infrastructure · homelab
Real systems. Clearly documented.
From the Proxmox cluster and redundant network paths to remote access: the platform as actually operated, in six areas.
$ infra --summary
3 Proxmox hosts · 6 Xeon Gold 6152 · 768 GB DDR4
2 core switches · 25/100 GbE · 48×1 GbE access
2×32 TB Synology · 64 TB NAS total
schematic · arista 25/100 gbe with peer link · every host attached to core a and core b
$ status
all areas documented
overview
Six areas of the platform
virtualization · compute
Proxmox VE: three hosts, one compute layer
Three Proxmox VE nodes provide virtual machines and LXC containers: 6 Xeon Gold 6152 CPUs and 768 GB DDR4 RAM in total.
| Host | CPU | RAM |
|---|---|---|
| PVE 01 | 2× Intel Xeon Gold 6152 | 256 GB DDR4 |
| PVE 02 | 2× Intel Xeon Gold 6152 | 256 GB DDR4 |
| PVE 03 | 2× Intel Xeon Gold 6152 | 256 GB DDR4 |
- Workloads: VMs and LXC containers are distributed across the hosts by role and dependencies; the assignment stays documented and verifiable.
- Maintenance: Identical hardware simplifies capacity planning and troubleshooting. Work can be prepared host by host and workloads moved in a controlled way.
- Recovery: Local backup targets, S3 copies and monitored backup states form a clear path from backup to restore.
Three compute nodes and redundant network paths do not automatically make every application highly available. What matters is the configuration of each VM, its data dependencies and a tested restart.
network · perimeter
Two network paths, one controlled edge
Two Arista switches form the 25/100 GbE core for compute and storage. OPNsense handles routing, firewall rules and separation of the internal networks.
- Core
- 2× Arista (Core A, Core B) with peer link
- Backbone
- 25/100 GbE
- Access
- Arista 48×1 GbE, PoE for access points
- Perimeter
- OPNsense: firewall, VLANs, policies
| System | Spec | Uplink |
|---|---|---|
| PVE 01-03 | 2× Xeon 6152 · 256 GB DDR4 | Core A + Core B |
| Storage 01-02 | Synology NAS · 32 TB | Core A + Core B |
| Access Layer | Arista 48×1 GbE · PoE | Core A + Core B |
- Redundancy: Every compute host and every NAS is connected to both Core A and Core B. If a core or an uplink fails, the second path remains.
- Access: The 48-port switch connects wired endpoints and powers access points over PoE.
- Segmentation: OPNsense connects internal zones selectively instead of making them all reachable from each other.
remote access · thin client
Boot, connect, work
A Debian 13 thin client boots a minimal Openbox session and connects to a Windows VM on Proxmox via Tailscale, MagicDNS and FreeRDP. No publicly reachable RDP port is required.
Debian + Openbox
Automatic login of the minimal session and initialisation of display, audio, microphone and USB.
Tailscale + MagicDNS
The client waits for network and name resolution; the target name is resolved inside the private network.
FreeRDP + Windows VM
Full screen, dynamic resolution and automatic reconnect after dropped sessions instead of an open desktop.
- Redirection: Audio, microphone, clipboard and selected USB devices are available inside the remote session.
- Login: The password is not stored in plain text in the configuration; it is encrypted locally and bound to the host and its TPM.
- Restart: After a drop, FreeRDP reconnects automatically as soon as the private network and name resolution are available again.
storage · backup
Back up locally, add an external copy
Two Synology systems provide 64 TB in total (2×32 TB). Local Proxmox backups are complemented by an offsite copy in Amazon S3; every backup run is monitored centrally.
1 Proxmox VE
Source: virtual machines and containers
2 2× Synology
Local targets: 32 TB NAS capacity each
3 Amazon S3
Offsite copy outside the homelab
- Short restore path: The local NAS targets avoid the detour via the cloud for everyday restores and stay separate from the compute hardware.
- Site failure: The S3 copy remains available even when the local backup targets are unreachable.
- Detect early: Checkmk checks runtime, age and result of the backup jobs as well as the free capacity of the local targets.
Depending on the failure, the local or the external target is used first: select a restore point, restore to an available Proxmox host, then verify that the workload works.
cloud edge · infrastructure as code
Built from the inside, limited on the outside
An outbound Newt tunnel connects selected internal applications to a Pangolin edge in AWS Frankfurt. No direct inbound exposure of the home network is needed for this path.
- Tunnel direction
- Outbound: the Newt connector in the homelab initiates the connection
- Endpoint
- Pangolin edge with TLS
- AWS region
- Frankfurt
- Provisioning
- Infrastructure as code
- Access: Only explicitly selected applications get a public path. The tunnel does not replace internal segmentation or application authentication.
- Separation: Pangolin access and the offsite backup to Amazon S3 remain separate data paths with different jobs.
- Infrastructure as code: The edge, network rules and related AWS resources are described in version control and reviewed before changes.
monitoring · alerting
Detect state, react deliberately
Checkmk monitors Proxmox hosts, virtual services, network components, OPNsense, NAS systems and backup states. ntfy delivers relevant warnings to the mobile device automatically.
1 Sources
Hosts · services · backups: states and metrics
2 Checkmk
Rules · thresholds · priorities
3 ntfy
Relevant events to the mobile device
- Systems: Proxmox hosts, virtual services, NAS, network components and OPNsense form one structured view.
- Signals: Thresholds and service states reduce raw data to prioritised events with a clear need for action.
- Response: Outages, missing backups and capacity problems become visible quickly. Checkmk evaluates and escalates, ntfy only handles delivery.
Goal: less noise, more context. A technical state should become an understandable message that maps to a system, an impact and a next step.
Product names and logos are trademarks of their respective owners. They only identify the products and services actually in use.