Self-Hosted Stack Launch Kit

Everything to go from zero to production homelab in one afternoon.

Not just a guide — a complete deployment kit. Six Docker Compose stacks, pre-configured nginx security headers, Cloudflare Tunnel config, monitoring setup, and a setup script that scaffolds your entire directory structure and generates secrets. Plus a 37-page guide that explains every decision, every config line, and every gotcha we hit building it. Deploy a secure, SSO-protected homelab with reverse proxy, monitoring, dashboards, and workflow automation — all wired together and tested in production.

What's included

6 Docker Compose stacks — Nginx Proxy Manager, Authentik SSO, Homepage, Portainer, Grafana/InfluxDB/Telegraf, n8n
Nginx security headers config — X-Content-Type-Options, HSTS, CSP, X-Frame-Options, Referrer-Policy
Cloudflare Tunnel config template — ingress rules, DNS routing, zero open ports
Telegraf monitoring config — system metrics + Docker container stats → InfluxDB
Homepage services.yaml — pre-built dashboard layout with Docker integration
Authentik forward auth nginx block — copy-paste SSO protection for any service
setup.sh — one script to create directories, generate secrets, set permissions
37-page deployment guide (PDF) — phased build with verification at every step
Decision rationale — why each tool was chosen and what alternatives were considered
Troubleshooting reference — common issues, root causes, and fixes

Requirements

Docker and Docker Compose installed
A domain with DNS managed by Cloudflare (free tier works)
Basic terminal comfort (copy-paste level)

setup.sh

#!/bin/bash
# Self-Hosted Stack Launch Kit — directory + secrets setup

export LAB_ROOT=/opt/homelab

sudo mkdir -p $LAB_ROOT/{secrets,containers}
sudo mkdir -p $LAB_ROOT/containers/{nginx-proxy-manager,authentik,homepage,portainer,monitoring,n8n}

# Generate secrets (32-char random each)
for secret in authentik_postgres_password authentik_secret_key \
  n8n_postgres_password n8n_encryption_key grafana_admin_password \
  influxdb_password influxdb_admin_token; do
  openssl rand -base64 32 > $LAB_ROOT/secrets/$secret
done

chmod 700 $LAB_ROOT/secrets && chmod 600 $LAB_ROOT/secrets/*
echo "Done. Secrets at $LAB_ROOT/secrets/"