main-services

Core services for the home lab, hosted on the VPS: the self-hosted NetBird VPN control plane, a Forgejo Actions runner, and Pocket ID passkey authentication.

Services

Service	Directory	Image	Exposed on	Purpose
NetBird stack	netbird/	netbirdio/netbird-server, netbirdio/dashboard, netbirdio/reverse-proxy, traefik:v3.6, crowdsecurity/crowdsec	80/443, 3478/udp, 51820/udp, 22	Self-hosted VPN (management + signal + relay + STUN), admin dashboard, public reverse proxy for the LAN, and brute-force protection
Forgejo runner	forgejo-runner/	data.forgejo.org/forgejo/runner:13, docker:dind	(none)	CI runner for the Forgejo instance
Pocket ID	pocketid/	ghcr.io/pocket-id/pocket-id:latest	443 via Traefik	Passkey-based authentication

Details

netbird/

• Traefik terminates TLS (Let's Encrypt) for netbird.luigi.ovh (dashboard, management gRPC, backend API) and redirects HTTP to HTTPS.
• NetBird reverse proxy takes over every other domain via TCP passthrough (PROXY protocol v2) and exposes internal LAN services to the public internet through the NetBird mesh — this is how *.apps.luigi.ovh reach the home network.
• CrowdSec sits in front of the proxy and blocks abusive IPs.
• Internal docker network netbird uses 172.30.0.0/24 (Traefik pinned to 172.30.0.10).

forgejo-runner/

Forgejo Actions runner registered against https://forgejo.apps.luigi.ovh/, with a Docker-in-Docker sidecar as the job executor. Runner config (URL, UUID, token) lives in data/runner-config.yml.

pocketid/

Passkey SSO at auth.netbird.luigi.ovh, routed via Traefik labels. The encryption key file lives under key/ and is mounted read-only into the container.

First-time setup

Real config files are gitignored — copy each sample and fill in real values:

Real file	Sample	Notes
netbird/config.yaml	netbird/config.yaml.sample	Combined NetBird server config
netbird/dashboard.env	netbird/dashboard.env.sample	Dashboard OIDC settings
netbird/proxy.env	netbird/proxy.env.sample	Proxy token, CrowdSec key
forgejo-runner/data/runner-config.yml	forgejo-runner/data/runner-config.yml.sample	Forgejo URL + runner credentials
pocketid/key/encryption_key	pocketid/key/encryption_key.sample	Pocket ID encryption key

Regenerate secrets with openssl rand -base64 32.

Deployment

cd <service-dir>          # netbird | forgejo-runner | pocketid
docker compose pull       # fetch newest images
docker compose up -d      # (re)create the containers

Also automated from the home-lab ansible inventory repo:

ansible-playbook -i inventory.yml main-services.yml   # pull + up on the VPS

Repository layout

• Tracked: docker-compose files and .sample configs.
• Gitignored (never commit): netbird/config.yaml, netbird/*.env, netbird/crowdsec/ runtime, netbird/letsencrypt_backup/, pocketid/key/encryption_key, pocketid/pocketid/data/, forgejo-runner/data/runner-config.yml and runner state.