Infrastructure Overview
A production homelab with multi-VLAN network segmentation, a full monitoring stack, containerized services, and backups, all managed as code with Ansible.
Physical Hardware
OPNsense Firewall
Asus Desktop
- Intel Core i5-4570S @ 2.90GHz
- 16GB DDR3 RAM
- 128GB SSD
- 2× Intel I350-T4 (WAN + per-VLAN)
Core of the network. Handles all inter-VLAN routing, firewall rules, Kea DHCP, Unbound DNS, and WireGuard VPN. Fully managed via REST API with Ansible.
Proxmox VE Hypervisor
HP Z440
- Intel Xeon E5-2698v3 @ 2.30GHz
- 128GB DDR4 RAM
- 1TB PNY SSD (VM storage)
- 6TB + 3TB Seagate HDD
- 1× Intel I350-T4
Main server running 10+ VMs: monitoring stack, logging, Docker services, Frigate, OpenMediaVault, a Windows 11 gaming VM with PCI passthrough, a Linux Mint dev VM, and test servers.
Proxmox Backup Server
HP EliteDesk 800 G2
- Intel Xeon E3-1245v3
- 16GB DDR3 RAM
- Integrated NIC
Dedicated backup host running Proxmox Backup Server. Encrypted backups of important VMs run every night.
Primary NAS
Synology DS418
- 4× 3TB Seagate Ironwolf
- 12TB raw storage
- Encrypted volumes
Primary backup target. Uses Synology SHR Raid and encrypted folders. Receives Proxmox backups every night, just like PBS.
Switch
Zyxel GS1900-24E
- 24-port managed Gigabit
- VLAN-aware (802.1Q)
Managed switch handling all traffic. Configured for handling VLAN tagged and untagged traffic.
WiFi Access Point
Zyxel NWA50AX
- WiFi 6 (802.11ax)
- Multi-SSID with VLAN tagging
Access point serving separate SSIDs for trusted devices, guest WiFi, and CCTV, each tagged to their respective isolated VLAN.
Architecture
Infrastructure Inventory
Core Infrastructure
Backup Server
Dedicated Proxmox Backup Server running nightly encrypted backups of important VMs.
Docker Host
RedHat VM running 15+ containerized services behind Nginx Proxy Manager with individual SSL certificates. Accessible only from within the network.
Firewall
BSD-based firewall with REST API management, multi-VLAN routing, Kea DHCP, Unbound DNS, and firewall rules automation.
Hypervisor
KVM/LXC hypervisor hosting most of the infrastructure as virtual machines.
Logging
Centralized log aggregation split across two VMs: a Graylog main node and a dedicated OpenSearch data node storing logs on a separate disk. All hosts forward syslog via rsyslog.
Metrics
Time-series metrics visualization (Grafana) and storage (InfluxDB), with Telegraf agents on all hosts and via SNMP for Synology.
Monitoring
Service and performance monitoring platform with SNMP-based checks. Mail alerts are sent via Postfix.
NAS, Primary
Primary backup target for Proxmox VMs, Docker data, and more.
NAS, Secondary
Secondary backup target running as a Proxmox VM, providing redundant storage for all critical data.
NVR
Network video recorder managing IP security cameras on an isolated CCTV VLAN, running on its own dedicated Debian server. Replaced ZoneMinder, whose Ansible role is kept on standby in case a reinstall is ever needed.
Self-Hosted Applications
Infrastructure & Networking
MariaDB
Shared MariaDB instance backing the self-hosted apps that need MySQL-compatible storage.
Nginx Proxy Manager
Reverse proxy and SSL termination for every self-hosted app on the Docker host.
OpenMediaVault
Open-source NAS software providing secondary backup storage as a Proxmox VM.
OPNsense
Open-source, FreeBSD-based firewall and routing platform, the most heavily automated piece of software in the homelab.
phpIPAM
Tracks IP address allocation and subnet usage across every VLAN, kept in sync with Ansible.
Portainer
Web UI for inspecting and managing the Docker host's containers, images, and volumes.
PostgreSQL
Shared PostgreSQL instance backing the self-hosted apps that need it.
Proxmox Backup Server
Open-source backup software providing deduplicated, incremental, encrypted VM backups.
Proxmox VE
Open-source KVM/LXC virtualization platform hosting most of the homelab as virtual machines.
Synology DSM
Proprietary NAS operating system on dedicated hardware, the homelab's primary backup target.
Monitoring & Observability
ARA
Records every Ansible playbook run across the homelab into a searchable web UI and API.
Centreon
Open-source IT monitoring platform for service and host health checks.
Grafana
Open-source dashboarding tool for the homelab's time-series metrics.
Graylog
Open-source log management platform aggregating syslog output from every host.
Security
2FAuth
Self-hosted two-factor authentication app for storing and generating TOTP codes.
Frigate
Open-source NVR software for the homelab's IP cameras, the active system after replacing ZoneMinder.
Vaultwarden
Self-hosted, Bitwarden-compatible password manager.
Media
Koito
Primary tool for tracking personal music listening history, backed up nightly via its API export.
Maloja
Secondary, backup scrobble tracker for music listening history, kept alongside Koito, the primary tracker.
Navidrome
Self-hosted music streaming server with a Subsonic-compatible API, its database backed up nightly through dedicated automation.
Productivity & Tools
BentoPDF
Self-hosted toolkit for merging, splitting, and converting PDF files without uploading them to a third party.
DokuWiki
Lightweight, file-based wiki set up for infrastructure docs and notes, though rarely used today.
GitLab
Self-hosted Git hosting and CI/CD for personal projects, including this homelab's own Ansible code and the Sonixd Redux client.
Glance
Self-hosted homepage aggregating service links, status, and feeds in one dashboard.
IT-Tools
Collection of everyday developer and IT utilities (encoders, generators, converters) in one self-hosted app.
Joplin
Self-hosted, end-to-end encrypted note-taking app, synced across devices.
Mealie
Self-hosted recipe manager and meal planner.
Nextcloud
Self-hosted file sync and storage, used as a personal cloud drive.
Key Practices
Everything as Code
All infrastructure configuration managed via Ansible with idempotent, version-controlled roles. Changes are previewed with --check before applying.
Dual Backup Strategy
Critical services backed up to both a Synology NAS and a Proxmox-hosted OpenMediaVault VM. Every backup runs through an Ansible role, most run by hand, with a handful on a nightly cron schedule.
Network Isolation
VLANs are isolated from each other, except for specifically allowed traffic. Firewall rules enforced via OPNsense with automated, idempotent rule deployment.
Full Observability
Grafana dashboards for metrics, Graylog for centralized logs, Centreon for service checks. Every host is monitored.