Homelab / Architecture

Architecture

Logical layers of the homelab — Proxmox and Rocky Linux as the base, then identity, delivery, ops, and observability.

The homelab is a personal showcase of a small, IaC-driven platform. Tooling mirrors enterprise IT — preferably open-source / community editions — with Proxmox as the compute foundation and Rocky Linux for enterprise compatibility. This overview shows how access, services, and operations fit together.

Overview

Dual 5G behind carrier NAT: outbound tunnels instead of port-forwards; HTTPS/OIDC and overlay VPN as parallel remote paths. Access / Dual Remote Dual 5G · CGNAT · Pangolin · Overlay VPN Central OIDC IdP and secrets/PKI — the same identity base for apps and remote access. Identity & Secrets Keycloak · HashiCorp Vault Forgejo as lab SoT; Actions on Linux, macOS, and Windows; docs and app services on the compute layer. Platform & Apps Forgejo · Actions · Wiki Proxmox cluster as the compute foundation; managed guests on Rocky Linux, IaC from Forgejo. Compute Proxmox · Rocky Linux Host lifecycle, patch orchestration, and service desk — automated as far as practical. Ops & Automation Lifecycle · Patching · Tickets Metrics, logs, and alerts belong to the platform from day one — not as an afterthought. Observability Metrics · Logs · Alerts

Hover or focus a layer for details.

Dual 5G behind carrier NAT: outbound tunnels instead of port-forwards; HTTPS/OIDC and overlay VPN as parallel remote paths.

Central OIDC IdP and secrets/PKI — the same identity base for apps and remote access.

Forgejo as lab SoT; Actions on Linux, macOS, and Windows; docs and app services on the compute layer.

Proxmox cluster as the compute foundation; managed guests on Rocky Linux, IaC from Forgejo.

Host lifecycle, patch orchestration, and service desk — automated as far as practical.

Metrics, logs, and alerts belong to the platform from day one — not as an afterthought.

Layers

Access and dual remote

Two equal remote paths, intentionally separate from the LAN:

  • Pangolin — identity-aware HTTPS edge; published apps reach the lab through a tunnel (Newt) and authenticate via OIDC against Keycloak.
  • Overlay VPN — mesh / OLM access for admin and ops, without port-forwarding as the default strategy.
  • LAN — Zoraxy terminates TLS and proxies services locally.

No classic port-forwarding as the primary path: remote access stays controlled via tunnels and identity. Why — dual 5G behind carrier-grade NAT — is covered under Connectivity.

Identity and secrets

Keycloak provides SSO via OIDC (including for Pangolin). HashiCorp Vault manages secrets and internal PKI. Apps and remote access share the same identity foundation.

Platform and apps

Forgejo is the source of truth for lab code — IaC for guests and services, Ansible, wiki, academy, and the portfolio site. Documentation, collaboration, and application workloads run as dedicated services on the compute layer. The public site is only one delivery chain from that SoT: Forgejo → private GitHub mirror → Cloudflare Pages (Hugo) — details: Website.

CI

Forgejo Actions run on a dedicated runner fleet: Linux amd64 (guests on the Proxmox cluster), macOS Apple Silicon, Windows 64-bit (guest VM), and Windows ARM64 (notebook). Hardware details for the Mac and ThinkBook: Hardware.

Compute

Proxmox is the compute foundation: the cluster hosts nearly all guests and workloads. Managed Linux guests run Rocky Linux. Infrastructure as Code provisions guests and baseline services from Forgejo repos; fleet management keeps operations consistent.

Ops and automation

Day-two operations are part of the platform: host lifecycle and patch orchestration, a service desk for incidents/changes, and backup — automated as far as practical, close to enterprise ops patterns. How storage and backup are layered (Ceph vs file tiers, offsite, why not RAID everywhere): Storage & Backup.

Observability

Metrics, logs, and alerts are part of the platform from day one, so operations stay visible instead of bolting monitoring on later. Local multi-pass LLMs summarize alerts and upgrade paths — Qwen3 8B → Qwen3.6 35B-A3B → GPT-OSS 20B, human approval; no blind apply. Examples: Ops AI Showcases.

Operating principles

  1. Infrastructure as Code — guests and services are created reproducibly from Forgejo (OpenTofu, Ansible, Terrakube); managed guests on Rocky Linux.
  2. Enterprise-aligned ops — open-source / community editions of enterprise tools; lifecycle, patching, tickets, and changes automated where practical.
  3. Identity first — OIDC is the default path; central identity instead of credential sprawl.
  4. Dual remote — Pangolin (HTTPS/OIDC) and overlay VPN (OLM/mesh) run in parallel; LAN stays its own path.
  5. Observability default — metrics, logs, and alerts belong to the platform.
  6. Secure by design — secrets in HashiCorp Vault, TLS at the edge, and a clear split between portfolio presentation and operational access.
  7. Controlled AI — local multi-pass pipeline (Qwen3 / Qwen3.6 / GPT-OSS) and ops assistance; no autopilot, no cloud LLM.