domains on blocklists
500K+
GitHub-sourced domain lists currently loaded into Pi-hole.
Personal infrastructure / Homelab2026 — present
A private cloud that stays private.
I built a Raspberry Pi 5 homelab for file storage, private remote access, and network-level DNS—without opening the services directly to the public internet.
Private network / service mapLocal + remote
Connection path
- 01
Approved home or remote device
Runs the Tailscale client and joins my private tailnet.
- Encrypted private connection
- 02
Raspberry Pi 5
Its own Tailscale client accepts the approved device's request.
- Docker maps the request to the selected container
03 / Docker services on the Pi
The requested service responds
Nextcloud + 2 TB SSD
Pi-hole
Unbound DNS
Containers keep their default internal ports · Docker publishes distinct host ports
No direct public service exposure
- Hardware
- Raspberry Pi 5
- Storage
- 2 TB SSD
- Application
- Nextcloud
- Runtime
- Docker
- Remote access
- Tailscale mesh VPN
- DNS
- Pi-hole + Unbound
Current operating snapshot
Small hardware, useful scale.
A live look at what the stack is handling now. Blocklist size and filtering rate change as sources update and network traffic shifts.
DNS queries blocked
~30%
The current share reported by the Pi-hole dashboard.
dedicated SSD storage
2 TB
Local storage allocated to the Nextcloud instance.
image previews
Prebuilt
Medium-resolution thumbnails are generated ahead of browsing for fast gallery loading.
System architecture
Storage, access, and DNS—kept under one roof.
Store it locally
Nextcloud runs on the Raspberry Pi with a dedicated 2 TB SSD, creating a personal file service on hardware I control.
Reach it privately
Tailscale connects approved devices through a private mesh VPN, so remote access does not require exposing the service directly to the public internet.
Control the lookup path
Pi-hole provides network-level filtering while Unbound handles recursive DNS resolution inside the same self-managed stack.
Keep ports from colliding
Docker gives each container its own internal network. Services can keep their expected default ports while Docker maps them to distinct ports on the Pi.
Operating choices
Designed around privacy, not public exposure.
No public service exposure
Remote connections stay behind the private Tailscale network.
Static local addressing
A predictable address keeps services and network configuration consistent at home.
Containerized services
Docker separates each service's internal ports, then maps only the chosen host ports on the Pi so defaults do not conflict.
Useful in two contexts
The same setup remains available on the home network and through approved remote devices.
More work