDProxy |
open: Traefik with Tailscale certificates todo |
| VPN egress for downloads |
none |
Gluetun with a provider: Mullvad (Tailscale integration), Proton VPN (Stealth protocol), OVPN, TorGuard; Privacy Guides VPN comparison |
backlog |
| Inventory and IPAM |
Ansible inventory |
NetBox |
backlog |
| New-device alerting |
none |
NetAlertX |
backlog |
| Router scripting |
asuswrt-chkwan |
jacklul/asuswrt-scripts |
backlog |
| LoRa mesh |
none |
Meshtastic |
backlog: hardware |
Security, identity, and secrets
| Need |
In use |
Candidates |
Decision |
| Single sign-on |
none |
Authentik, Keycloak, Zitadel, Authelia, OAuth2 Proxy forward authentication, FreeIPA for a Linux domain |
open: centralized user management todo |
| Certificates |
self-signed on Proxmox |
step-ca, acme.sh, minica, XCA, Dogtag PKI |
open: Proxmox certificates todo |
| Secrets at rest |
untracked vault and tfvars files |
Hashicorp Vault, sops and age, sops-nix, agenix |
conditional: a private or self-hosted repository for the encrypted-in-Git options |
| Password manager |
none |
Vaultwarden |
backlog |
| SSH keys in hardware |
none |
ssh-tpm-agent |
backlog |
| Intrusion prevention |
fail2ban |
CrowdSec |
settled |
| Endpoint visibility |
none |
osquery, Fleet |
backlog |
| Docker API exposure |
none |
Docker Socket Proxy |
open: Docker socket hardening todo |
Monitoring, logging, and notifications
| Need |
In use |
Candidates |
Decision |
| Metrics, alerting, dashboards |
Prometheus, Alertmanager, Grafana, exporters |
Netdata |
settled |
| External heartbeat |
UptimeRobot, to verify |
Healthchecks.io, Uptime Kuma, uptimerobot module |
open: dead-man's-switch todo |
| Uptime checks and status page |
blackbox exporter |
Uptime Kuma |
settled |
| Disk health |
smartmon exporter |
Scrutiny |
backlog |
| Proxmox status |
none |
Pulse |
backlog |
| Bandwidth |
none |
speedtest-exporter |
backlog |
| Log aggregation |
journald per host |
Loki, LogWard, Fluent Bit |
open: Loki todo |
| Notifications |
Telegram via Alertmanager |
ntfy, Gotify, Apprise, Mailrise |
settled |
| Service dashboard |
none |
Homepage, Homarr, Homer |
open: dashboard todo |
Backup and storage
| Need |
In use |
Candidates |
Decision |
| Video library and requests |
Jellyfin, Jellyseerr, Ombi, the arr stack, qBittorrent |
Tdarr, Bazarr, Unpackerr, qbit_manage, FileBot |
settled; companions backlog |
| Music |
none |
Navidrome, Lyrion Music Server, MusicBrainz Picard |
backlog |
| Podcasts and audiobooks |
none |
Audiobookshelf, AntennaPod sync |
backlog |
| Ebooks and comics |
none |
Calibre-Web and the Calibre-Web Automated fork, Kavita, Komga with komf, Comixed, LANraragi, Mihon as the Android client |
backlog |
| Retro games |
none |
RomM |
backlog |
| Game streaming |
none |
Sunshine and Moonlight, Apollo and Artemis, Parsec |
backlog |
| Photos |
none |
Immich |
open: Immich todo |
| Other downloads |
none |
Amule |
backlog |
| TV ad skipping |
none |
iSponsorBlockTV |
backlog |
Documents and productivity
Smart home and hardware projects