MSc student in Applied Computer Science with a hands-on background in designing and operating production-grade infrastructure — hypervisors, VLAN-segmented networking, zero-trust access, and full observability stack, all self-built and self-operated.
† excluding Plex and TeamSpeak 6 which are port-forwarded by design
I'm Petr, a final-year MSc student in Applied Computer Science at Palacký University in Olomouc. My academic background is in software development, but the work I find most compelling sits at the boundary between software and infrastructure — the layer where reliability, security, and operational discipline actually get enforced.
This homelab is how I close the gap between theory and practice. Every design decision here mirrors what you'd find in a production environment: VLAN segmentation with default-deny firewall policy, HA-aware service placement across a two-node Proxmox cluster, zero-trust external access via Cloudflare tunnels with no open WAN ports, and a full observability stack — Prometheus, Grafana, and Wazuh — that gives me real signal when something breaks. The goal is to build the muscle memory that textbooks don't provide.
I'm particularly drawn to roles that sit at the intersection of infrastructure reliability and data stewardship — network administration, hypervisor and Linux systems management, or data infrastructure roles focused on access control, dataset structuring, and keeping data secure at rest and in transit. If your team cares about doing these things properly, I'd like to talk.
A two-node Proxmox VE cluster with shared TrueNAS storage, a dedicated backup server, and a Raspberry Pi quorum device to prevent split-brain during single-node failures.
Each workload class lives in its own VLAN with tailored firewall rules. This limits blast radius if any service is compromised and enforces least-privilege networking by default.
local.screedy.com. Forwarder zone for screedy.com — local overrides resolve to Traefik VIP (10.20.0.10), unknown records forwarded to Cloudflare. Secondary Technitium syncs via zone transfer.25+ self-hosted services across six VLANs, all accessible via Traefik with wildcard TLS certs issued through a Cloudflare DNS challenge — no open WAN ports required for web access.
local.screedy.com, forwarder for screedy.com. Secondary node provides HA for DNS resolution.Defence in depth — from VLAN segmentation at the network layer up through zero-trust tunnels, automated TLS, SIEM alerting, and per-service access controls.
*.local.screedy.com is never published to public DNS — unreachable externally by design*.local.screedy.com and *.screedy.com via Cloudflare DNS challengeserversTransport with appropriate cert verification settingsMetrics, logs, and security events aggregated into a coherent observability pipeline — so problems surface before they become outages.
/metrics on :8080), Unpoller (UniFi network metrics), and itself. Basic auth enforced by Traefik middleware.The decisions that shaped this setup — and the trade-offs considered.
10.20.0.10 (future keepalived VIP) even before the second Traefik node exists. When lenovo2 gets its Traefik instance and keepalived is configured, no DNS records need to change — the cutover is operationally invisible.service.screedy.com to the Traefik VIP via Technitium's forwarder zone. External clients get Cloudflare's public record. Same domain, different resolution path — no internal traffic hairpins through Cloudflare, and no UX difference for users.Every technology actively used, managed, or operated in this environment.
Active migrations and planned improvements to move the lab closer to a fully HA, zero-trust production posture.
10.20.0.10) — eliminates the reverse proxy as a single point of failure