Home server · always running

One machine. Eight services. No open ports.

Every service here is named after a god with the right job description. Watch the traffic move through them — including the requests that never make it out.

JARVIS
1 physical machine
8 services running
0 ports forwarded
Heimdall sees every lookup

The simulator

Every DNS request in this house goes through Heimdall.

Heimdall is Pi-hole: the resolver that answers every name lookup on the network, and the filter that refuses to answer for ad and tracker domains. Devices at home reach it through the router; devices away reach it through Tailscale — same resolver, same filtering, anywhere. Or switch to the map to see how the whole lab fits together.

Queries0
Blocked0
Blocked %0%
Traffic also runs on its own

Heimdall query log

What this is

Software you run, not software you rent.

Self-hosting means the software you use every day runs on hardware you control, instead of someone else’s subscription. No account to lose, no pricing change to absorb, no feature moved behind a new tier.

Everything above runs on one box — Jarvis, a refurbished office PC that Proxmox splits into isolated containers and VMs, reachable privately without a single open port. Each service gets its own space, so a bad experiment never takes the others down.

Jarvis — HP EliteDesk 800 G4 SFF

CPU Intel Core i5, 8th gen
iGPU UHD 630 — Quick Sync transcoding
Memory 16 GB DDR4
Storage 2 × 256 GB SSD
Hypervisor Proxmox VE — LXC + KVM
Draw ~15 W idle (estimate — measure yours)
Started on MacBook Air M4

The rack

Everything currently running.

Each tile is one service, its job in a sentence, and the line it belongs to. Filter by line to see how the lab is grouped.

Jarvis

Proxmox VE

Hypervisor · bare metal

Runs every other box on this page as an isolated container or VM.

CPU21%
MEM42%
Remote line
Heimdall

Pi-hole

LXC container

Resolves every name on the network, and refuses to resolve the ad ones.

CPU4%
MEM11%
Network line

Cloudflare Tunnel

Outbound tunnel

Publishes one service to the internet without opening a router port.

CPU2%
MEM6%
Secure line

Debian + Docker

KVM virtual machine

A full VM where Docker Compose stacks run with their own kernel.

CPU10%
MEM27%
Secure line
Indra

Vaultwarden

Docker · inside Debian VM

A password manager whose server I own, on a subdomain I own.

CPU4%
MEM14%
Secure line
Kubera

Sonarr · Radarr · Prowlarr

LXC container · Docker inside

Watches for new releases and files them into the library, named correctly.

CPU7%
MEM19%
Media line

Media library

Host disk · bind-mounted

One disk, mounted into both Kubera and Agni.

CPU1%
MEM3%
Media line
Agni

Jellyfin

LXC container · iGPU passthrough

Streams the library to any screen in the house, or out of it.

CPU6%
MEM23%
Media line

Tailscale

Mesh VPN · on the host

Carries my devices home from anywhere — including their DNS.

CPU3%
MEM5%
Remote line

Readings are simulated. This site is static and never talks to the server — a public status endpoint would undo the point of a lab with no open ports.