The lab

Home infrastructure

Four years in: a two-node Proxmox cluster, an HA reverse proxy, six VLANs and 25+ self-hosted services, some of them used daily by people outside this household. Web services are reachable without a single open port; the game and voice servers that do need one are isolated in their own VLAN. Everything below is designed, built and operated by hand.

01 / Infrastructure

Compute & storage

A two-node Proxmox VE cluster with shared TrueNAS storage, a dedicated backup server, and a Raspberry Pi quorum device to prevent split-brain during single-node failures.

lenovo1 · primary

Proxmox VE

infra VLAN · node 1

Primary cluster node. Hosts most production LXCs. All DNS points to the keepalived VIP shared by both Traefik nodes.

Proxmox 9VLAN 169cluster primary

lenovo2 · secondary

Proxmox VE

infra VLAN · node 2

Secondary node and HA target. Hosts the second Traefik node and its keepalived peer, so the reverse proxy is no longer a single point of failure.

Proxmox 9VLAN 169HA failoverTraefik node 2

truenas · primary datastore

TrueNAS SCALE

infra VLAN · datastore

Shared storage over NFS and SMB. Issues its own ACME certs natively. Single source of truth for persistent data.

NFSSMBACME certsVLAN 169

pbs · backup

Proxmox Backup Server

infra VLAN · backup

Scheduled incremental backups for all LXCs and VMs with deduplication. Critical config paths verified per service. Stored on separate hardware from compute.

incrementaldedupscheduledVLAN 169

rpi5b · quorum

Raspberry Pi 5B

infra VLAN · quorum

Cluster quorum device — prevents split-brain when one Proxmox node becomes unreachable. With only two nodes, a tiebreaker is mandatory for HA to function correctly.

quorumsplit-brain prevention

ubiquiti · routing & switching

UniFi Network

all VLANs

All switching and routing on UniFi hardware. Zone-based firewall with default-deny between VLANs and explicit allow rules only. No implicit inter-VLAN trust.

zone firewalldefault-deny6 VLANs

02 / Network Architecture

VLAN segmentation

Each workload class lives in its own VLAN with tailored firewall rules. This limits blast radius if any service is compromised and enforces least-privilege networking by default.

VLAN map — six segments

proxy

10.20.0.0/16

Ingress layer — sole entry point for all proxied traffic

TraefikCloudflaredkeepalived VIP

media

10.30.0.0/16

Media stack — isolated, no outbound to any other VLAN

PlexSonarrRadarrProwlarrSeerrqBittorrent

game

10.40.0.0/16

Game servers — isolated, port-forwarded directly bypassing Traefik

TeamSpeak 6AMP

services

10.50.0.0/16

Primary application VLAN — internal and split-horizon services

ImmichAuthentikOpenWebUIDocmostFoundryVTTNetboxN8NCrowdSec+more

exposed

10.55.0.0/16

Internet-facing services with stricter isolation from VLAN 50

NextcloudForgejoForgejo runnerPortfolio

169

infra

10.169.0.0/16

Infrastructure — hypervisors, storage, DNS, monitoring

ProxmoxTrueNASPBSTechnitiumPrometheusGrafanaLokiWazuh

Firewall policy

Inter-VLAN rules

ALLOWDNS request from any VLAN → Technitium on VLAN 169

ALLOWVLAN 20 → backend VLANs on specific ports only

ALLOWCloudflare IPs → VLAN 20 only

DENYVLAN 30 (Media) → any other VLAN

DENYVLAN 40 (Game) → any other VLAN

DENYAll other inter-VLAN by default

WAN ingress

ALLOW9987/UDP → TS6 (voice)

ALLOW32400/TCP → Plex (direct streaming)

ALLOW3478, 5349 → Nextcloud (STUN/TURN)

DENYAll other inbound WAN traffic

Split-horizon DNS

Technitium DNS server

Primary

Secondary

Offsite failover

Authoritative for local.screedy.com. Forwarder zone for screedy.com — local overrides resolve to Traefik VIP, unknown records forwarded to Cloudflare. Secondary Technitium syncs via zone transfer.

Domain conventions

*.local.screedy.com

Internal only. Technitium-authoritative. Never published to Cloudflare DNS. Unreachable externally by design.

*.screedy.com

Public or split-horizon. Technitium override for internal clients + Cloudflare public record for external clients. Same domain, different resolution.

03 / Services

Deployed applications

25+ self-hosted services across six VLANs, all accessible via Traefik with wildcard TLS certs issued through a Cloudflare DNS challenge — no open WAN ports required for web access.

Productivity & knowledge

Nextcloud

split-horizon

nextcloud.screedy.com

Full self-hosted cloud suite — file sync, calendar, contacts, collaborative editing, and video calls. STUN/TURN port-forwards bypass Traefik for real-time communication.

VLAN 55Cloudflare tunnelSTUN/TURN

Docmost

split-horizon

docmost.screedy.com

Collaborative wiki and documentation platform accessible externally via Cloudflare tunnel.

VLAN 50Cloudflare tunnel

Immich

internal

immich.local.screedy.com

Self-hosted Google Photos alternative with ML-powered face recognition, EXIF search, and mobile backup. NFS-backed storage on TrueNAS. Migrating from VLAN 169 to VLAN 50.

VLAN 50NFS storageML faces

Booklore

internal

booklore.local.screedy.com

Self-hosted library management and e-book reader with metadata enrichment and reading progress tracking.

VLAN 50

Kiwix

internal

wiki.local.screedy.com

Offline Wikipedia and reference content server. Useful when external internet is unavailable.

VLAN 50Doomsday Preparation

AI & automation

OpenWebUI

split-horizon

ai.screedy.com

Web frontend for local LLMs served through LiteLLM proxy. Supports model switching, conversation history, and RAG pipelines from behind a Cloudflare tunnel.

VLAN 50Cloudflare tunnelLiteLLM

N8N

internal

n8n.local.screedy.com

Low-code workflow automation platform. Migrating to VLAN 50 with full Traefik integration and persistent NFS storage.

VLAN 50migrating

Changedetection

internal

changedetection.local.screedy.com

Website change monitoring with alerting. Tracks upstream service updates, CVEs, and infrastructure advisories.

VLAN 50monitoring

Infrastructure & operations

Traefik v3

internal

traefik.local.screedy.com

traefik.screedy.com

Reverse proxy and TLS termination for all internal and split-horizon services. Wildcard certs via Cloudflare DNS challenge. Dynamic config hot-reloads with no restart. Runs as a two-node active/passive pair sharing a keepalived VRRP virtual IP, with failover in roughly 4 seconds. Config and certificates are synced one way from traefik-01 to traefik-02 by rsync on a systemd timer, so the passive node is always ready to take over. Access logs are shipped to Loki over OpenTelemetry, and a CrowdSec bouncer plugin rejects banned IPs before they reach any backend.

VLAN 20keepalived VIP2 nodeswildcard TLSmetricsCrowdSec bouncerOTLP logs

CrowdSec

internal

services VLAN · detection + LAPI

Behaviour-based intrusion prevention. Reads Traefik access logs from Loki, detects scanning, CVE exploit attempts and brute force, and pushes bans to a bouncer plugin on both Traefik nodes. Also enforces the CrowdSec community blocklist of around 15,000 known attackers. Its AppSec component works as an inline WAF with virtual-patching rules for known CVEs.

VLAN 50bouncercommunity blocklistfail-open

Authentik

internal

auth.screedy.com

Identity provider and SSO. Forward auth middleware for Traefik planned — will protect services without built-in auth. Cloudflare tunnel exposure planned.

VLAN 50SSOforward auth planned

Netbox

internal

netbox.local.screedy.com

Network source of truth — VLAN documentation, device inventory, and rack diagrams.

VLAN 50

Technitium DNS

internal

infra VLAN · primary DNS

Primary DNS server with split-horizon zones. Authoritative for local.screedy.com, forwarder for screedy.com. Secondary node provides HA for DNS resolution.

VLAN 169split-horizonzone transfer

Forgejo

split-horizon

forgejo.screedy.com

Self-hosted git forge. Hosts all infrastructure and application code, including the CI/CD pipelines that deploy this portfolio. Actions runner in VLAN 55 SSHes into target LXCs for zero-downtime deploys.

VLAN 55Cloudflare tunnelActions runner

Media (VLAN 30 — isolated)

Plex

split-horizon

plex.screedy.com

Media server. Port-forwarded directly on 32400 for remote direct streaming — bypasses Traefik by design to avoid proxy overhead on large media streams. Isolated in VLAN 30.

VLAN 30port-forwardisolated

Arr stack

internal

*.local.screedy.com

Sonarr, Radarr, Prowlarr, Seerr, qBittorrent, Flaresolverr — fully automated media acquisition pipeline. All services reside in VLAN 30 with no outbound to other VLANs.

VLAN 30isolatedNFS storage

Gaming and entertainment

FoundryVTT

split-horizon

vtt.screedy.com

Self-hosted virtual tabletop for TTRPGs. Exposed externally via Cloudflare tunnel with WebSocket support through Traefik. Split-horizon DNS keeps latency low for local players.

VLAN 50WebSocketCloudflare tunnel

TeamSpeak 6

port-forward

ts6.screedy.com

Voice communication server for gaming. Port-forwarded directly on UDP 9987 to minimize latency.

VLAN 40port-forwardisolated

04 / Security

Security posture

Defence in depth — from VLAN segmentation at the network layer up through zero-trust tunnels, automated TLS, a web application firewall, intrusion prevention, SIEM alerting, and per-service access controls.

Network segmentation

Six VLANs isolate workloads by risk profile and purpose
Default-deny between all VLANs — explicit allow rules only
Media (30) and Game (40) have no outbound to internal services
VLAN 55 (Exposed) further isolates exposed services from VLAN 50
The Traefik HA pair (VIP) on VLAN 20 is the sole ingress point for proxied web traffic

Zero-trust external access

Cloudflare Tunnel — no inbound WAN ports for web services
All external traffic terminates at Cloudflare edge
*.local.screedy.com is never published to public DNS — unreachable externally by design
Cloudflared LXC isolated from backend VLANs — only permitted to reach Traefik

TLS everywhere

Wildcard certs for *.local.screedy.com and *.screedy.com via Cloudflare DNS challenge
No HTTP-01 challenge — WAN ports 80/443 remain closed
Certificates managed on traefik-01 and synced to the backup node, renewed automatically before expiry
HTTPS backends use serversTransport with appropriate cert verification settings
HSTS, XSS protection, frame options, referrer policy enforced via Traefik middleware

SIEM & access monitoring

Wazuh agent on Traefik LXC ships access logs and daemon logs as JSON
Custom Wazuh rules for brute force, 5xx storms, blocked access, slow response anomalies
Traefik access log captures ClientHost, X-Forwarded-For, DownstreamStatus, Duration, RouterName
Prometheus scrapes Traefik metrics — Grafana dashboards for request rates and error spikes
Rate-limit middleware on Traefik: 100 req/s average, burst 50
Basic auth on Prometheus endpoint enforced via Traefik middleware

Intrusion prevention

CrowdSec analyses Traefik access logs from Loki for scanning, CVE exploit attempts and brute force
Offending IPs are banned on both Traefik nodes within about a minute
Community blocklist of ~15,000 known attackers enforced alongside local detections
Real client IP taken from Cf-Connecting-Ip only when the request comes from the tunnel connector
Cloudflare WAF rules challenge traffic from cloud-provider networks at the edge

Web application firewall

CrowdSec AppSec inspects every public request inline, before it reaches a service
Virtual-patching rules block exploits for known CVEs on the very first request
Blocks the single malicious request instead of banning the visitor, so a stray bad URL never locks out a real user
Fails open — if CrowdSec or its WAF is unreachable, traffic flows and only detection pauses
Generic OWASP rules (SQL injection, XSS) staged behind a false-positive review

05 / Observability

Monitoring & alerting

Metrics, logs, and security events aggregated into a coherent observability pipeline — so problems surface before they become outages.

Prometheus

Metrics collection

Scrapes Traefik (/metrics on :8080), CrowdSec, Unpoller (UniFi network metrics), and itself. Basic auth enforced by Traefik middleware.

Grafana

Dashboards

Datasources pointed directly at Prometheus and Loki (bypasses the Traefik auth layer). Dashboards for UniFi AP/client metrics, Traefik request rates, error rates, response time percentiles, access logs with visitor geolocation, and CrowdSec detections.

Wazuh

SIEM / EDR

Agent on Traefik LXC with custom JSON decoder for Traefik access logs. Custom rules fire on brute-force patterns, 5xx error spikes, blocked access events, and slow response anomalies.

Unpoller

Network metrics

UniFi controller exporter for Prometheus. Tracks per-client and per-AP traffic, signal quality, and channel utilisation. Pure exporter — no UI, port 9130 only.

Beszel

Host monitoring

Lightweight agent-based host monitoring. Tracks CPU, memory, disk I/O, and network per LXC and VM. Low overhead compared to full node_exporter setups.

Loki

Log aggregation

Receives Traefik access logs from both proxy nodes over OpenTelemetry (OTLP), labelled per node, with 30-day retention. Grafana queries it next to Prometheus, and CrowdSec reads it for attack detection. Logs from other LXCs and VMs are next.

06 / Engineering decisions

Why this setup?

The decisions that shaped this setup — and the trade-offs considered.

LXC over VM for most services

LXCs share the host kernel, making them faster to start and far cheaper on RAM — a meaningful constraint with two nodes. Proxmox HA works on LXCs, so failover is still automatic. VMs are reserved for workloads that genuinely need kernel isolation, like Nextcloud.

Cloudflare Tunnel instead of open WAN ports

No inbound WAN firewall rules for web services. Traffic terminates at Cloudflare's edge — the origin IP is never exposed. DDoS protection, WAF and rate-limiting handled by Cloudflare. The trade-off is a dependency on Cloudflare's availability for public-facing services, which is an acceptable risk for a homelab.

DNS challenge for wildcard TLS

Using the Cloudflare DNS-01 ACME challenge means no ports need to be open for cert issuance or renewal. A single wildcard cert covers all subdomains, and renewal is fully automated inside Traefik — no manual intervention ever needed.

VIP pre-allocated — cutover with zero DNS changes

Every DNS record pointed at the keepalived VIP long before a second Traefik node existed. When traefik-02 came online on lenovo2 and keepalived was configured, not one DNS record or port forward had to change — the cutover to an HA pair was operationally invisible. Choosing the indirection up front turned what is usually a migration into a configuration change.

Split-horizon DNS over separate domain names

Internal clients resolve service.screedy.com to the Traefik VIP via Technitium's forwarder zone. External clients get Cloudflare's public record. Same domain, different resolution path — no internal traffic hairpins through Cloudflare, and no UX difference for users.

Quorum device for a two-node cluster

Proxmox requires quorum to take HA actions. With only two nodes, a network partition creates a tie — without a tiebreaker, neither node can safely fence the other and HA stalls. The Raspberry Pi resolves this at minimal cost and power draw.

Separate VLAN 55 for internet-facing services

Nextcloud receives STUN/TURN port-forwards directly from WAN and runs the AiO container which exposes more surface area. Putting it in VLAN 55 rather than VLAN 50 limits the blast radius if the container is compromised — it cannot reach other application services.

CrowdSec: central detection, enforcement in the proxy

One CrowdSec instance on VLAN 50 reads Traefik's logs from Loki instead of running agents on the exposed proxy nodes, so there is one config to maintain and nothing extra on the edge. The Traefik plugin enforces bans from a local copy of the list and fails open: a CrowdSec or Loki outage only pauses new detections, it never takes public services down. Tunnel traffic is attributed to the real visitor via Cf-Connecting-Ip, trusted only from the tunnel connector — otherwise every visitor would look like cloudflared, and one ban would block everyone. AppSec adds a second, inline layer: individual exploit requests are blocked immediately, while IP bans handle repeat behaviour.

07 / Technology