Self-Hosting Starter Stack: What to Run First
The order I'd build a first homelab in, from a fresh Proxmox install to photo backup, with what each piece needs and where its guide is.
By Brandon Sheley · Updated
Short answer: install Proxmox, then add Pi-hole or AdGuard Home, Tailscale for remote access, and a Docker host. On the Docker host, run Uptime Kuma, Vaultwarden and Nginx Proxy Manager. Then add Home Assistant, Immich and a media server. Set up backups before you put anything on it you'd hate to lose. A 16GB mini PC runs all of that except a NAS VM.
Don't open ports on your router for any of it. Reach everything over Tailscale instead.
The Stack, in Build Order
| # | Service | What it does | Runs as | Guide |
|---|---|---|---|---|
| 1 | Proxmox VE | Runs everything else as VMs and containers | Bare metal | Install guide |
| 2 | Pi-hole or AdGuard Home | Blocks ads and trackers for every device on your network | LXC | Setup guide |
| 3 | Tailscale | Reach your services from anywhere without opening router ports | LXC or each device | Below |
| 4 | Docker host | Runs the app containers in steps 5-7 | LXC or small VM | Docker guide, Dockhand |
| 5 | Uptime Kuma | Tells you when something goes down | Docker | Below |
| 6 | Vaultwarden | Password manager that works with the Bitwarden apps | Docker | Below |
| 7 | Nginx Proxy Manager | Friendly names and HTTPS certificates for your services | Docker | Below |
| 8 | Home Assistant OS | Home automation for lights, sensors and cameras | VM | Setup guide |
| 9 | Immich | Google Photos-style phone backup | Docker in a VM | Below |
| 10 | Emby or Jellyfin | Stream your movies and TV | LXC or Docker | My media lab |
| 11 | Proxmox Backup Server | Nightly backups of every VM and container | Separate machine | Setup guide |
Not sure about containers versus VMs? See LXC vs VM on Proxmox. The community helper scripts install most of these with one command.
Phase 1: The Foundation
Proxmox VE goes on the bare machine, and everything else runs on top of it. Follow how to install Proxmox VE 9, give the host a static IP, and switch to the free update repository. Use ext4 on a single disk, or a ZFS mirror if you have two (ZFS vs LVM-thin).
Write down every IP address you hand out as you go. A simple text file listing the service, its IP and its port saves a lot of hunting later.
Phase 2: DNS and Remote Access
Pi-hole or AdGuard Home is the best first service: it's useful the moment you point your router's DNS at it, and it fits in a 512MB LXC container. The Pi-hole and AdGuard Home guide covers the setup and which blocklists are worth adding.
Tailscale builds a private WireGuard network between your devices, so your phone can reach Home Assistant or Vaultwarden from anywhere without exposing anything to the internet. The free Personal plan covers up to 6 users with unlimited devices, for non-commercial use. Install it in a small LXC and turn on subnet routing to reach your whole LAN, or install it on each machine you want to reach.
Want to replace your router too? That can come later: pfSense and OPNsense on Proxmox and the M720q router build. Don't make your first project the one that takes your whole house offline when it breaks.
Phase 3: A Docker Host and the First Apps
Most self-hosted apps ship as Docker containers, so you need one place to run them. Docker in an LXC with nesting turned on is lighter, and it's what I use for most small apps. Proxmox's own docs recommend a VM for application containers, and some apps say the same (Immich, below). The Docker guide covers both ways, and Dockhand gives you a web UI for managing them.
- Uptime Kuma checks your services and alerts you when one goes down. Its web UI is on port
3001. Keep its data on a local volume; the project says NFS isn't supported. - Vaultwarden is a lightweight, Bitwarden-compatible server written in Rust, so the official Bitwarden apps and browser extensions work with it. It isn't affiliated with Bitwarden, Inc. Its web vault needs HTTPS, which is what the next item is for. Back it up before you move your passwords into it.
- Nginx Proxy Manager gives each service a name like
vault.home.example.comwith a real HTTPS certificate, instead of an IP and port. It listens on ports80and443, and its admin UI is on81. If you only reach things over Tailscale, Tailscale's own HTTPS certificates are a simpler option.
A minimal Uptime Kuma container looks like this:
docker run -d --restart=always -p 3001:3001 \
-v uptime-kuma:/app/data --name uptime-kuma louislam/uptime-kuma:2Phase 4: Home, Photos and Media
- Home Assistant OS runs best as a full VM. Its documented floor is 2GB of RAM, but plan on 4GB once you add a few add-ons. See Home Assistant on Proxmox.
- Immich backs up your phone's photos and videos automatically, much like Google Photos. It's the heaviest app here: Immich's docs list a 6GB RAM minimum (8GB recommended) and 2 CPU cores (4 recommended). They also say Docker inside LXC isn't recommended, and the database must sit on a local SSD, never a network share. Give it its own small Debian VM.
- Emby or Jellyfin for movies and TV. Jellyfin is free and open source; I run Emby. A CPU with Intel Quick Sync handles transcoding easily. See my media lab, and the data hoarding hub for storing the library.
- A NAS, once you outgrow the mini PC's disk: TrueNAS Scale on Proxmox (8GB RAM minimum) or a separate NAS box (NAS power use, NAS prices).
Phase 5: Backups, Before You Need Them
Once your passwords and photos live on this box, a dead SSD stops being an inconvenience. Proxmox Backup Server on a second machine takes nightly, deduplicated backups of every VM and container. Keep one more copy off-site with a sync job. Until it's running, Proxmox's built-in backup to a USB drive is better than nothing. Test a restore once, so you know it works before the day you need it.
How Much RAM the Stack Needs
RAM runs out before CPU does on a homelab. These are the documented minimums from each project or my own guides, plus my estimate for a Docker host running a few small apps:
| Piece | RAM to plan | Basis |
|---|---|---|
| Proxmox VE itself | 2GB | Proxmox recommends at least 2GB for the host |
| Pi-hole or AdGuard Home (LXC) | 512MB | helper-script default |
| Docker host for small apps | 2GB | my estimate for Uptime Kuma, Vaultwarden and a reverse proxy |
| Home Assistant OS (VM) | 4GB | 2GB documented minimum; 4GB once you add add-ons |
| Immich photo backup | 6GB | Immich's documented minimum; 8GB recommended |
| TrueNAS Scale (VM) | 8GB | TrueNAS minimum |
| Build | Planned | Installed | Left over |
|---|---|---|---|
| Starter: 16GB mini PC | 14.5GB | 16GB | 1.5GB |
| With a NAS VM: 32GB | 22.5GB | 32GB | 9.5GB |
Containers only use what they need, so real usage usually lands below these numbers, but VMs hold on to what you give them. An Intel N100 mini PC with 16GB is the usual starting box; on my mini PC tracker they start at $190 today. Compare options in best mini PC for Proxmox, plan a build with the homelab build planner, and check what it'll cost to leave on 24/7 with the power cost calculator.
Five Rules That Save Beginners
- Don't port-forward. Use Tailscale or WireGuard. Exposing a service to the internet means keeping it patched against everyone, forever.
- Add one service at a time and get it working before you start the next.
- Snapshot before you change anything. Proxmox snapshots take seconds and make updates painless.
- Back up before you rely on it. Especially passwords and photos.
- Keep it updated. Update Proxmox monthly (release notes) and your containers on a schedule, not never.
Frequently Asked Questions
What should I self-host first?
Start with Pi-hole or AdGuard Home for network-wide ad blocking. It is small, useful on day one, and teaches you containers, static IPs and DNS. Next set up Tailscale for remote access and a Docker host, then add Uptime Kuma, a password manager like Vaultwarden, Home Assistant and photo backup with Immich. Set up backups before anything you would hate to lose.
How much RAM do I need for a self-hosting homelab?
16GB runs a solid starter stack: Proxmox, Pi-hole, a Docker host with a few small apps, Home Assistant with 4GB and Immich with its 6GB minimum add up to about 14.5GB. Add a TrueNAS VM and you want 32GB, since TrueNAS needs at least 8GB on its own.
Should I run Docker in an LXC container or a VM on Proxmox?
Both work. Docker in an LXC with nesting turned on is lighter and is what I run for most small apps. Proxmox's own docs recommend a VM for application containers, and Immich specifically says Docker inside LXC is not recommended, so put Immich and anything you would hate to see break after an update in a small Debian VM.
How do I access my self-hosted services from outside my home?
Use a VPN instead of opening ports on your router. Tailscale is the easiest: its free Personal plan covers up to 6 users with unlimited devices for non-commercial use, and nothing on your network is exposed to the internet. A plain WireGuard server on your router or in an LXC is the do-it-yourself alternative.
Is Vaultwarden the same as Bitwarden?
No. Vaultwarden is a separate, lightweight server written in Rust that works with the official Bitwarden apps and browser extensions. It is not affiliated with Bitwarden, Inc. Its web vault needs HTTPS, so set it up behind a reverse proxy or Tailscale's HTTPS certificates rather than plain http.