Household Hub is the family's Personal Information Management (PIM) platform —
one Docker Compose stack on a single LXC that groups four applications:
BookStack (knowledge base), Baïkal (shared CalDAV/CardDAV calendars),
LubeLogger (vehicle maintenance history), and Paperless-ngx (scanned
document archive, added in Phase 2) — plus a Homepage dashboard (Phase 3)
tying all four together in one Tailscale-only landing page.
See also: Operational Workflows
for the day-to-day/monthly/annual routines and worked examples of how these
services hand off to each other in practice — this page covers architecture
and ownership, that one covers usage.
Why grouped together, unlike every other single-purpose service in this
homelab: these four share the same purpose (household admin/organization,
not infrastructure), the same users (the household, not services or other
LXCs), the same maintenance schedule, and the same backup requirements. A
single compose stack with a shared MariaDB instance where applicable is
simpler to operate and back up than four separate LXCs for what is, in
practice, one "household operations" concern.
Single Source of Truth philosophy: every kind of household information
has exactly one owning application. Nothing is ever duplicated across two
apps "just in case" — if BookStack needs to reference a document that lives
in Paperless, or a repair that lives in LubeLogger, it links to it, it
doesn't copy it. This matters because duplicated data silently goes stale
(the copy in BookStack doesn't get updated when the original changes
elsewhere) — a single owner per data type means there's never a question of
which copy is the current one. See the ownership table below.
Docker: one docker compose stack (/opt/household-hub/compose.yml on
the LXC), seven containers total: hh-bookstack, hh-baikal, hh-lubelogger,
hh-paperless, hh-homepage, hh-mariadb, and hh-paperless-broker
(Valkey/Redis, required by Paperless's task queue). All on one Docker bridge
network (household-hub), all restart: unless-stopped, all with Docker
healthchecks, JSON-file logging capped at 10MB × 3 files per container.
Storage: persistent data lives at /mnt/ceph/docker/household-hub/ on the
LXC, one subdirectory per app (bookstack/, baikal/, lubelogger/,
paperless/, mariadb/, backups/). This is currently a local directory on
the LXC's own disk, not a real cephfs mount — /mnt/pve/cephfs/docker/ doesn't
exist yet on the Proxmox host — but it's laid out identically to how a real
cephfs mount would look, so migrating later is a straightforward rsync + bind
mount swap, not a redesign.
Database: one shared MariaDB 11 instance, but only BookStack actually uses
it (own database + least-privilege user) — this was a deliberate outcome, not
an inconsistency: LubeLogger has zero MySQL/MariaDB driver support at all
(verified by inspecting its image), Baikal chose SQLite during its own
installer, and Paperless was explicitly scoped to SQLite per the household's
scale (single-writer household use, avoiding a fourth database engine). Full
reasoning for each is in the container's own README.md.
Backup strategy: scripts/backup.sh, cron'd daily at 03:00 UTC. Dumps the
BookStack MariaDB database, runs Paperless's own document_exporter (portable
manifest + decrypted files, safer than copying a live SQLite file), and tars
every app's data directory plus the stack's own config (compose.yml, .env,
scripts). 14-day retention. Verified end-to-end with a real test document
(OCR'd, exported, then correctly pruned after deletion).
Authentication: BookStack and Baikal both have their own local logins
(BookStack's admin account was changed from the image default immediately
after first boot; Baikal's admin + CalDAV user were set during its one-time
web installer). LubeLogger currently has no login wall (EnableAuth=false,
acceptable since it's Tailscale/LAN-only for now). Paperless has its own local
admin account (auto-created via env vars on first boot). None of the four
are wired up to Authentik (SSO) yet — BookStack, LubeLogger, and Paperless
all support OIDC and could be registered as Authentik applications later;
Baikal is the one permanent exception, since CalDAV/CardDAV clients (iOS,
Thunderbird, DAVx5) don't support OIDC redirects at all.
Tailscale access: this LXC is joined to the tailnet with MagicDNS enabled
(household-hub, .tailbacb1d.ts.net). Tailscale is the primary access
path — there's no public domain or reverse proxy in front of this stack, and
none is currently needed. BookStack's APP_URL is pinned to the Tailscale
FQDN so its internal redirects resolve correctly; Paperless is more flexible
and trusts all three of the LAN IP, the Tailscale short name, and the
Tailscale FQDN simultaneously via PAPERLESS_CSRF_TRUSTED_ORIGINS.
Service URLs (all via Tailscale hostname household-hub, LAN IP
192.168.86.221 also works -- except Homepage, see below):
| Service | URL |
|---|---|
| BookStack | http://household-hub:6875 |
| Baïkal (admin panel) | http://household-hub:6876/admin/ |
| Baïkal (CalDAV) | http://household-hub:6876/dav.php/calendars/household/ |
| LubeLogger | http://household-hub:6877 |
| Paperless-ngx | http://household-hub:6878 |
| Homepage (dashboard) | http://household-hub:6879 -- Tailscale-only, not reachable on the LAN IP at all (bound to the Tailscale interface specifically) |
Why it exists: the household's long-term knowledge base — anything that's
reference information rather than a live record (apartment details, purchase
history, gift ideas, travel planning, recurring procedures).
What it owns: household knowledge and reference documentation. Currently
11 books: People, Apartment, Home (Future), Food, Finances, Purchases, Gift
Ideas, Vehicles, Travel, Procedures, Life Log — seeded with the full chapter/
page structure via an idempotent script.
What it should NOT contain: actual recipes (Mealie owns those — Food book
is explicitly references-only: restaurants, meal ideas, coffee shops, not
recipe instructions), vehicle maintenance history (LubeLogger owns that —
Vehicles book is static reference only: VIN, registration, tire sizes), scanned
original documents (Paperless owns those — BookStack pages should link to a
Paperless document's stable URL, not re-upload the file as a BookStack
attachment), and passwords (Finances book is explicit about this: reference
info only, never credentials).
Relation to other services: links out to Mealie (recipes) and Paperless
(scanned documents) rather than duplicating; no relation to Grocy, Immich, or
Home Assistant; not yet SSO'd to Authentik (documented follow-up).
Why it exists: shared household calendars that any family member's phone/
computer can subscribe to via standard CalDAV, independent of any single
provider's calendar app (no Google/Apple lock-in).
What it owns: calendar events across 5 calendars — Household (bills,
utilities, trash, maintenance, appointments), Relationship (date nights,
birthdays, anniversaries, vacations), Errands, Chores, Meal Planning.
What it should NOT contain: anything that isn't a scheduled event —
reference information belongs in BookStack, not as an all-day calendar entry
with notes.
Relation to other services: the Meal Planning calendar coordinates with
Mealie (meal plans) and Grocy (grocery shopping trips) but doesn't replace
either — Baikal just has the when, Mealie/Grocy have the what. No relation
to Immich or Home Assistant. Deliberately excluded from Authentik SSO (CalDAV
client incompatibility, not an oversight).
Why it exists: dedicated vehicle ownership history — fuel, maintenance,
repairs, modifications, mileage, registration, insurance, expenses — tracked
per-vehicle over the vehicle's whole ownership lifetime.
What it owns: all vehicle maintenance/repair/fuel/expense history.
What it should NOT contain: static vehicle reference data like VIN or
paint codes that never change (BookStack's Vehicles book owns that instead —
the split is "history that accumulates" vs. "facts that don't change"), and
it should never duplicate a document that's really a Paperless-owned scan
(the vehicle title/registration PDF lives in Paperless; LubeLogger can note
that it exists, but the file itself isn't re-uploaded here too).
Relation to other services: none currently — self-contained, no data
shared with Mealie/Grocy/Immich/Home Assistant. Supports OIDC for future
Authentik integration (not yet configured).
Why it exists: (added Phase 2) a real scanned-document archive so
physical paperwork (leases, insurance policies, medical records, tax returns,
warranties, manuals) becomes searchable and never gets lost to a shoebox or a
random folder on someone's laptop. OCR runs on every consumed document, so
even a phone photo of a printed page becomes full-text searchable.
What it owns: the scanned/digital originals of any household document that
needs to be kept long-term, tagged with a Document Type (16 defined: Medical
Record, Insurance Policy, Receipt, Warranty, Lease, Utility Bill, Vehicle
Registration, Vehicle Title, Bank Statement, Tax Return, Pay Stub, Manual,
Invoice, Employment, Education, Contract), a Tag (14 defined, several mapping
directly to import folders), and a Correspondent (17 defined, several as
explicit placeholders where the real provider/account isn't yet known).
What it should NOT contain: anything that's really a BookStack knowledge
page rather than a physical document (don't scan a "how to reset the home
network" checklist into Paperless — that's a BookStack Procedures page),
recipes (Mealie), or photos that aren't documents (Immich).
Relation to other services: BookStack references Paperless documents by
link rather than duplicating them; otherwise self-contained. Not yet SSO'd to
Authentik (Paperless supports OIDC/SAML — a documented follow-up, same
category as BookStack/LubeLogger).
Why it exists: (added Phase 3) a single links dashboard so the household
doesn't need to remember four different URLs and ports -- one page, icons,
descriptions, one click to whichever service is needed.
What it owns: nothing -- it's a read-only links page (config-file driven,
services.yaml/settings.yaml, no database, no login). It doesn't proxy or
cache live data from any other service in this deployment.
What it should NOT contain: any actual household data -- if a future
version adds live-status widgets, those would need per-service API keys,
which don't exist yet on purpose (avoids minting new credentials just for
dashboard tiles).
Relation to other services: links to all four Household Hub apps plus
Mealie, Grocy, Immich, and Home Assistant. Deliberately Tailscale-only
(bound to the Tailscale interface IP, not 0.0.0.0) -- unlike the other four
services in this stack, which are also reachable on the plain LAN IP.
README.md.EnableAuth=false) — acceptable given/mnt/ceph/docker/household-hub/ onto real cephfs once that mountEnableAuth=false default (see Known Limitations).Paperless's consume folder (/mnt/ceph/docker/household-hub/paperless/consume/
on the LXC) has ten subfolders, scanned automatically and recursively — the
subfolder a document is dropped into becomes its tag automatically, so most
documents need zero manual tagging at import time.
Getting started with each category:
consume/Apartment/. Start with theconsume/Medical/. Tag with Document Typeconsume/Receipts/. Doesn't need to beconsume/Insurance/. One document per policy; set Document Type toconsume/Vehicle/. Cross-reference with LubeLogger once a vehicleReceipts/ alongside the purchase receipt, or a dedicated review later) —Recommended scanning practices:
2026-07-lease-renewal.pdf) — Paperless uses the filename as the initialscan001.pdf.Full technical detail (compose config, healthchecks, backup internals,
restore procedure) lives in /opt/household-hub/README.md on the container
itself — this page is the household-facing summary, that file is the
infrastructure reference.
| Date | Change |
|---|---|
| 2026-07-23 | Phase 1: BookStack, Baïkal, LubeLogger deployed and configured. |
| 2026-07-23 | Phase 2: Paperless-ngx added (SQLite + Valkey broker), document types/tags/correspondents seeded, import framework created, backups extended, this page written. |
| 2026-07-25 | Phase 3: Homepage dashboard added (Tailscale-only); BookStack Templates book (18 templates), LubeLogger Usage Guide, and Document Management book seeded; new Operational Workflows companion page written; this page and README.md updated throughout. |
| 2026-07-25 | Phase 4: fixed two real bugs (BookStack switched to short Tailscale hostname; Paperless admin password had drifted from .env and was reset, both login paths re-verified). Root-caused and fixed LubeLogger's "only lets you create vehicles" report — the Visible Tabs default hid every functional tab — then fully populated and re-emptied a real vehicle's data to prove fuel/maintenance/repairs/expenses/reminders/charts all work with verified-correct math. Homepage expanded with bookmarks/widgets and consistent Tailscale hostnames. Added real cross-links (BookStack ↔ Paperless via 6 new Saved Views ↔ LubeLogger). Added household starter data (a real BookStack page for the actual Camry, one clearly-labeled example Purchase page, a Paperless Inbox auto-tag Workflow, 7 starter Baïkal calendar events). Wrote a new Getting Started / First Week onboarding book. Full end-to-end validation performed across all five services. |