Why I run my home lab like enterprise infrastructure

CLAUDIO — Sun, 12 Jul 2026 19:51:05 +0000

I'm an IT Systems Administrator / Service Desk Team Lead L2 in Torino, Italy. During the day I manage endpoints and infrastructure for a large public-sector IT provider. At night I run PolarisCore, a home lab built with the same standards I use at work: VLAN segmentation, a real reverse proxy, internal DNS, ZFS storage with redundancy, and monitoring — not just a pile of Docker containers on a single box.

Here's the actual current state of it, pulled live via SSH, not marketing copy.

The compute layer — Proxmox

One node left after a migration earlier this year moved the old primary host over to dedicated NAS duty (more on that below).

pve-manager/9.2.3 (kernel 7.0.12-1-pve)
Uptime: 10 days
RAM: 4.7 / 7.5 GiB used
ZFS rpool (NVMe mirror): 45.9 GB / 236 GB (19%)
Containers: 14 running / 16 total (LXC)
Load average: 0.05, 0.08, 0.14

14 LXC containers handle: a Caddy reverse proxy, internal DNS (PowerDNS + Pi-hole), a self-built deployment tool (more below), a Next.js search frontend, and a handful of smaller services. Everything sits behind VLANs — management, services, IoT, gaming, guest, and VPN are all separated, with the services VLAN carrying most of the public-facing traffic.

The storage layer — TrueNAS SCALE

The hardware that used to run Proxmox now runs TrueNAS SCALE full-time:

TrueNAS 25.10.4 (Fangtooth)
Uptime: 10 days
RAM: 28 / 31 GiB (ZFS ARC, expected)
Pool DATA (RAIDZ1, 4x8TB): 13.4 TB / 21.8 TB used (61%)
Pool APPS (mirror): 23.5 GB / 460 GB used (5%)
Pool boot: 3.47 GB / 236 GB used (1%)
All pools: ONLINE

22TB isn't there for the sake of it — it holds a media library (Jellyfin + the *arr stack, running as native TrueNAS apps, not VMs), backups for a few side projects, and a dedicated encrypted share. RAIDZ1 across 4 drives gives me a single-drive failure buffer, which for a home setup with real data on it (not just test VMs) matters more than raw speed.

The network layer

FTTH 10Gbps from TIM into a UniFi Cloud Gateway Max, distributed over a 2.5GbE backbone to switches and clients. The 10Gbps WAN isn't about single-stream throughput to the internet — it's headroom so the internal 2.5GbE backbone never bottlenecks against the uplink when multiple services (backups, streaming, syncs) are active in parallel. TLS is wildcard, issued via DNS-01 against DuckDNS, auto-renewing, with zero inbound ports open for cert issuance.

The lightweight cloud piece — Oracle Always Free

Not everything lives on-prem. Site analytics run on Umami (self-hosted, replaced GA4 across 5 sites) on an Oracle Cloud Always Free VM:

Ubuntu 20.04.6 LTS
VM.Standard.A1.Flex — 1 OCPU / 6 GB RAM
RAM used: 631 MiB (11%)
Load average: ~0.00 (idle)
Stack: Umami + Postgres 15 + Caddy, Docker Compose

It's been up for a couple of days since the last restart and barely registers on CPU. For a low-traffic analytics backend, the free tier is more than enough — no reason to spend money on a VPS for this.

A side project that came out of daily frustration

The one piece of software here that isn't just infra glue is NovaSCM — an open-source, self-hosted alternative to Microsoft SCCM for zero-touch Windows deployment (PXE boot, autounattend generation, network scanning, WiFi 802.1X certificate management, workflow-based software deployment). I wrote about it in more detail in a separate post — it's MIT-licensed, on GitHub, and it runs as one of the 14 containers above.

Why bother with all this at home

The honest answer: because building it the "enterprise" way — with segmentation, real cert automation, redundant storage, and a reverse proxy instead of exposed ports — is the best way I know to actually understand those patterns instead of just reading about them at work. When something breaks at 11pm on my own network, I'm the only one who can fix it, which is a different kind of pressure than a ticket queue.

More on the project (and a few more services I haven't written up yet) at polariscore.it.

I built a free open-source alternative to Microsoft SCCM

CLAUDIO — Sat, 07 Mar 2026 14:18:00 +0000

Why I built this

Every day as an IT admin I was managing PC deployments, software installs,
WiFi certificates, network scans... and every day I thought:
"Why do I have to pay thousands for SCCM to do this?"

So I built my own alternative. It's called NovaSCM.

## What is NovaSCM?

NovaSCM is a self-hosted fleet & deployment manager inspired by Microsoft SCCM —
but free, open source, and lightweight.

It combines:

A WPF desktop console (Windows)
A REST API server (Python/Flask)
A cross-platform agent (Windows & Linux)

## What it does

### 💿 Zero-touch Windows deployment
Generate autounattend.xml and postinstall.ps1 automatically.
Copy to USB → boot the PC → go grab a coffee → come back with a fully configured machine.

### 📡 Network scanner
Discover all devices by IP, MAC, vendor. One-click RDP and SSH directly from the console.

### 📦 Software deployment
Visual workflow editor with multi-step sequences — winget_install, powershell, reboot, registry, file_copy and more.
Just like SCCM Task Sequences, but free.

### 🔐 WiFi 802.1X EAP-TLS
Issue client certificates signed by an internal CA.
Auto-enrollment agent for Windows, mobileconfig for iOS, QR code for Android.

### 📋 Change Request tracker
Track every deployment job per machine with status, logs and notes.

## Tech stack

| Component | Technology | Platform |
|-----------|-----------|----------|
| Console | C# / WPF / .NET 9 | Windows |
| Server | Python 3 / Flask / SQLite | Linux / Docker |
| Agent | Python 3 | Windows & Linux |

## Quick start

Start the server:

  cd server
  docker compose up -d

Deploy the agent on a Windows machine:

  iwr http://<server-ip>:9091/agent/install.ps1 | iex

Then download NovaSCM.exe from Releases, point it to your server and you are ready.

Links

👉 GitHub: https://github.com/ClaudioBecchis/NovaSCM

MIT License — free to use, modify and distribute.

Built by an IT admin, for IT admins. Feedback and stars are always welcome! ⭐

DEV Community: CLAUDIO