01 · FILE / SYNC / COLLABcloud.fxmq.netNextcloud 34 — your data, your server
The centre of the homelab. Files & sync with desktop/mobile clients, calendar & contacts over CalDAV/CardDAV auto-discovery, photo memories, and built-in Talk chat/video calls. Emails out via the local mail platform; the database lives in PostgreSQL on the same box.
| product | Nextcloud 34 (PHP-FPM) · PostgreSQL 17 · Redis 7 · Talk built-in |
| door | https://cloud.fxmq.net — CardDAV/CalDAV auto-discovery on /.well-known |
| backend | nextcloud FPM container → php_fastcgi · postgresql · redis (cache + locking) |
| access | public · Cloudflare proxied. Non-browser clients (sync, curl) need a per-hostname CF WAF skip. |
| admin | occ via make nc-* recipes (make nc-occ CMD="…") |
| repo | kefohaine/server · services/nextcloud (compose + fpm/opcache tuning + talk configs) |
| upstream | nextcloud/server |
02 · PASSWORDS / SECRETSvault.fxmq.netVaultwarden — Bitwarden-compatible, self-hosted
Drop-in Bitwarden server — keep passwords, passkeys, TOTP seeds and notes in one encrypted vault. Works with the official Bitwarden browser extension, desktop and mobile apps pointed at this URL. Verification and invite email is sent by the homelab's own mail platform.
| product | Vaultwarden (Rust, single container) |
| door | https://vault.fxmq.net |
| access | public · Cloudflare proxied · SMTP out via [email protected] |
| repo | kefohaine/server · services/vaultwarden |
| upstream | dani-garcia/vaultwarden |
03 · MONITORING / STATUSkuma.fxmq.netUptime Kuma — watchdogs for the whole stack
Fancy status page + uptime robot: heartbeats, HTTP(S)/TCP checks and notifications for every vhost on this box. The dashboard shows live green/red for the services below — the homelab's own self-check on itself.
| product | Uptime Kuma (Node) |
| door | https://kuma.fxmq.net |
| access | public · Cloudflare proxied |
| repo | kefohaine/server · services/uptimekuma (seed monitors in seed-monitors.sql) |
| upstream | louislam/uptime-kuma |
04 · GAMES / MINECRAFTmc.fxmq.netPufferPanel + Minecraft — click, and play in the browser
The game corner. /play serves an in-browser Minecraft 1.8.8 client (EaglercraftX) — no install, no login. Java players of any version 1.7.10→latest join the same world on port 25565 via the Via family. The PufferPanel behind it (/panel) manages servers; public registration is closed, accounts are admin-created.
| product | PufferPanel · Paper MC + EaglerXServer (EaglercraftX 1.8.8 client) | ||||||||
| door |
| ||||||||
| access | public · A record DNS-only at Cloudflare so game ports bypass the proxy · registration closed (edge 403 + backend toggle) | ||||||||
| repo | kefohaine/server · services/pufferpanel + server templates | ||||||||
| upstream | PufferPanel/PufferPanel · eaglercraft/eaglercraft |
05 · EMAILmail.fxmq.netRoundcube webmail on Docker Mailserver (Postfix + Dovecot)
Full mail platform for the fxmq.net domain: webmail in the browser plus plain SMTP/IMAP for any client. DKIM, SPF and DMARC are published; spoof protection locks each mailbox to its own send identity. TLS reuses the same Let's Encrypt certificate as the website — one cert path for web + mail.
| product | Roundcube webmail + Docker Mailserver (Postfix / Dovecot / Rspamd) | ||||||||
| door |
| ||||||||
| access | public · A + MX records DNS-only (grey cloud) · per-mailbox quotas, disposable addresses & forward-only aliases | ||||||||
| repo | kefohaine/server · services/mailserver | ||||||||
| upstream | docker-mailserver/docker-mailserver · roundcube/roundcubemail |
06 · OPERATOR COCKPITtail.fxmq.nettailnet-only — the back door that isn't a door
Private side of the lab, reachable only from devices on the Tailscale network — not in public DNS, and Caddy answers 403 to any non-tailnet source. / lists every vhost as links; /ttyd opens a real terminal on the host. This is where the operator sits.
| product | Caddy vhost + ttyd (host systemd unit) behind Tailscale split-DNS |
| door | https://tail.fxmq.net — index · /ttyd — host terminal |
| access | Tailscale membership only · remote_ip 100.64.0.0/10 → anything else 403 |
| repo | kefohaine/server · services/fxmq.net (vhost) · config/ttyd (unit) |
| upstream | tailscale/tailscale · tsl0922/ttyd |
07 · FRONT DOORwww.fxmq.netthis zone — empty homepage · drop folder · showcase pages
The public face of the domain. / serves an empty index.html placeholder; /download is a read-only public drop folder (Caddy file browser); /1 and /2 are two showcase indexes of the whole stack — two takes on the same seven doors.
| product | Caddy — static file_server browse over the download/ drop folder |
| door | https://www.fxmq.net · /download/ · /1 /2 (this page = /1) |
| access | public · Cloudflare proxied · anything dropped in /download is publicly readable |
| repo | kefohaine/server · services/fxmq.net |
| upstream | caddyserver/caddy |
S · UNDER THE HOODthe stackwhat runs the seven doors
| edge | Cloudflare (proxy / DNS) → Caddy 2.11.4 (custom image, caddy-dns/cloudflare) on one Debian VPS |
| tls | per-vhost Let's Encrypt via DNS-01 — each cert scoped to its own vhost's SNI |
| containers | 11 docker containers on one net bridge (172.22.0.0/16), all with healthchecks + RAM caps |
| storage | data on-box; nightly pg_dump → a 1 TB storage VPS on the tailnet (migration pending) |
| repo | github.com/kefohaine/server — everything above is one git repo: compose files, vhosts, host config, scripts |