Homelab v2: notes from moving off a full-size rack

The first version of my homelab was a full-size 42U rack. It ran hot, it was loud, it lived in the wrong room, and it grew by accretion instead of by design. Every time I wanted to try something, it was another U of steel and another fan. Version two starts from a different constraint: the rack has to fit under a desk.

The constraint

3D printing brings the cost of custom rack hardware to close to nothing, and 10-inch rack ecosystems have gotten deep enough over the last few years that most of the parts I want either exist or are one print away. The picture I had in my head: a modular 10-inch rack, sled-shaped bays, cable pass-throughs that route on purpose instead of by accident, quiet enough to live in the room I actually work in.

What has to earn its way in

The migration turned into a curation problem. Full-rack v1 ran a lot of things because I could. 10-inch v2 has less than a quarter of the U, so each service has to make its case:

• Proxmox cluster for VMs and containers. Non-negotiable, everything else runs on top of it.
• Self-hosted DNS for the LAN, including ad blocking and split-horizon for the tailnet.
• Wireguard VPN so the box is reachable from anywhere without exposing it to the internet.
• Backup targets for both the homelab itself and the machines that live outside it.
• Wazuh SIEM. This one is the interesting story.

The SIEM as the acceptance test

Wazuh started as a resume line and turned into the way I know whether the migration is going well. Every host on the LAN runs an agent, and every configuration change I make - a firewall rule, a service restart, an unexpected package install - has to survive Wazuh’s alert set without a false positive.

When I move a service from v1 to v2, the acceptance test is not “does it come up?” It is “does Wazuh notice I broke something before I do?” It has caught two misconfigurations already: a Docker container running with more privileges than it needed, and an SSH config that stopped rejecting keyboard-interactive after a bootstrap script mis-touched it. Both would have been found eventually. Both were found in minutes because the SIEM was watching.

What comes next

The rack is not done. There is more consolidation coming - the goal is a shape where every service earns its slot, cable routing is intentional, and the whole thing runs quiet enough that a family member walking by does not comment. Photos and diagrams belong in a follow-up post; this one is the logic, not the picture.

The lesson so far: cutting scale from a homelab is more useful than adding it. Every service that survived the migration is one I would deploy again on purpose. Everything that did not survive is one I was running because I could, not because it earned its watts.