⌘

Home Lab — na prvi pogled

Oracle VPS

Hostnamevpn-server
IP130.162.209.80
OSUbuntu 22.04
CPU / RAM2 core / 1 GB
Uptime528 dana

Mini PC

Hostnamehome-core-dev
LAN IP192.168.0.240
WiFi IP192.168.0.241
WireGuard IP10.8.0.6
OSDebian 13 (trixie)

Aktivni URL-ovi

URLServisStatus
ha.dzonicasa.xyzHome Assistantlive
pihole.dzonicasa.xyzPi-hole DNS + AdBlocklive
docs.dzonicasa.xyzDokumentacija (ovo)live

Brzi linkovi

Servisi SSH pristup Security Arhitektura Održavanje

Svi servisi

Home Assistant

externiport 8123

Smart-home kontrola, automations, dashboardovi.

URLhttps://ha.dzonicasa.xyz
Lokalnihttp://192.168.0.240:8123
App (S22)Unesi https://ha.dzonicasa.xyz
Trusted proxies172.18.0.0/16, 10.8.0.0/24

Pi-hole

externiDNS 53web 8180

DNS resolver + ad blocker + network monitoring. Vidi koji uređaj šta posećuje.

URLhttps://pihole.dzonicasa.xyz
Lokalnihttp://192.168.0.240:8180/admin
Admin passdzonicasa2026
DNS adresa192.168.0.240:53

Mosquitto MQTT

port 1883anon auth on

Message broker za IoT uređaje i Home Assistant komunikaciju.

OpenClaw Gateway

port 18789port 18790

Smart-home automation gateway. Trenutna verzija: v2026.3.25 (dostupna v2026.5.12).

Guest Portal

port 8090

Welcome stranica za goste, QR kod za WiFi, light-control webhooks.

SSH & Pristup

Oracle VPS SSH

ssh -i ~/.ssh/ssh-key-2024-10-17.key ubuntu@130.162.209.80

Alias na WSL mašini: oracle-vps

Mini PC SSH

ssh devops@192.168.0.240   # LAN
ssh devops@192.168.0.241   # WiFi

Aliasi: mini-pc, mini-pc-lan, mini-pc-wifi

WireGuard Admin Panel

Port 51821 je blokiran spolja. Pristup samo kroz SSH tunel:

ssh -L 51821:localhost:51821 ubuntu@130.162.209.80
# Onda otvori: http://localhost:51821
# Lozinka: WZaadgj6

Home Assistant App — Samsung S22

  1. Google Play → Home Assistant
  2. Unesi: https://ha.dzonicasa.xyz
  3. Loguj se svojim kredencijalima
  4. Dozvoli notifikacije i lokaciju

Security Hardening

Oracle VPS

fail2banAktivan — 3 neuspela SSH = 1h ban
Whitelist188.2.11.65 (kuća), 79.101.44.157 (office)
Port 111 rpcbindzatvoren
Port 51821 wg-easy UIzatvoren — samo SSH tunel
Otvoreno spolja22, 80, 443, 51820/udp

Mini PC

SSHKey-only auth, root login off, X11 off
FirewallINPUT DROP — samo potrebni portovi
Dozvoljeni portovi22, 53, 1883, 8090, 8123, 8180, 18555, 18789, 18790
WireGuardCeo wg0 interfejs propušten
Docker subnetovi172.17/16, 172.18/16, 172.19/16 propušteni

SSL Certifikati

DomenIzdajeIstiče
ha.dzonicasa.xyzLet's Encrypt15.08.2026
pihole.dzonicasa.xyzLet's Encrypt15.08.2026
docs.dzonicasa.xyzLet's Encrypt15.08.2026

Auto-renew na 12h kroz certbot kontejner.

⚠️ Mosquitto MQTT — allow_anonymous true. Bilo ko na LAN-u može publish/subscribe. Treba dodati user/password — ali prvo proveri IoT uređaje.

Arhitektura

# Internet │ ▼ Oracle VPS 130.162.209.80 — vpn-server ├── Nginx HTTPS (80/443) │ ├── ha.dzonicasa.xyz → Home Assistant │ ├── docs.dzonicasa.xyz → Dokumentacija │ └── pihole.dzonicasa.xyz → Pi-hole Admin ├── WireGuard Easy (Docker, 51820/udp) ├── Certbot (Let's Encrypt auto-renew, 12h) ├── fail2ban (SSH protection) └── Firewall (iptables: 22, 80, 443, 51820/udp) │ ▼ WireGuard tunel (10.8.0.0/24) │ Mini PC 10.8.0.6 — home-core-dev (Debian 13) ├── Home Assistant (192.168.0.240:8123, host net) ├── Pi-hole (53 DNS + 8180 web, Docker) ├── Mosquitto MQTT (1883, Docker) ├── Guest Portal (8090, Docker) ├── OpenClaw Gateway (18789/18790, Docker) ├── go2rtc (18555) └── Firewall (INPUT DROP, allowlist portova)

WireGuard Peers

NazivIPPoslednji handshake
mini-pc10.8.0.6aktivan
dzoni-mob10.8.0.2365d ago
dzoni-lenovo10.8.0.3228d ago
vuk10.8.0.4~1y ago
Cveta-laptop10.8.0.5nikad
vindoza10.8.0.7243d ago

Održavanje & Kako-da

SSL cert obnova

Automatski na svakih 12h (certbot kontejner). Ručno:

ssh oracle-vps
docker exec certbot certbot renew
docker exec nginx-proxy nginx -s reload

Dodavanje novog subdomain-a

  1. Napravi nginx konfig u ~/nginx-proxy/conf.d/
  2. Izgeneriši SSL:
docker run --rm \
  -v ~/nginx-proxy/certbot/www:/var/www/certbot \
  -v ~/nginx-proxy/certbot/conf:/etc/letsencrypt \
  certbot/certbot certonly --webroot \
  --webroot-path=/var/www/certbot \
  -d NOVI.dzonicasa.xyz
  1. Aktiviraj HTTPS konfig i reload: docker exec nginx-proxy nginx -s reload

Pi-hole update / restart

ssh mini-pc
docker pull pihole/pihole:latest
docker stop pihole && docker rm pihole
# pa ponovo docker run sa istim parametrima

Korisni aliasi (WSL ~/.bashrc)

alias mini-pc='ssh devops@192.168.0.240'
alias mini-pc-wifi='ssh devops@192.168.0.241'
alias oracle-vps='ssh -i ~/.ssh/ssh-key-2024-10-17.key ubuntu@130.162.209.80'
alias wg-ui='ssh -L 51821:localhost:51821 ubuntu@130.162.209.80'

Domen i DNS

RegistrarSpaceship
Domendzonicasa.xyz
Nameserverilaunch1.spaceship.net, launch2.spaceship.net
A record* → 130.162.209.80