The 10-layer home lab stack for 2026: what you actually need
A home lab is not a pile of hardware; it is a stack of layers, each solving a problem the layer below created. Here is the whole stack for 2026 — foundation to security — and the honest reasoning for each choice.
Most home-lab guides are parts lists: buy this box, flash this image, done. But the thing that turns a machine in a closet into a genuine enterprise simulator is not the hardware — it is the architecture running on top of it. Think in layers, each one solving a problem the previous layer created, and a home lab stops being a hobby toy and starts teaching you the exact skills a data centre needs. This guide walks the stack from the foundation up.
01The foundation: your hypervisor
Everything sits on a hypervisor — the layer that turns one physical machine into many isolated virtual ones. In 2026 the home-lab default is Proxmox VE, a Debian-based, open-source platform that runs full virtual machines (via KVM) and lightweight system containers (via LXC) from one web interface.1 It is free, scriptable, clusters across several nodes, and is the closest thing the community has to a standard.
The main alternative is TrueNAS — the product formerly called TrueNAS SCALE, rebranded TrueNAS Community Edition with the 25.04 "Fangtooth" release in 2025.2 TrueNAS leads with ZFS storage and adds virtualisation and apps on top, so the rule of thumb is simple: if your lab is compute-first, start with Proxmox and add storage; if it is storage-first (a serious NAS that also runs a few apps), start with TrueNAS. Many labs eventually run both — TrueNAS as the storage box, Proxmox as the compute cluster.
02Identity: single sign-on for your whole lab
The moment you run more than a couple of services, you have a login problem: a dozen apps, a dozen passwords, no consistent way to enforce two-factor. The enterprise answer is single sign-on, and you can run it at home. Authelia is a lightweight authentication and two-factor portal that sits in front of your apps and gates them behind one login,3 while Keycloak is a full open-source identity and access-management server speaking OpenID Connect and SAML — the same protocols enterprises use.4 Start with Authelia for a forward-auth gate; graduate to Keycloak when you want to learn OIDC/SAML properly. Either way, you have built the identity layer real companies pay teams to run.
03The data layer: a real 3-2-1 backup strategy
Self-hosting means you are now the person responsible for the data, and a home lab without backups is a data-loss incident on a timer. The canonical discipline is the 3-2-1 rule: keep 3 copies of your data, on 2 different types of media, with 1 copy off-site.5 It was coined by photographer Peter Krogh and is endorsed by CISA as the baseline for resilient backup.5 In practice: your live data, a local backup on a different disk or NAS, and one copy off-site (a friend's house, a rotated drive, or encrypted cloud). Modern ransomware has pushed the pros to 3-2-1-1-0 — adding one immutable or air-gapped copy and zero restore errors — but 3-2-1, actually tested, is the layer that separates a lab from a liability.
The test of a backup is not that it exists but that you have restored from it. An untested backup is a hope, not a layer.
04The security lab: vulnerability scanning and a SIEM
Here is where a home lab earns its keep as a cybersecurity trainer. Two layers turn your network into a practice range. First, vulnerability management: a scanner like OpenVAS / Greenbone Community Edition probes your hosts for known weaknesses and reports them the way an enterprise scanner would, so you learn to read and remediate findings.6 Second, a SIEM — Security Information and Event Management — which collects logs from across your lab, correlates them, and raises alerts. Wazuh is a free, open-source SIEM/XDR platform that does exactly this and is widely used to learn blue-team skills at home.7 Running both against your own infrastructure is the single most employable thing a home lab can teach.
05The remaining layers, briefly
The stack does not stop there, and the later parts of this series go deep on the ones that matter most. In short, the other layers are:
- Networking — VLANs and a capable router/firewall (pfSense or OPNsense) to segment trusted, IoT, and lab traffic.
- Secure remote access — a zero-trust layer so you never forward a port to the internet (covered in part two of this series).
- Reverse proxy — Traefik, Caddy, or Nginx Proxy Manager to give services clean HTTPS names instead of
ip:port. - Containers — Docker (and Compose) as the unit most self-hosted apps ship in.8
- Monitoring — Prometheus scraping metrics and Grafana drawing the dashboards, so you see the lab.9
- Automation — Infrastructure as Code (Ansible) so the whole stack is reproducible (covered in part five).
06Where OcxlyDev lands
We treat a home lab as the cheapest professional-development environment in existence: for the price of a used mini PC and some evenings, you can run the same layers — hypervisor, identity, backup, vulnerability management, SIEM — that a mid-size company runs, and break them safely. Build the stack from the bottom up, add each layer only when the one below is stable, and resist the urge to install everything at once. The goal is not the biggest pile of services; it is a stack you understand well enough to rebuild from scratch — which, as part five shows, is exactly what Infrastructure as Code makes possible.