Built a self-hosted homelab on an old laptop — sanity checking my setup (security, Docker, media stack)

Hi guys,

Turned an old i3 laptop (8GB RAM, Ubuntu 24.04) into a full homelab. Looking for a sanity check and expert advice on gaps.

What's running:

• Jellyfin (native, VAAPI HW transcoding)
• Transmission (torrent daemon)
• Samba (LAN file sharing, SMBv2+, mandatory signing)
• Pi-hole (DNS-level ad/tracker blocking)
• Vaultwarden (self-hosted password manager, Bitwarden-compatible)
• Portainer CE (container management)
• Glances (monitoring)
• Jellyseerr (media requests)
• AI agent stack (local LLM + API fallback)
• Restic (manual backups to external drive)

Remote access: VPN-only (zero open ports on router — everything tunneled)

Security steps taken so far:

• UFW default deny, scoped rules per interface
• fail2ban with aggressive SSH + Jellyfin jails + recidive
• Lynis hardening (currently ~82/100)
• AppArmor profiles for critical services
• Kernel hardening via sysctl
• Docker memory limits on all containers
• Services proxied — no raw ports exposed externally
• Vaultwarden: signups disabled after first account, hardened compose (cap_drop ALL, no-new-privileges)
• SSH locked to VPN interface only

What I'm unsure about:

1. Docker + UFW iptables bypass — currently "iptables": false is reverted because it broke Docker internal DNS. What's the recommended fix?
2. Is Lynis 82/100 "good enough" or are there high-impact items people usually chase past that point?
3. Restic backups are manual — is that a major gap, or acceptable for a homelab?
4. Anything obviously missing from this stack?

Hardware is CPU-only so heavy local AI inference is slow — considering a new PC for this eventually.

Happy to share config snippets. What would you do differently?