Infra

Terraform and Docker stacks for my Homelab.

Hardware and Topology

There are two apartments: Krasnoyarsk - main homelab and Nazarovo. There's also a VPN server with often changed location. Both apartments have OpenWRT routers that connect networks with AmneziaWG.

Krasnoyarsk

1. ASUS TUF-AX4200 with OpenWRT. 192.168.0.0/24 network
2. Terramaster F2-212 with TrueNAS. Static lease 192.168.0.2.

• 500GB WD Black SN770 [WDS500G3X0E] for OS
• 14TB Seagate 7200 IronWolf Pro [ST14000NE0008] for data

3. Minisforum MS-A2 with Proxmox. Static IP 192.168.0.2

• AMD Ryzen 9 9955HX
• 512GB KC3000 for OS
• 64GB SODIMM Kingston FURY Impact [KF556S40IBK2-64]

4. Some other devices, like TVs and laptops

Minisforum and Terramaster are connected into peer-to-peer 192.168.3.0/29 network.

Nazarovo

1. ASUS TUF-AX4200 with OpenWRT. 192.168.0.1/24 network
2. Apple Mac Mini (M4 10C CPU, 10C GPU) 24 GB RAM, 512 GB SSD
3. Some other devices, like TVs and laptops

Setting up a stack in Dockhand

1. Push the latest changes to the remote stacks repo
2. In Dockhand, press "From Git", in the popup write the following values
3. Stack name: whatever you want to see in Dockhand
4. Repository: stacks
5. Compose file name: a compose file path, relative to the root, e.g. stacks/navidrome/compose.yml
6. Additional env file (if you need any shared vairables): ./shared.env (or other file, relative to the below context directory)
7. Context directory (if you need any shared vairables or configs): .

Notes on stateful setup

immich_server doesn't support non-root execution as of June 2026, thus MAPROOT was used on /mnt/base0/media/images NFS share

Corrupted Postgres volume

When replacing a stack with running Postgres you should always backup volumes. If you launch two Postgres containers running on the same volume WAL will be corrupted. To fix it you can reset WAL, e.g. for forgejo (note: it runs on Postgres 14):

$ docker run -u postgres --rm -v forgejo_postgres_data:/var/lib/postgresql/data postgres:14 pg_resetwal -f /var/lib/postgresql/data

VM settings

To allow non-owners (Docker containers e.g. Sonarr and Radarr) to create hard links:

$ sysctl -w fs.protected_hardlinks=0

NFS mounts (in /etc/fstab):

192.168.3.2:/mnt/tank/archive      /mnt/archive      nfs4  rw,hard,noatime,_netdev,x-systemd.automount,nofail  0  0
192.168.3.2:/mnt/tank/media      /mnt/media      nfs4  rw,hard,noatime,_netdev,x-systemd.automount,nofail  0  0