architecture

How the homelab is built — decisions, not a recon dump.

I run a small enterprise-style lab to practice the same problems I want to work on: segmentation, storage under sustained write, hypervisor isolation, and identity-aware remote access. Operator details (addressing, credentials, full diagrams, camera topology) stay on a private wiki behind SSO. This page is what I'm comfortable putting in front of a hiring manager.

cluster

…

nodes

—

cpu

—

ram

—

raid

—

Sanitized snapshot from the lab — no hostnames, no graphs, no management UI.

01 / intent

Design goals

  • Untrusted devices never share a broadcast domain with the workstation or hypervisor management plane.
  • No inbound ports on the firewall. Remote access is outbound-only.
  • Storage for continuous recording must survive a disk failure without a long, risky rebuild.
  • Every service is a separate VM unless there is a hard reason not to.

02 / access

Zero Trust edge

Internal apps reach the internet through a Cloudflare Tunnel. Cloudflare Access sits in front of anything that is not meant to be anonymous. Identity is email-gated and easy to revoke. The public site is the only unauthenticated origin.

internal service → tunnel (egress) → Cloudflare edge → Access policy → operator

03 / network

Zones, not a flat LAN

Two managed switches and a pfSense box. The second switch only sees traffic that has already been firewalled. Core switching and the firewall sit on UPS so the control plane survives a power blip.

Zone Purpose What lives there
trusted Day-to-day work and hypervisor Workstations, APs, Proxmox host
dmz Semi-trusted automation Home Assistant on bare metal
iot Isolated sensors / cameras NVR and PoE endpoints only
wan ISP handoff Fiber ONT into the firewall

ISP → core switch → firewall → core switch → internal zones

04 / storage

RAID10 for the NVR

Continuous video is a sequential-write problem. RAID10 keeps write performance predictable and rebuilds shorter than RAID5/6. The cost is 50% of raw capacity — accepted on purpose.

  • External SAS enclosure, hardware RAID controller
  • ext4 volume presented into the hypervisor, then to the NVR VM
  • Health via the vendor CLI (predictive failure, temps, BBU) plus Netdata

One unused spare currently has a predictive-failure flag. It is not in the array.

05 / compute

One hypervisor, split duties

Recycled Dell rack server running Proxmox. Workloads are separate VMs so a compromise or a bad upgrade does not take the whole lab with it.

WorkloadWhy it is isolated
public webOnly anonymous origin
SIEMLog ingest should outlive other VMs
NVRTied to the RAID volume
containersApp experiments, not on the hypervisor
home automationBare metal, in the DMZ

06 / observe

Monitoring

Netdata on the host for CPU, memory, disk, and guests. Hardware RAID metrics (controller health, SMART, drive temperature) are scraped from the controller CLI so a dying disk shows up before the array does.

Live tank and pump telemetry is on the Lab Dashboard — a small public slice of the same idea.

07 / what is not here

Deliberate omissions

  • No RFC1918 addresses, VLAN IDs, or switch configs
  • No public hostnames for cameras, Portainer, or monitoring
  • No firmware versions or full rack diagrams
  • Operator runbooks stay behind Cloudflare Access

If you are hiring, I can walk through the private wiki on a screen share. I will not post it. You can also take a shift on the Incident Board.