Lab Architecture

The homelab is operated with the same standards and expectations as a production environment.

01 /

Homelab Engineering

The journey began with a single Raspberry Pi and expanded into a production‑style virtual private cloud.

  • Raspberry Pi Foundations

    Raspberry Pi boards running Ubuntu were the first platform for edge computing and experimentation. Early prototypes of containerized services and the first local network segments were built here.

    • Raspberry Pi
    • Ubuntu

  • Kubernetes Clusters

    k3s clusters provide lightweight Kubernetes orchestration, with MicroK8s also running at the app layer. Bare‑metal nodes and Raspberry Pis are integrated into the compute fabric.

    • k3s
    • MicroK8s

  • MicroCloud & LXD

    MicroCloud clusters deployed across physical nodes form a secure, scalable micro‑cloud at the OS layer. LXD containers run inside Proxmox VMs for lightweight virtualization.

    • MicroCloud
    • LXD

  • Surveillance & IoT

    A local CCTV network streams over RTSP with secure local access. Self‑hosted platforms such as Shinobi and Frigate handle multiple feeds, recorded to an affordable NAS build.

    • RTSP
    • Shinobi
    • Frigate

02 /

Proxmox Cloud Platform

A 3‑node Proxmox VE cluster forms the core of the production‑grade home cloud.

  • 3‑Node Proxmox Cluster

    Three Proxmox VE nodes run VMs, LXC containers, and Docker workloads, with resource allocation and high‑availability workloads managed across the cluster. Centralized ZFS, NFS, and OMV storage pools back the cluster.

    • Proxmox VE
    • KVM
    • LXC

  • Template‑Based Provisioning

    VMs are provisioned from templates for reproducible deployments. Each VM follows a managed lifecycle: create, configure, optimize, and retire.

    • Templates
    • KVM

  • Cluster Maintenance

    Node updates, kernel patches, and security maintenance keep the cluster current. Cluster health, CPU and RAM usage, and disk I/O are monitored continuously.

    • Patching
    • Monitoring

  • LXC Services

    Lightweight services run in maintained LXC containers to keep self‑hosted applications up. System logs are reviewed and anomalies are addressed.

    • LXC
    • Docker

03 /

Backup & Storage Architecture

A hybrid NAS architecture and Proxmox Backup Server form a reliable multi‑tier backup strategy.

  • Proxmox Backup Server

    PBS provides deduplicated, encrypted, incremental backups for VMs, LXCs, and hosts. A prune and GC strategy maintains long‑term backup hygiene, verified by regular restore tests.

    • PBS
    • Deduplication
    • Encryption

  • TrueNAS SCALE

    A TrueNAS SCALE NAS provides high‑availability primary storage. Its NFS shares integrate with Proxmox for VM and container storage, backups, and templates.

    • TrueNAS
    • NFS
    • ZFS

  • OpenMediaVault Secondary NAS

    OpenMediaVault turns DAS hardware into cost‑effective secondary storage, running on a Raspberry Pi with DAS or an HDD docking station. It supports VM backups, ISO storage, and general cloud storage.

    • OMV
    • Raspberry Pi

  • Integrity & Archival

    SMART monitoring and RAID/ZFS integrity checks protect stored data. A backyard backup solution provides long‑term archival.

    • SMART
    • RAID/ZFS

04 /

Network Engineering & Security

An enterprise‑style network with segmentation and monitoring, plus hardened access to every service.

  • UniFi Network Ecosystem

    A UniFi Cloud Gateway, Switch, and Access Point form the home network, with VLAN segmentation isolating services. Firewall rules, traffic monitoring, security policies, and performance tuning are administered across it.

    • UniFi
    • VLAN
    • Firewall

  • Reverse Proxy & TLS

    Nginx Proxy Manager handles DNS‑01 for internal services and HTTP‑01 for the public‑facing blog. Caddy adds automatic HTTPS and local wildcard TLS for localhost services.

    • Nginx Proxy Manager
    • Caddy
    • TLS

  • Host Hardening

    SSH is hardened with key‑based authentication, disabled root login, a custom port, and modern crypto. Fail2ban and UFW are deployed with advanced configuration.

    • SSH
    • Fail2ban
    • UFW

  • Secrets & Threat Modeling

    A modular secrets registry tracks rotation of SSH keys, API tokens, and TLS certificates, with credentials stored in self‑hosted Vaultwarden. STRIDE threat modeling is applied to Vaultwarden, Proxmox, and WordPress.

    • Vaultwarden
    • STRIDE

05 /

Automation & Development

Declarative infrastructure, maintenance scripting, and AI‑assisted engineering workflows.

  • Ansible Playbooks

    Six to seven modular Ansible playbooks handle container deployment, service configuration, and system hardening. Each workflow is validated for idempotence and reproducibility across nodes.

    • Ansible
    • SSH
    • Inventory

  • Scripting & CI/CD

    Python and Bash scripts handle maintenance, updates, and backups. CI/CD experimentation supports automation and agentic workflows.

    • Python
    • Bash
    • CI/CD

  • Local LLM Stack

    Open‑source LLMs run through Ollama, oMLX, LocalAI, LM Studio, and llama.cpp, integrated with Docker MCP tools and runners. An Ubuntu‑based AI server repurposes an older Nvidia GPU for GPU‑accelerated inference.

    • Ollama
    • llama.cpp
    • Docker MCP

  • Agentic Architecture

    A deterministic, token‑driven workflow moves from VDA to IDD, CDD, and SDD for building structured SME applications. DESIGN.md acts as the contract, and outputs reference tokens only.

    • VDA
    • IDD
    • CDD
    • SDD

  • Knowledge Reasoning Engine

    A prototype knowledge reasoning AI engine has been built as a full pipeline on the local LLM stack. It remains active work, alongside computer vision exploration.

    • LLM
    • Computer Vision

  • SME Training Program Engine

    A local, on‑prem SME application in ongoing development, with pre‑engineered training and evaluation pipelines. It covers synthetic dataset generation, schema and meta‑prompt building, fine‑tuning orchestration, and export.

    • train.py
    • eval.py
    • Fine‑tuning

06 /

Self‑Hosted Ecosystem

Open‑source services deployed and maintained through a repeatable workflow.

  • Containerized Apps

    Open‑source apps run in Docker inside Proxmox containers, managed with Portainer. Deployments include immich, Nextcloud, Paperless‑ngx, memos, Label Studio, Termix, Vaultwarden, and Beszel.

    • Docker
    • Portainer

  • Monitoring & Observability

    Prometheus, Grafana, and uptime tools monitor system health, uptime, and resource usage. UniFi network analytics add traffic visibility.

    • Prometheus
    • Grafana

  • Self‑Hosted WordPress

    A self‑hosted WordPress blog runs with its own domain configuration. HTTPS is managed through DNS‑01 and HTTP‑01 SSL certificate workflows.

    • WordPress
    • HTTPS

  • Developer & Productivity Tools

    Git services and CI/CD runners support development work. Media servers, productivity apps, and cloud‑native utilities complete the self‑hosted stack.

    • Git
    • CI/CD

  • Deployment Workflow

    1. Discover new open‑source software
    2. Evaluate architecture and requirements
    3. Deploy via Docker, LXC, or VM
    4. Configure networking, SSL, and access control
    5. Monitor logs and performance
    6. Maintain, update, and secure the service

07 /

OpsSecDev Mindset

Treating the home cloud like a real production system.

  • Security by Default

    Security is integrated into every deployment, with least‑privilege access and segmentation.

  • Continuous Monitoring

    Continuous monitoring instead of reactive fixes, with regular audits of logs, configs, and exposed services.

  • Deterministic Workflows

    Deterministic workflows and a modular monolith architecture keep systems predictable.

  • Token‑Based Design

    A token‑based design philosophy, with DESIGN.md as the contract.