Home Lab 家庭实验室完全搭建指南：从硬件选型到虚拟化、网络与服务部署

# 1. 下载 PVE ISO
# https://www.proxmox.com/en/downloads

# 2. 制作启动 U 盘（macOS）
diskutil unmountDisk /dev/diskN
sudo dd if=proxmox-ve.iso of=/dev/rdiskN bs=1M

# 3. BIOS 设置
# - 开启 VT-x / VT-d（虚拟化）
# - 开启 Hyper-Threading
# - 设置 U 盘优先启动

# 4. 安装 PVE
# 按照安装向导：
# - 选择目标硬盘
# - 设置时区、键盘
# - 设置管理 IP（如 192.168.1.100）
# - 设置 root 密码
# - 设置邮箱

# 5. 安装完成后访问
# https://192.168.1.100:8006
# 用户名：root
# 密码：你设置的密码

# 1. 更新系统
apt update && apt dist-upgrade -y

# 2. 去除企业源（免费版）
rm -f /etc/apt/sources.list.d/pve-enterprise.list

# 3. 添加免费源
echo "deb http://download.proxmox.com/debian/pve bookworm pve-no-cost-subscription" > /etc/apt/sources.list.d/pve.list
apt update

# 4. 去除订阅提示（可选）
sed -i.bak "s/data.status !== 'Active'/false/g" /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js
systemctl restart pveproxy

# 5. 安装常用工具
apt install -y vim curl wget git htop iftop iotop ncdu

# 6. 配置邮件通知（可选）
apt install -y postfix

# OpenWrt VLAN 划分
# 网络 → 接口 → 设备 → 配置 VLAN

# VLAN 10 (管理)
# vid: 10, ports: CPU tagged, LAN1 tagged

# VLAN 20 (LAN)
# vid: 20, ports: CPU tagged, LAN2-LAN4 untagged

# VLAN 30 (IoT)
# vid: 30, ports: CPU tagged, WAN untagged

# 防火墙规则（IoT 隔离）
# 网络 → 防火墙 → 自定义规则
iptables -I FORWARD -i br-iot -d 192.168.20.0/24 -j DROP
iptables -I FORWARD -i br-iot -d 192.168.10.0/24 -j DROP

# 在 PVE Web 界面创建虚拟机
# - 系统：Debian 12
# - CPU：2 核
# - 内存：4GB
# - 硬盘：64GB
# - 网络：VLAN 10（管理网）

# 进入虚拟机后安装 Docker
apt update
apt install -y curl vim

# 安装 Docker
curl -fsSL https://get.docker.com | bash

# 安装 Docker Compose
apt install -y docker-compose-plugin

# 验证
docker --version
docker compose version

# 创建自定义网络（隔离不同服务）
# 前端网络（Web 服务）
docker network create --driver bridge \
  --subnet 172.20.0.0/16 \
  --gateway 172.20.0.1 \
  web-net

# 后端网络（数据库等）
docker network create --driver bridge \
  --subnet 172.21.0.0/16 \
  --gateway 172.21.0.1 \
  db-net

# 管理网络
docker network create --driver bridge \
  --subnet 172.22.0.0/16 \
  --gateway 172.22.0.1 \
  mgmt-net

# /opt/home-lab/docker-compose.yml
version: '3.8'

services:
  # ============ 反向代理 ============
  nginx-proxy-manager:
    image: jc21/nginx-proxy-manager:latest
    container_name: npm
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "81:81"  # 管理界面
    volumes:
      - ./data/npm:/data
      - ./data/npm/letsencrypt:/etc/letsencrypt
    networks:
      - web-net

  # ============ 私人云盘 ============
  nextcloud:
    image: nextcloud:latest
    container_name: nextcloud
    restart: unless-stopped
    depends_on:
      - nextcloud-db
    volumes:
      - ./data/nextcloud:/var/www/html
    networks:
      - web-net
      - db-net

  nextcloud-db:
    image: mariadb:10.6
    container_name: nextcloud-db
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: ${NC_DB_ROOT_PW}
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: ${NC_DB_PW}
    volumes:
      - ./data/nextcloud-db:/var/lib/mysql
    networks:
      - db-net

  # ============ 密码管理器 ============
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: https://vault.example.com
      ADMIN_TOKEN: ${VW_ADMIN_TOKEN}
      SIGNUPS_ALLOWED: false
    volumes:
      - ./data/vaultwarden:/data
    networks:
      - web-net

  # ============ 媒体中心 ============
  jellyfin:
    image: jellyfin/jellyfin:latest
    container_name: jellyfin
    restart: unless-stopped
    ports:
      - "8096:8096"
    volumes:
      - ./data/jellyfin/config:/config
      - ./data/jellyfin/cache:/cache
      - /mnt/media:/media:ro
    networks:
      - web-net

  # ============ 智能家居 ============
  homeassistant:
    image: homeassistant/home-assistant:latest
    container_name: homeassistant
    restart: unless-stopped
    privileged: true
    network_mode: host
    volumes:
      - ./data/homeassistant:/config
      - /etc/localtime:/etc/localtime:ro

  # ============ 广告拦截 DNS ============
  adguardhome:
    image: adguard/adguardhome:latest
    container_name: adguardhome
    restart: unless-stopped
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "3000:3000"  # 管理界面
    volumes:
      - ./data/adguard/work:/opt/adguardhome/work
      - ./data/adguard/conf:/opt/adguardhome/conf
    networks:
      - web-net

  # ============ 监控 ============
  uptime-kuma:
    image: louislam/uptime-kuma:latest
    container_name: uptime-kuma
    restart: unless-stopped
    ports:
      - "3001:3001"
    volumes:
      - ./data/uptime-kuma:/app/data
    networks:
      - web-net

  # ============ Git 服务 ============
  gitea:
    image: gitea/gitea:latest
    container_name: gitea
    restart: unless-stopped
    environment:
      USER_UID: 1000
      USER_GID: 1000
    ports:
      - "3002:3000"
      - "2222:22"
    volumes:
      - ./data/gitea:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    networks:
      - web-net
      - db-net

networks:
  web-net:
    external: true
  db-net:
    external: true

# 创建环境变量文件
cat > .env << 'EOF'
NC_DB_ROOT_PW=your-strong-password
NC_DB_PW=your-strong-password
VW_ADMIN_TOKEN=your-admin-token
EOF

# 启动所有服务
docker compose up -d

# 查看状态
docker compose ps
docker compose logs -f

# 添加 HDD 数据盘
# PVE Web → Datacenter → Storage → Add → Directory

# 或命令行
pvesm add dir hdd-data \
  --path /mnt/hdd \
  --content images,rootdir,vztmpl,iso,backup

# 配置 ZFS（推荐，支持快照）
# 假设新磁盘是 /dev/sdb
zpool create -f -o ashift=12 tank /dev/sdb
zfs create tank/vm-disks
zfs create tank/docker-data
zfs create tank/media

# PVE 中添加 ZFS 存储
pvesm add zfspool tank-zfs --pool tank

# 手动备份
vzdump 100 --storage local --mode snapshot --compress zstd

# 定时备份（PVE Web → Datacenter → Backup）
# 每周日凌晨 2 点备份所有虚拟机
# 保留最近 4 份

# 或命令行配置
echo "0 2 * * 0 root vzdump --all --storage local --mode snapshot --compress zstd --mailto admin@example.com" >> /etc/crontab

#!/bin/bash
# backup-docker.sh - Docker 数据备份脚本

BACKUP_DIR="/mnt/hdd/backup/docker"
DATE=$(date +%Y%m%d)
RETENTION=7

mkdir -p $BACKUP_DIR

# 备份所有 Docker volumes
for volume in $(docker volume ls -q); do
    echo "Backing up $volume..."
    docker run --rm \
        -v ${volume}:/data:ro \
        -v ${BACKUP_DIR}:/backup \
        alpine tar czf /backup/${volume}_${DATE}.tar.gz -C /data .
done

# 备份 docker-compose 配置
tar czf ${BACKUP_DIR}/config_${DATE}.tar.gz /opt/home-lab/

# 清理旧备份
find $BACKUP_DIR -name "*.tar.gz" -mtime +$RETENTION -delete

echo "Backup completed: $DATE"

# 设置定时任务
# crontab -e
0 3 * * * /opt/home-lab/backup-docker.sh >> /var/log/docker-backup.log 2>&1

# 使用 rclone 同步到云存储
apt install -y rclone
rclone config
# 配置 S3 / Backblaze B2 / Google Drive

# 定时同步
rclone sync /mnt/hdd/backup remote:home-lab-backup --transfers 4 --checkers 8

# 1. PVE 防火墙
# PVE Web → Datacenter → Firewall → Options
# 启用防火墙

# 允许 SSH（仅管理网）
# PVE Web → Firewall → Add
# Direction: IN, Action: ACCEPT, Source: 192.168.10.0/24, Dest Port: 22

# 允许 Web 管理（仅管理网）
# Direction: IN, Action: ACCEPT, Source: 192.168.10.0/24, Dest Port: 8006

# 默认拒绝其他
# Direction: IN, Action: DROP

# 2. SSH 加固
sed -i 's/Port 22/Port 2222/' /etc/ssh/sshd_config
sed -i 's/PermitRootLogin yes/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart sshd

# 3. Fail2ban
apt install -y fail2ban
cat > /etc/fail2ban/jail.local << 'EOF'
[sshd]
enabled = true
port = 2222
maxretry = 3
bantime = 3600
EOF
systemctl enable --now fail2ban

# 使用 Nginx Proxy Manager 统一管理 TLS 证书
# 访问 http://192.168.1.x:81
# 默认账号：admin@example.com / changeme

# 添加 Proxy Host：
# Domain: nextcloud.example.com
# Forward IP: 127.0.0.1
# Forward Port: 对应容器端口
# SSL: 申请 Let's Encrypt 证书

# 或使用 Cloudflare Tunnel（更安全）
cloudflared tunnel create home-lab
cloudflared tunnel route dns home-lab nextcloud.example.com

cat > ~/.cloudflared/config.yml << 'EOF'
tunnel: home-lab
credentials-file: /root/.cloudflared/home-lab.json

ingress:
  - hostname: nextcloud.example.com
    service: http://nextcloud:80
  - hostname: vault.example.com
    service: http://vaultwarden:80
  - hostname: jellyfin.example.com
    service: http://jellyfin:8096
  - service: http_status:404
EOF

cloudflared tunnel run home-lab

# 已在 docker-compose.yml 中部署
# 访问 http://192.168.1.x:3001

# 添加监控：
# - HTTP 监控：Nextcloud / Vaultwarden / Jellyfin
# - TCP 监控：SSH / 数据库
# - Ping 监控：路由器 / 互联网
# - DNS 监控：AdGuard Home

# 配置通知：
# - Telegram
# - 邮件
# - Webhook

# 添加到 docker-compose.yml
  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    restart: unless-stopped
    volumes:
      - ./data/prometheus:/etc/prometheus
      - ./data/prometheus/data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
    networks:
      - mgmt-net

  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    restart: unless-stopped
    ports:
      - "3003:3000"
    environment:
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PW}
    volumes:
      - ./data/grafana:/var/lib/grafana
    networks:
      - mgmt-net

  node-exporter:
    image: prom/node-exporter:latest
    container_name: node-exporter
    restart: unless-stopped
    pid: host
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    command:
      - '--path.procfs=/host/proc'
      - '--path.sysfs=/host/sys'
      - '--path.rootfs=/rootfs'
    networks:
      - mgmt-net