The Fully Degoogled Homelab on Proxmox: Sovereign Cloud, Passwords, and Sync

Also available in: Italiano · Français

For more than a decade, Google’s cloud services have been marketed as the indispensable standard for modern digital life. We outsourced our files, personal contacts, calendars, passwords, and digital identities to a single advertising conglomerate. This centralized convenience came at an unacceptable cost: relentless behavioral tracking, vendor lock-in, and the total surrender of digital sovereignty.

Building an independent infrastructure is not an exercise in paranoia; it is basic operational hygiene and technical self-determination.

Using a modest home server running Proxmox VE, I transitioned my entire daily workflow (Linux workstation and Android smartphone) out of Mountain View's perimeter, replacing proprietary services with containerized, zero-knowledge, and open-source alternatives.

The Foundation: Proxmox VE and Container Isolation

The bedrock of the infrastructure is Proxmox VE (Virtual Environment), a bare-metal hypervisor built on Debian. Unlike bulky virtual machines, the strength of this architecture lies in LXC (Linux Containers):

• Resource Efficiency: Containers share the host kernel with near-zero CPU and memory overhead. A server with just 8 GB of RAM effortlessly hosts dozens of isolated services simultaneously.
• Network Segmentation & Hardening: Every service (storage, credential vault, sync) runs in its own unprivileged Debian or Ubuntu container, governed by granular firewall rules and routed through upstream SSL reverse proxies with automated Let's Encrypt certificates.
• Resilience with ZFS: Atomic snapshots allow instantaneous rollbacks before any maintenance or update, ensuring zero unexpected downtime.

1. Storage & Files: Seafile over Google Drive & Google Photos

Google Drive and Photos continuously scan metadata, documents, and family photos. Replacing them required a system engineered for raw performance, native deduplication, and rock-solid mobile synchronization: Seafile.

• Chunk-Based Block Storage: Unlike bloated PHP solutions, Seafile slices files into encrypted, indexed blocks written in C and Python. Sync speeds routinely saturate local Gigabit bandwidth.
• Deduplication and Versioning: File edits only store differential chunks, conserving storage while maintaining a comprehensive, immutable version history.
• Seamless Mobile Integration: The Android Seafile client provides instant background camera uploads and two-way document synchronization with my Linux laptop, with zero third-party cloud intermediaries.

2. Identity & Secrets: AliasVault + YubiKey 2FA over Google Password Manager

Entrusting master credentials to Google Chrome or the Android operating system permanently tethers your digital identity to their ecosystem. I deployed AliasVault, a privacy-focused password and identity manager built with Rust and WebAssembly:

• Zero-Knowledge Cryptography: The vault is encrypted client-side on the device before transmission, utilizing Argon2id for key derivation and AES-256-GCM / XChaCha20 for authenticated encryption. The Proxmox server stores only opaque blobs it cannot decrypt.
• Integrated Email Aliasing: Beyond credentials, credit cards, and WebAuthn/Passkeys, AliasVault runs an internal SMTP service to generate unique on-the-fly email aliases for every service, preventing cross-platform profiling.
• Hardware Hardening with YubiKey: Access to the core administration layer is strictly gated by hardware two-factor authentication (2FA) managed by a physical YubiKey via Yubico Authenticator (TOTP stored within the secure cryptographic element). No vulnerable SMS codes, no reliance on Google Authenticator: the secret key never leaves the physical silicon.

3. Contacts, Calendars & Tasks: EteSync over Google Contacts & Calendar

Personal contacts and daily calendars map out an individual’s most sensitive relational graph. Traditional CalDAV/CardDAV servers decentralize storage, but data often rests in plain text on the server. The answer is EteSync:

• Rigorous End-to-End Encryption (E2EE): EteSync operates as an encrypted, tamper-proof journal for contacts, calendars, and tasks. Even with root database access on the Proxmox host, reading an event description or phone number is cryptographically impossible.
• Native Android Integration: Through its dedicated sync adapter and DAVx5, native Android contacts and calendar apps sync directly with the local EteSync container in real time.

The Mobile Experience: True Android Independence

A self-hosted homelab is useless if it degrades day-to-day smartphone usability. On Android:

1. System-Level Autofill: AliasVault is registered as the primary OS Autofill provider, eliminating the prompt to store credentials inside Google Play Services.
2. Zero-Telemetry Input: Using FUTO Keyboard, I maintain simultaneous trilingual typing (IT, FR, EN) with offline autocomplete, stripping Google Gboard of keyboard telemetry.
3. Decoupled Browsing: Brave on Android delegates form autofill directly to the local AliasVault instance via secure native APIs.

Conclusion

Degoogling does not require compromising on convenience or modern functionality. It simply requires an architectural shift: abandoning the passive tenancy on surveillance clouds and reclaiming ownership of the hardware beneath your roof.

With a homelab powered by Proxmox VE, Seafile, AliasVault, and EteSync, privacy shifts from an abstract aspiration to an active, verified reality.