Introduction

Why Build a Home Lab?

A home lab is essentially a mini data center set up right in your own living space. It can range from a single, low-power mini PC hidden behind a desk to a dedicated server rack filled with enterprise-grade network gear, switches, and uninterruptible power supplies (UPS).

Many people build home labs because they want complete ownership over their data. Instead of trusting third-party cloud corporations with their files, photos, and smart devices, they self-host.

• Private Cloud Storage: Running alternatives like Nextcloud to replace Google Drive or Dropbox.

• Local Smart Home Control: Using platforms like Home Assistant to manage smart switches, lights, and automated voice clients locally. This ensures your automated routines still work flawlessly even if your internet connection goes down entirely.

• Media Streaming: Setting up personal media servers (like Plex or Jellyfin) to stream an owned movie and music collection without relying on changing streaming platform catalogs.

• Breaking Things Safely: If you want to learn enterprise network configurations, cluster computing, or test out container environments like Docker, doing it on a production system at work is a massive risk. A home lab lets you experiment, break configurations, and learn how to rebuild them with zero real-world consequences.

• Hypervisor Mastery: It provides a space to learn type-1 hypervisors (like Proxmox VE or VMware ESXi) to split one physical machine into dozens of isolated virtual machines (VMs).

Recommended Design Architecture

Basic Home Lab Configuration

A Home Lab self-contained in an inexpensive single mini-computer.

Note: If you want to use this information in an AI window – select this section into your chat window to reference the entire configuration. This can be helpful if you want to ask any AI questions regarding your Home Lab configuration. Just tell your AI client "gemini" to load this config your reference in your conversation. It might be helpful to tell your AI conversation:

"Please start a clean conversation, flush all buffers and caches and then load this config for reference."

Installing your Home Lab on a Mini-Computer

Although this setup may seem complex, you can complete the installation in a day or two and have a complete, running system ready for a production rollout of your new Home Lab.

Step by Step instructions

To run Proxmox, Home Assistant, NGINX, PiHole, Twingate Connector and Ollama together, a Proxmox VE (PVE) base layer is the best approach.

Proxmox VE base layer

When running there are some recommended resource allocations that you will be asked for. Use the details presented in each section to allocate your resources efficiently to avoid crashing the host.

Step-by-Step Deployment Guide

Step 1: Download the latest Proxmox VE ISO

The official website is located at https://www.proxmox.com/en/downloads/proxmox-virtual-environment.

Step 2: Setup Putty/ssh for easy communication with your new Home Lab.

1. To set up passwordless SSH login to a Proxmox VE server using PuTTY, you need to generate a key pair on Windows, add the public key to Proxmox, and configure PuTTY to use the private key.

2. Here is the complete step-by-step process.

Step 3: Use Helper Scripts for Easy Setup of the remaining products.

If you do not think you want that specific product installed, then you may skip that section. Just be aware that when you get to the tools and backup sections below the scripts may change. If you do end up changing the scripts remember that you can comment on the lines by using a "#" at the beginning of the line you do not want executed. That way later you know what to uncomment if you change your mind.

Once Proxmox is installed,

• open the Proxmox Web UI (https:// 192.168.86.250:8006)

• select your main node

• open the Shell

In this window you can execute simple commands and check for status if you desire

To use the community-standard Proxmox VE Helper-Scripts listed below to deploy your services instantly open a dedicated ssh window for running install scripts. Leave your Proxmox Web UI for small tasks.

PiHole (LXC 100)

To install PiHole run this command to deploy a lightweight container:

When you copy and run this command it will start the install script. Always select the advance installation and if prompted select the GUI install method. When prompted enable all ssh keys and enable ssh.

Make the selections in the GUI by using the output presented below:

After you run the above code block you will get an output like this. - Verify that it matches.

Home Assistant OS (LXC 101 - HAOS VM)

Run this command in the Proxmox host shell to automatically build a fully functional Home Assistant VM: When prompted enable all ssh keys and enable ssh.

When you copy and run this command it will start the install script.

Make the selections in the GUI by using the output presented below: When prompted enable all ssh keys and enable ssh.

After you run the above code block you will get an output like this. - Verify that it matches.

NGINX Proxy Manager (LXC 102):

Run this command to deploy a lightweight NGINX container:

When you copy and run this command it will start the install script. Always select the advance installation and if prompted select the GUI install method.

Make the selections in the GUI by using the output presented below: When prompted enable all ssh keys and enable ssh.

After you run the above code block you will get an output like this. - Verify that it matches.

Ollama AI Engine (LXC 103)

This uses the specialized ollama.sh hardware and software installer path:

When you copy and run this command it will start the install script. Always select the advance installation and if prompted select the GUI install method.

Make the selections in the GUI by using the output presented below: When prompted enable all ssh keys and enable ssh.

After you run the above code block you will get an output like this. - Verify that it matches.

Load the Agents

In the Prolog Web GUI at http://192.168.86.250:8006 and select Datacenter - Promox - 103 (ollama) in the Server View column

In Container 103 (ollama) on node Promox window select the console

It should log you in without using a password.

If it does not - then log in as root with the password of your Promox server

Enter "passwd" and set the new password the same as your Promox server's password.

The next time you log in it should not ask you for the password anymore.

In this window enter the commands listed below:

How to Connect Ollama to Home Assistant

For Voice: Install the official Ollama Integration in Home Assistant.

• Open the Home Assistant Web Page by going to http://homeassistant.local:8123.

• Open your Home Assistant Dashboard.

• Navigate to Settings > Voice Assistants.

• Create an Assist Pipeline, and assign the qwen2.5:7b model to handle your conversational sentences and smart home exposures.

For Coding:

• Point your development environment (like VS Code or Cursor) to your server's IP address (http://192.168.86.250:11434) using a local copilot extension to begin drafting automations locally.

• It is highly recommended to use external VS Code IDEs instead of the embedded Home Assistant Integration. You can still connect remotely via ssh and do everything without bogging down your Home Assistant Environment.

Wyoming Docker Installation (LXC104 - Docker)

Step 1: Create a Docker LXC in Proxmox

The easiest way to get Docker running in an LXC is to use the community-maintained Proxmox Helper Scripts, which handle setup and dependencies automatically.

Execute the following command inside of a Putty-SSH window connected to the Promox host.

This must be done in a Putty Shell and not via the Promox web GUI because if the GUI gets changed or dies for some reason the script will be backgrounded. If it is waiting for a prompt, it will never exit.

When you copy and run this command it will start the install script. Always select the advance installation and if prompted select the GUI install method.

Make the selections in the GUI by using the output presented below:

Ensure you enable all ssh keys and enable ssh, Docker Compose AND install Portainer during the prompt, as you will need it to run your Wyoming services later.

After you run the above code block you will get an output like this. - Verify that it matches.

Step 2: Set Up Wyoming Docker Services

• Now that Docker is installed in your LXC, you can deploy your chosen Wyoming voice or speech-to-text tools.

• SSH into your Docker LXC IP address do not use the Proxmox Web UI Console.

• Configure PuTTY for Key Authentication

• Create a docker-compose.yaml file to manage your Wyoming services. For example, to set up the Piper Text-to-Speech and Whisper Speech-to-Text services, run:

Paste the following configuration, making sure to replace paths and voices with your preferences:

Spin up the containers by typing the following command in you Putty ssh window:

Step 3: Connect to Home Assistant

• Once your Docker containers are running on the Proxmox LXC, you can easily link them to Home Assistant:

• Open your Home Assistant Dashboard.

• Navigate to Settings > Devices & Services.

• Click Add Integration and search for Wyoming Protocol.

• Enter the IP address of your Proxmox Docker LXC (192.168.86.248/24) and the corresponding port for the service (e.g., 10200 for Piper or 10300 for Whisper) integrations and associate the following links.

Portainer/Docker changes

Twingate Connector (LXC 105)

• Installing Twingate on a Proxmox server is straightforward and highly automated, taking only a few minutes to complete.

• Before running the script, you must generate the necessary Connector tokens from your Twingate Admin Console.

• Phase 1: Generate Twingate Connector Tokens

• Log in to your Twingate Admin Console https:// twingate.com.

• If you don’t have an account you will need to create one.

• After you are logged in Go to Network > Remote Networks and select your remote network (or create one).

• Click to Add a Connector and select the Manual deployment type.

• Scroll down and click Generate Tokens.

• Copy the Access Token and Refresh Token (you will need these below)

Paste the following configuration, making sure to replace paths and voices with your preferences:

Post Install Scripts

Proxmox Scripts:

Setting Vi as your default editor

To set vi as the default editor across all containers in your Barnes Home Lab, you can use a bash loop script run directly from your Proxmox host terminal.

Since vi is natively included in almost every Linux distribution (including minimal Debian, Ubuntu, and Alpine templates), this script will work universally without needing to install extra packages.

The Automation Script

Run this complete script on your Proxmox host terminal:

Finds All LXCs: Loops through your existing containers (LXC 100, 102, 103, 104, and 105).

Updates Root Profiles: Appends the environment variable to /root/.bashrc for root terminal sessions.

Sets a System-Wide Fallback: Appends the variable to /etc/profile to capture system-wide processes, automation tasks, and alternative shell instances.

To guarantee that any new containers you build in the future also default to vi, run this single command on your Proxmox host to update the global skeleton directory:

Code 23: ExportVIasDefault.sh

Twingate Connector

To safely disable password-based SSH logins and prevent brute-force attacks on Proxmox, you must verify your key-based login is working, modify the SSH daemon configuration, and restart the service.

Phase 1: Verify Your Current Setup

Keep your current session open. Do not close your active SSH window until you verify the new changes work.

Test the key login in a new window. Open a second PuTTY window, load your saved session, and click Open.

Confirm success. Ensure you log in automatically without any password prompt before proceeding.

Phase 2: Modify the SSH Configuration File

In your active Proxmox terminal, open the SSH configuration file:

vi /etc/ssh/sshd_config

• Press Ctrl + W to search for PasswordAuthentication.

• Remove any # symbol from the beginning of the line to uncomment it.

• Change the value from yes to no:

• PasswordAuthentication no

• Press Ctrl + W to search for ChallengeResponseAuthentication (or KbdInteractiveAuthentication on newer Proxmox versions).

• Ensure it is also set to no:

• ChallengeResponseAuthentication no

Save and exit the file by pressing Ctrl + O, Enter, then Ctrl + X.

Phase 3: Apply and Test the Changes

Apply the new settings by restarting the SSH service:

systemctl restart sshd

Keep this configuration window open.

• Launch a completely new instance of PuTTY.

• Attempt to log in to your Proxmox server without loading your private key.

• Confirm the server rejects the connection with a No supported authentication methods available error.

• Open another PuTTY window with your private key loaded to confirm you can still access the server.

• If both tests pass, you can safely close your original terminal window. Your Proxmox host is now immune to password brute-force attacks.

Post-Script Configuration Injection

Because helper scripts typically only create the primary interface (eth0 on vmbr0), you can instantly wire up your isolated backend (vmbr1), lock down your resource caps, and configure your pass-through requirements using these post-install snippets.

This is the best way to ensure the entire system is set up correctly.

Run these directly on your Proxmox host terminal right after a script finishes:

Home Assistant OS (VM 101)

Run this because you used the HAOS VM installer to attach your second isolated network adapter:

Pi-Hole Limits (Ensuring it uses the temporary staging IP)

Ollama LLM Engine (LXC 103)

Run this right after the Ollama LXC script finishes to attach the isolated segment and map your 13th Gen Intel iGPU:

Advanced Intelone API & SYCL Tuning Flags

Append these environment flags directly to your Ollama service definition file (usually found at /etc/systemd/system/ollama.service.d/override.conf or directly inside your LXC startup script environment variables):

Add the following environment lines to your deployment:

# Force the Intel driver to bypass aggressive power savings and keep execution units alert

NEOReadDebugKeys=1

OverrideGpuAddressSpace=48

# Tell the SYCL backend to strictly optimize for low-latency single-batch generation

# This prevents the thread-pool from waiting for data batches during quick autocomplete requests

CL_PROGRAM_OPTS="-cl-mad-enable -cl-fast-relaxed-math"

# Direct the GGML backend to pin memory mappings across the virtualized container bridge

OLLAMA_NUM_GPU=999

GGML_OPENCL_PLATFORM=Intel

Wyoming Docker (LXC 104)

Run this to map the isolated network switch so it can talk privately to the Ollama API:

Disaster Recovery:

Text Configuration Backup Script

To secure your precise resource layouts, network definitions, and maps, keep this custom backup tool saved on your host.

Execute it at any time to output a fresh, timestamped config snapshot to your host storage directory:

Tools to verify Installation and functionality

How to Quickly Verify Promox Container Configurations:

Sometimes a quick check is needed to verify if there is a problem. For example, you may want to know if a specific Proxmox container can see all your other containers.

You can log into any Promox container via Putty ssh or the Promox web page. In the Promox container select Console and paste in the following code. Or you can open Putty and select the Container you want. In that shell paste in the following code:

When you copy and run this simple script in a terminal of your Putty Shell, Proxmox host, or any Linux-based container it automatically verifies that every IP in your config is alive and responsive on your subnet. It will also tell you specific configuration items for each container that you can verify against this output.

After you run the above code block you will get an output like this.

• The check boxes show the hosts are correctly configured and can communicate with each other.

References

Home Labs for Newbies

Proxmox VE installation and administration

• Proxmox VE Downloads

• Proxmox VE Installation Guide

• Proxmox VE Administration Guide

• Proxmox VE Network Configuration

• Proxmox VE Linux Container Documentation

• Proxmox Package Repositories

• Proxmox PCI Passthrough

These support the ISO installation, VM/LXC terminology, bridges such as vmbr0 and vmbr1, resource allocation, repository configuration, and GPU passthrough sections.

Community installation scripts

The installation commands in the document came directly from the Proxmox Community Scripts project:

• Proxmox VE Community Scripts

• Pi-hole script

• Home Assistant OS VM script

• NGINX Proxy Manager script

• Ollama script

• Docker script

• Twingate Connector script

Third-party community-maintained scripts. They execute remote shell code, so readers should inspect the scripts before running them.

Home Assistant

• Home Assistant Installation

• Home Assistant OS on Proxmox

• Home Assistant Ollama Integration

• Home Assistant Wyoming Integration

• Home Assistant Voice Assistants

These support the HAOS VM, Ollama integration, Wyoming Protocol, and local voice assistant sections.

Ollama and local AI

• Ollama Documentation

• Ollama Linux Installation

• Ollama API Documentation

• Ollama Model Library

• Ollama GitHub Repository

These support commands such as ollama pull, the local API on port 11434, model names, embeddings, and Home Assistant connectivity.

Docker, Piper, Whisper, and Wyoming

• Docker Engine on Debian

• Docker Compose Documentation

• Docker Compose File Reference

• Rhasspy Wyoming Protocol

• Wyoming Piper

• Wyoming Faster Whisper

• Home Assistant Voice Assistant Configuration

These support the docker-compose.yaml, Piper text-to-speech, Whisper speech-to-text, exposed ports, mounted volumes, and Home Assistant integration steps.

Pi-hole and NGINX Proxy Manager

• Pi-hole Documentation

• Pi-hole Docker Documentation

• NGINX Proxy Manager

• NGINX Proxy Manager Guide

• NGINX Proxy Manager GitHub Repository

These support the DNS filtering, reverse proxy, container deployment, and web management sections.

Twingate

• Twingate Linux Connector

• Twingate Docker Connector

• Twingate Network Administration

These support the connector token, private network access, and secure remote access sections.

SSH and PuTTY

• PuTTY User Manual

• PuTTYgen Documentation

• OpenSSH Authorized Keys Manual

• OpenSSH Key-Based Authentication

These support Ed25519 key generation, PuTTY .ppk files, authorized_keys, SSH permissions, and passwordless login.

Further Reading

• Proxmox VE Wiki

• Proxmox Backup Server

• Home Assistant Backup Documentation

• Docker Security Documentation

• Pi-hole Privacy and Security

• Intel GPU Device Plugin and Runtime Information

• Linux Network Namespaces

• systemd Service Documentation