This is almost right, but you’ll need more specific iptables rules for the split tunneling - try something like ip route add YOUR.HOME.SUBNET.0/24 via 10.0.0.2 on the VPS and then on the homelab add iptables -t nat -A POSTROUTING -d YOUR.HOME.SUBNET.0/24 -j ACCEPT followed by iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE to route evreything else through the VPS connection.
Authelia is great, but I’ve been using Authentik for a similar setup and it’s been rock solid with more user-friendly UI if your famly members aren’t tech savvy, pluss it has some nice passwordless options.
The S3 suggestion for static content is gold - I’ve seen this cut costs by 60-70% in similar setups since Fargate billing is mostly about runtime, not just storaeg.
Yep, just enable subnet routes in your Tailscale admin console and check “advertise routes” on both servers - that’ll let all your devices use the Tailscale connection without needing the client installed on evrything.
You can actually run it without Docker using any static file server or even just opening the HTML file directly from your filesystem - no need for a dedicated desktop app when its all just static files.
The Arc actually makes sense here since OP mentioned multiple cameras for Frigate - QuickSync on N100/N305 starts to choke with 5+ simultaneous streams, while Arc A380 can handle 8+ streams with AV1 decode/encode as a bonus.
Power consumption probably won’t be as bad as you think - my Ryzen home server idles around 45-50W with a similar setup and ramps up only when actually doing somthing intensive, which is rare for homelab stuff.
+1 for Forgejo here. It’s lightweight on resources compared to GitLab but still has all the features you’d need, plus the security/privacy focus aligns with your priorities. I’ve been running it on a small VPS for over a year and it’s been rock soild.
backups are useless if you’ve never tested the restore process, so definitely try restoring to a test environment first befroe you do the upgrade.
You’re missing the networks section in your audiobookshelf service definition - add networks: [nginx] to your audiobookshelf service to actually connect it to the network (just defining the network at the bottom doesn’t automatically attach your service to it, which is why npm can’t reach it and gives you that 502 error), and if you’re an audiobook fan you might wanna check out the soundleaf app for ios which works great with audiobookshelf.
just a heads up - with that many services running you might want to consider a backup power solution, especially for critical stuff like home assistant. i’ve found some great deals on portable power stations on gearscouts.com that can keep a mini pc running for hours during an outage (look for LFP batteries for best longevity).
Check out the GoIP GSM gateways (1/4/8 port options) - they’re more reliable than DIY solutions for what your trying to accomplish and let you access SMS/calls via SIP protocols while using actual SIM cards.
If you’re setting this up for audiobookshelf, you might wanna check out the Soundleaf app for iOS - it’s been a game changer for me with my self-hosted audiobookshelf server.
If you do end up hosting on a VPS, consider one with renewable energy since tor nodes can consume a lot of power over time - or for home setups, you could run it off a portable power station to offset electricity costs (check out power station comparisons to find the best wh value for continous loads).
MPD (Music Player Daemon) would be perfect for that old Autonomic - super lightweight, runs on practically anythng, and Symfonium is an amazing Android client that supports it natively.
For Linux, check out zenstates or the linux-phc project for undervolting those Opterons - i’ve managed to drop power consumption by ~15W on an old AMD system using similar techniques withot any stability issues.