Nocturnal Home Server

Documentation

• Installation — first-time provisioning checklist
• Administration — day-to-day operations and hctl command reference
• Architecture — auth flows, network layout, and secrets reference

Architecture

graph TD
    Internet["🌐 Internet"] --> Traefik

    subgraph proxy["proxy network"]
        Traefik["Traefik\nreverse proxy + SSL"]
        Authelia["Authelia\nauthelia.nocturnal-home.de"]
        LLDAP["LLDAP\nlldap.nocturnal-home.de"]
        Radicale["Radicale\nradicale.nocturnal-home.de"]
        Firefly["Firefly III\nbudget.nocturnal-home.de"]
        Importer["Firefly Importer\nimporter.nocturnal-home.de"]
        Grafana["Grafana\ngrafana.nocturnal-home.de"]
        Whoami["Whoami\nwhoami.nocturnal-home.de"]
        Homepage["Homepage\nhome.nocturnal-home.de"]
        Synapse["Synapse\nchat.nocturnal-home.de"]
        Element["Element\nchat.nocturnal-home.de"]
        SynapseAdmin["Synapse Admin\nmatrix-admin.nocturnal-home.de"]
        Immich["Immich\nphotos.nocturnal-home.de"]
    end

    subgraph postgres_net["postgres network"]
        Postgres[("postgres\nShared PostgreSQL")]
    end

    subgraph lldap_net["lldap network"]
        LLDAP
    end

    subgraph authelia_net["authelia network"]
        Authelia
        Redis[("iam-redis\nRedis")]
    end

    subgraph finance_net["finance network"]
        Firefly
        Importer
        Ofelia["ofelia\ncron scheduler"]
    end

    subgraph monitoring_net["monitoring network"]
        Grafana
        Prometheus["Prometheus"]
        Loki["Loki"]
        Promtail["Promtail"]
        NodeExporter["Node Exporter"]
        Cadvisor["cAdvisor"]
    end

    subgraph messaging_net["messaging network"]
        Synapse
        Coturn["Coturn\nSTUN/TURN"]
    end

    subgraph photos_net["photos network"]
        Immich
        ImmichML["Immich ML"]
        ImmichPostgres[("immich-postgres")]
        ImmichRedis[("immich-redis\nValkey")]
    end

    Traefik -- "forward-auth" --> Authelia
    Authelia -- "LDAP :3890" --> LLDAP
    Authelia --- Redis
    Authelia --- Postgres
    LLDAP --- Postgres
    Ofelia -- "cron trigger" --> Firefly
    Ofelia -- "cron trigger" --> Importer
    Importer -- "API" --> Firefly
    Grafana --- Prometheus
    Grafana --- Loki
    Loki --- Promtail
    Prometheus --- NodeExporter
    Prometheus --- Cadvisor
    Synapse -- "OIDC" --> Authelia
    Synapse --- Postgres
    Immich -- "OIDC" --> Authelia
    Immich --- ImmichPostgres
    Immich --- ImmichRedis
    Immich --- ImmichML
    Radicale -- "LDAP :3890" --> LLDAP

Active Services

Infrastructure

• PostgreSQL - Shared database instance for all services
  • Location: services/00_postgres/
• Traefik - Reverse proxy with automatic HTTPS/SSL via Let's Encrypt
• LLDAP - Lightweight LDAP server for centralized user management
• Authelia - SSO and authentication with OIDC support
• Monitoring stack - Prometheus, Grafana, Loki, Promtail, Node Exporter, cAdvisor
  • Location: services/05_monitoring/

Applications

• Homepage - Service dashboard (forward-auth protected)
  • Location: services/06_homepage/
• Radicale - CalDAV/CardDAV server for calendars and contacts (LDAP-integrated)
  • Location: services/02_webdav/
• Firefly III - Personal finance manager with Authelia forward auth; includes data importer and ofelia cron scheduler
  • Location: services/03_finance/
• Matrix/Synapse - Matrix homeserver with Element web client, Coturn STUN/TURN, and Synapse Admin (OIDC via Authelia)
  • Location: services/07_messaging/
• Immich - Photo and video management (OIDC via Authelia, own PostgreSQL)
  • Location: services/08_photos/