ServeHub-2 is a comprehensive guide to creating a dual-server architecture, comprising both local and remote servers, tailored to meet specific operational needs. This project offers a robust solution for individuals seeking a fully self-hosted server setup complete with essential services right out of the box.

The hybrid approach utilized in ServeHub-2 allows resource-intensive services to run on a local machine while leveraging a remote VPS for secure internet access. This model maintains cost efficiency compared to hosting everything on a single high-powered VPS.

Key Features

• Nextcloud: A versatile cloud storage solution for files, contacts, and photos.
• Vaultwarden: A lightweight password manager compatible with the Bitwarden API for encrypted data storage.
• Gitea: An efficient Git-based version control system.
• Navidrome: Stream personal music collections effortlessly.
• Audiobookshelf: A server for audiobooks and podcasts with progress synchronization.

Network Architecture and Security

• Webnames: Domain registrar that manages domain ownership and DNS records (A records, Wildcard) essential for SSL functionality.
• WG-easy + AmneziaWG: An encrypted tunnel connecting devices to the VPS, obscuring the infrastructure, with service access strictly controlled within the VPN subnet 10.8.0.0/24 and a web panel for management.
• AdGuard Home: A local DNS server that blocks advertisements and trackers.
• Nginx (Proxy): Functions as a reverse proxy, ensuring that only internal network requests within the tunnel can access the services.
• SSH: Configured for key-based access using ed25519 and disabled password logins.
• Certbot: Automates the acquisition of SSL certificates (Wildcard) through DNS-01 verification, integrated with the Webnames API.
• Fail2ban: Offers protection against brute-force attacks at the system level.

Monitoring and Control

• Prometheus & Exporters: Collects metrics from the host (Node Exporter), containers (cAdvisor), and the web server (Nginx Exporter).
• Grafana: Provides visualization of system status and service performance.
• Gatus: Continuously monitors the uptime of the local server through regular healthcheck endpoint polling.
• Portainer: A web interface for Docker container administration.
• Loki + Grafana Alloy: Consolidates logs from all containers into a single source.

Alerting and Communication

• Alertmanager: Monitors critical events on the local server.
• Gatus: Tracks the operational status of both local and remote servers while checking SSL certificate validity.
• TG Bot Integration: Utilizes a Telegram bot for receiving notifications from Alertmanager and Gatus.

Backup Solutions

• BorgBackup + Borgmatic: Provides encrypted automated backups with lz4 compression.
• BorgUI: An interface for easily viewing backups.

Automation

• Ansible: A configuration management system for the automated deployment of OS, security settings, and orchestrating Docker containers.
• Vagrant: Facilitates rapid creation of virtual machines for testing Ansible playbooks.

User Convenience

• Homepage: A beautifully designed homepage that streamlines access to services through the web browser.