Homelab conversations typically revolve around the most exciting elements. So media servers, smart-home dashboards, and beautiful self-hosted apps make the headlines. However, the services that keep it all running are not typically as glamorous, and once the system is up, no one’s discussing them. Yet if one such service fails, the entire structure feels broken.

Several years of building and rebuilding have taught me that these six are non-negotiable in my setup. They handle blocking unwanted traffic, giving services proper addresses, and other jobs I don’t want to think about.

AdGuard Home is the bouncer my network never knew it had

Blocking unwanted DNS requests across my entire network

One of the first things that stands out when you open the query log on AdGuard Home is that you’re not the one generating half of the DNS requests coming from your devices. My smart TV seems to be checking in with at least three ad networks. There are also a handful of forgotten apps constantly pinging a tracker. Most of these happen without any action on my part.

With all my devices pointing to AdGuard Home, blocking DNS-level moves from individual apps. Any device using AdGuard Home for lookup benefits from its ad blocking.

Using DNS rewrites makes my setup feel less like a spreadsheet. For example, I give my Vaultwarden container a name like vault.home rather than keeping track of difficult-to-remember IP addresses. This turns AdGuard Home into more than a simple ad blocker, but the day it goes down, those local names may stop resolving too.

OS

Linux, macOS, Windows, and Raspberry Pi OS

Price

Free

An open-source network-based ad and tracker blocking that covers all devices on a home network.

Nginx Proxy Manager exposed services as routable hostnames

One reverse proxy handles my subdomains and HTTPS certificates

As the number of containers grew, I stopped remembering where they lived even though I knew exactly what they did. At one point, I knew I had Sonarr, the dashboard, and the vault, but I couldn’t keep up with their individual IP addresses and port numbers.

I started running Nginx Proxy Manager (NPM) in Docker, and I didn’t have to remember which ports belonged to which services. I point my domain to it and use subdomains to route traffic to the containers that actually handle requests. Nginx Proxy Manager also handles requesting and renewing my Let’s Encrypt certificates, eliminating a job I used to do myself.

Several healthy containers will appear dead if Nginx Proxy Manager goes down, since it’s a shared front door for several services. Still, it’s worth it because I don’t want to be afraid to access my homelab remotely.

OS

Linux, macOS

Price model

Free

Nginx is a popular, open-source software used as a web server, reverse proxy, load balancer, and HTTP cache.

Vaultwarden holds the one key to my entire homelab

Losing the vault could lock me out of everything else

Once I started self-hosting, I quickly learned that the setup accumulates far more than a handful of passwords. There are API keys, admin logins, and credentials for services I may not touch for months.

Vaultwarden now runs in Docker behind Nginx Proxy Manager. Although it’s a separate, unofficial server, it uses the same Bitwarden browser extension and mobile app I already haveinstalled on my devices.

That’s the part where it gets uninteresting, because nothing about how I use or access passwords in my daily routine changes. But it’s still the one service that I can’t do without. I may do without my media service for a weekend, but if I lose the vault, I lose access to the credentials I need to reach everything else.

Vaultwarden’s web vault requires HTTPS, which is another reason Nginx Proxy Manager isn’t optional in my setup.

Developer

Daniel García

Price model

Free, Open-source

Vaultwarden is a lightweight, self-hosted password manager compatible with Bitwarden clients, designed to run efficiently on low-resource servers.

Uptime Kuma only barks when something’s actually wrong

Knowing which service failed and when

I don’t want to keep my eyes constantly glued to a monitoring service to catch when a service is broken. So I’ve set up Uptime Kuma in its own container and connected to Telegram. It checks whether services are responding in the background and remains out of the way until it has to report a problem.

Uptime Kuma’s timestamps are even more useful than the alerts I get when something is wrong. When it shows a service has been down since 2:14 AM, I have a much better starting point. I can investigate what else was happening around that time.

Uptime Kuma checks the obvious elements, like HTTP requests, ping checks, and open ports. But a more interesting use case for Uptime Kuma arises when multiple services fail together. It often points to a shared dependency. However, it won’t show you why that specific service went down.

OS

Linux, Windows, Docker

Price model

Free, Open-source

Developer

Louis Lam

Uptime Kuma is a lightweight, self-hosted monitoring tool that tracks websites, servers, and network services, sending alerts whenever something goes offline.

Tailscale gave me remote access without touching my router

Reaching my home services remotely without opening router ports

Accessing my server from my phone at home is one thing; doing it from a remote Wi-Fi network is another.

I didn’t need port forwarding after installing Tailscale on my phone and laptop, allowing them to join the same private network as my home server. Now accessing a dashboard from a remote Wi-Fi almost feels the same as if I were sitting at home.

Tailscale’s free Personal plan now supports up to six users and unlimited user devices. But a major thing to note is that you’re trusting Tailscale’s managed control plane to coordinate your devices. Headscale is an alternative if you would rather run the control plane yourself, but the maintenance burden shifts to you.

Kopia is the insurance policy my homelab is betting on

One backup job decides if a dying drive ruins my week

A Docker Compose file can recreate my containers, but it doesn’t recreate the data inside them: Vaultwarden’s actual vault, NPM’s certificates, AdGuard Home’s settings, and months of Uptime Kuma history. If you need to rebuild a server without backed-up volumes, you’ll lose all this data.

Kopia now runs on a schedule, encrypting and storing my backups as snapshots. After an initial backup, Kopia only uploads file content that isn’t already in the repository, so unchanged data isn’t uploaded again.

Kopia is boring because I rarely touch it after setting it up and testing data restoration. It stays out of the way, and I consult its snapshots when there is a real need.

OS

Windows, macOS, Linux

Price model

Free

Kopia is a secure open-source backup and restore tool with a user-friendly desktop app for Windows, macOS, and Linux. 

The services I refuse to cut

I have a very interesting setup, but these six apps are the boring and uneventful backbone that carries every other service. They mostly stay out of the way, but when something breaks, they’re the services I want working first. They’re the boring backbone I’d rather not sacrifice.