Homelab Infrastructure

A peek under the hood at the hardware and software stack powering the network.

Everything runs on a three-node Proxmox cluster built from low-power mini PCs — the work of a small rack, on a shelf.

Router / firewall: An OpenWrt-based gateway handling DHCP and MAC-based firewall rules.
Proxmox cluster: Three mini PCs — one AWOW AK10 and two Lenovo ThinkCentre Tinys — managed as a single cluster. Bulk storage is a ZFS pool on the AWOW node.
Local AI: My daily-driver Framework workstation (AMD Strix Halo, 128 GB unified memory) also serves local language models via Ollama — that's what powers the recipe formatter and the family AI chat. A homemade load-aware router decides per-request whether to run on the local GPU or hand off to cloud models, so AI features keep working even while the workstation is busy gaming or training.

A consistent addressing scheme and MAC-based DHCP reservations, so every device has a known, stable address.

DNS & ad-blocking: AdGuard Home does network-wide DNS with ad and tracker filtering, and resolves internal hostnames straight to the reverse proxy — so requests for a local service never leave the network.
Reverse proxy & TLS: Two Caddy instances — one for internal services, one facing the internet — route requests by hostname and auto-provision Let's Encrypt certificates (HTTP-01 and DNS-01 challenges).
Dynamic DNS: Small containers keep the Cloudflare DNS records pointed at our dynamic home IP.
Firewall: MAC-based egress rules on the router — the living-room TV, for instance, can reach the LAN but not the open internet.
Remote access: Private services are reachable only over a Tailscale mesh VPN, never exposed to the public internet.

Workloads are split across LXC containers and VMs on Proxmox, spread over the three nodes.

Distributed Docker: Each node runs a Debian LXC hosting Docker, so containers are spread across all three machines rather than piled onto one.
Home automation (VM): A VM running Home Assistant with a USB Zigbee radio passed through, so the smart-home gear talks Zigbee directly instead of leaning on Wi-Fi or the cloud.
Docker & Compose: Around 40 containers managed with Docker Compose and Portainer. Services address each other by container name, so nothing breaks when an IP changes.

The parts that turn a pile of containers into something I can actually trust and leave running.

Monitoring: Uptime Kuma for service health, Scrutiny for disk SMART trends, and a custom single-pane dashboard pulling it all together. Alerts go out over push notifications and also flow into an RSS feed.
Backups & recovery: Nightly encrypted, off-site backups — whole-container images plus databases — so a failed node can be rebuilt from scratch, guided by a written disaster-recovery runbook.
Documentation: The whole estate is documented as a living knowledge base — every service, address, credential location, and gotcha — so future me (or anyone) can pick it up cold.

Fed Forager: An AI-assisted meal planner and grocery-list builder — Python backend and frontend, a PostgreSQL database, and its own Caddy edge.
Family Recipes: A single-file Python web app: an open recipe box anyone in the family can post to, no accounts needed. On the private network it adds a one-click AI step that reads a photo of a handwritten recipe card and turns it into a tidy, formatted recipe.
LLM Router: A single-file, OpenAI-compatible gateway on the workstation that checks GPU load and free memory per request, serving from local models when the machine is idle and transparently rerouting to cloud models when it isn't — the lab never interrupts a game, and a game never takes the lab's AI down.

Syncthing for continuous file sync across devices, and Samba for SMB shares off the storage pool.
Plus the family-facing services on the diagram above — a private search engine, self-hosted photos, a Minecraft server, RSS readers, and more.