diff --git a/docs/home-lab/setup-guide.md b/docs/home-lab/setup-guide.md
new file mode 100644
index 0000000..c7114ae
--- /dev/null
+++ b/docs/home-lab/setup-guide.md
@@ -0,0 +1,112 @@
+---
+tags:
+  - home lab
+  - cloudflare
+  - self-hosting
+---
+
+# How I set up my home lab with Cloudflare
+
+_2025-03-02_
+
+## **Overview**
+
+This guide walks through setting up my home lab using the domain `creeknet.uk`, managing **DNS, security, remote access, reverse proxy, and VPN** to ensure secure and private access to my services. This exists both as a record for myself and a guide for others looking to set up a similar home lab.
+
+---
+
+## **1. Cloudflare Setup**
+
+### **1.1 Register Domain & Set Up DNS**
+
+1. Log into [Cloudflare](https://dash.cloudflare.com) and **add `creeknet.uk`**. The `.uk` domains are amongst the cheapest, at around $5 per year.
+2. Go to DNS > Add A Records for all publicly accessible services:
+   These records allow external access to specific services.  
+    ⚠️ **Cloudflare Proxy (Orange Cloud ☁️) should be OFF (DNS Only) for services that require non-HTTP ports (e.g., Plex, VPN).**
+
+   | **Subdomain**          | **Record Type** | **Points To**    | **Proxy Status**       | **Purpose**               |
+   | ---------------------- | --------------- | ---------------- | ---------------------- | ------------------------- |
+   | `ai.creeknet.uk`       | A               | **My Public IP** | **DNS Only ☁️ (Gray)** | AI Server                 |
+   | `home.creeknet.uk`     | A               | **My Public IP** | **DNS Only ☁️ (Gray)** | Home Assistant            |
+   | `nas.creeknet.uk`      | A               | **My Public IP** | **DNS Only ☁️ (Gray)** | NAS Access                |
+   | `plex.creeknet.uk`     | A               | **My Public IP** | **DNS Only ☁️ (Gray)** | Remote Plex Access        |
+   | `rustdesk.creeknet.uk` | A               | **My Public IP** | **DNS Only ☁️ (Gray)** | Remote Desktop (RustDesk) |
+   | `vpn.creeknet.uk`      | A               | **My Public IP** | **DNS Only ☁️ (Gray)** | WireGuard VPN             |
+
+### **1.2 Enable Cloudflare Zero Trust for Web Services**
+
+I did consider that for any web-facing applications that do not have their own authentication I could use Cloudflare Zero Trust to enforce authentication. To do so I would:
+
+1. Go to **Zero Trust → Access → Applications**.
+2. Add an application.
+3. Configure **Access Policy** (Require login via OTP).
+
+---
+
+## **2. Setting Up Local DNS (Split DNS)**
+
+To **ensure local services work even if the internet is down**, configure **Pi-hole (`10.0.0.6`)**:
+
+- Add **Local DNS Records**:
+
+  - Web-services should direct to Nginx:
+    - ai.creeknet.uk → `10.0.0.20`
+    - home.creeknet.uk → `10.0.0.13`
+    - nas.creeknet.uk → `10.0.0.9`
+    - plex.creeknet.uk → `10.0.0.11`
+  - Non-web services should direct to the actual servers:
+    - rustdesk.creeknet.uk → `10.0.0.23` (dockerised on the same server as nginx)
+    - vpn.creeknet.uk → `10.0.0.5` (redundant if the internet is down but included for completeness)
+
+- **Router DNS Settings**:
+  - Primary DNS: `10.0.0.6` (Pi-hole)
+  - Secondary DNS: `1.1.1.1` (Cloudflare)
+
+---
+
+## **3. Reverse Proxy with NGINX Proxy Manager**
+
+### **3.1 Deploy NGINX Proxy Manager (Docker) on ProxRouter**
+
+```yaml
+version: "3"
+services:
+  npm:
+    image: "jc21/nginx-proxy-manager:latest"
+    container_name: npm
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+      - "81:81" # Admin UI
+    volumes:
+      - ./data:/data
+      - ./letsencrypt:/etc/letsencrypt
+```
+
+### **3.2 Configure Proxy Hosts**
+
+- ai.creeknet.uk → `http://10.0.0.20:8080` (Open Web UI)
+  - Provide SSL certificate through Let’s Encrypt
+  - Enable Websockets Support
+  - Force SSL
+- home.creeknet.uk → `http://10.0.0.13:8123` (Home Assistant)
+
+  - Provide SSL certificate through Let’s Encrypt
+  - Enable Websockets Support
+  - Force SSL
+  - Advanced custom nginx config:
+
+    ```text
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header Connection "upgrade";
+    proxy_redirect off;
+    ```
+
+- nas.creeknet.uk → `https://10.0.0.9:1001` (Asustor NAS)
+  - Provide SSL certificate through Let’s Encrypt
+- plex.creeknet.uk → `http://10.0.0.11:32400` (Plex Media Server)
+  - Provide SSL certificate through Let’s Encrypt