This page explains the software side of the lab: what runs, where it is defined, and how the pieces fit together.
The software model is split by responsibility. Docker-Swarm owns running service definitions, HomeLab owns host and VM automation, HiveMind owns Git-to-Swarm reconciliation, and wiki-js owns documentation. That separation keeps application changes from being mixed with host bootstrap, and it makes it clearer where to fix something when a service fails.
Most day-to-day services are containers running in Docker Swarm. The supporting platform includes shared databases, a reverse proxy, centralized authentication, monitoring, notifications, dependency automation, a private registry, backup jobs, and security scanners. User-facing services are documented separately from internal components so the service list stays useful to people who only need to open an app.
| Repo | Role |
|---|---|
~/Docker-Swarm |
Compose files, stacks.yml, Swarm scripts, database recovery notes, registry config, and CI for service definitions. |
~/HomeLab |
Ansible inventory, VM creation, Proxmox tuning, Swarm provisioning, storage mounts, security tooling, and host automation. |
~/HiveMind |
Python GitOps controller that polls Git and deploys Docker Swarm stacks. |
~/wiki-js |
Markdown source for this wiki. |
User-facing services are listed in List of Services. That page intentionally excludes internal sidecars, workers, database nodes, and scheduled jobs.
Major groups:
| Area | Software |
|---|---|
| Reverse proxy | Traefik |
| Authentication | Authentik |
| Edge protection | CrowdSec plus Cloudflare |
| DNS | Technitium and Cloudflare DDNS jobs |
| Monitoring | Grafana, Uptime Kuma, Dozzle, Homepage, Loki, Alloy, cAdvisor, node exporter |
| Notifications | ntfy |
| Registry | Private Docker registry with garbage collection |
| Dependency automation | Renovate |
| GitOps | HiveMind |
These platform services are what make the lab operate like a small production environment instead of a pile of one-off containers. Traefik and Authentik control access, monitoring catches failure modes, ntfy sends alerts, and HiveMind keeps Swarm aligned with Git. When adding new software, the goal is to include routing, login, monitoring, storage, and backup expectations at the same time as the container definition.
| Data service | Pattern | Typical consumers |
|---|---|---|
| PostgreSQL | Patroni/etcd/controller | Authentik, Gitea, Immich, Nextcloud, Paperless, Wiki.js, Arr apps, Speedtest Tracker. |
| MariaDB | Galera/controller | RomM, Uptime Kuma, Dynmap. |
| MongoDB | Replica set | MeshCentral. |
| Redis | Redis/Sentinel/controller | Authentik, Immich, Nextcloud, Paperless, RomM, SearXNG, Seer. |
The shared database model avoids running a separate database sidecar for every app unless there is a good reason. PostgreSQL, MariaDB, MongoDB, and Redis live in the databases stack and expose stable controller or replica-set endpoints. This makes backups, monitoring, and recovery more consistent, but it also means database stack health can affect many services at once.
| Tool | Job |
|---|---|
| GitHub Actions | Validate repo changes before merge. |
| HiveMind | Pull Docker-Swarm and deploy changed stacks. |
| Ansible | Configure hosts, VMs, Swarm, storage, Proxmox, and security tooling. |
| Renovate | Propose container image and dependency updates. |
| AutoKuma | Build Uptime Kuma monitors from service labels. |
| Tool | Location | Job |
|---|---|---|
| Authentik | Swarm reverse-proxy stack | Central login and forward-auth. |
| CrowdSec | Swarm reverse-proxy stack | Edge abuse detection and Traefik bouncer integration. |
| Wazuh | Security VM plus agents | Endpoint inventory and vulnerability/security visibility. |
| Falco | Swarm hosts via Ansible | Runtime behavior monitoring. |
| Greenbone | Security VM | Vulnerability scanning. |
| Trivy | Swarm security stack | Scheduled repo and image scans. |
Docker-Swarm.Host, VM, Proxmox, and security-agent changes go through HomeLab Ansible instead of HiveMind.
That boundary is important. HiveMind can deploy stacks, but it should not be expected to fix missing Docker volumes, broken CephFS mounts, absent GPU labels, or Keepalived state. Those are host/platform concerns and belong in HomeLab automation.
When a service changes, update the closest page: