Skip to content

Homelab

live

It's also where my projects run and get tested, and where the incidents on my blog happen.

One Proxmox host running 20+ self-hosted services behind a single reverse proxy, with no open ports.

ProxmoxDockerTraefikTailscale
NAME RESOLUTION On the LAN the router hands out Pi-hole first and AdGuard second, so names still resolve when the server is down On the tailnet split DNS: only the internal suffix goes to Pi-hole, and everything else uses the client's own resolver Why split it a resolver reachable only over the VPN cannot be that VPN's only resolver: the lookups that bring Tailscale up would wait on a host Tailscale has to reach first OUTSIDE THE LAN Home router DNS 1: Pi-hole DNS 2: AdGuard, so the LAN outlives the server no SNMP: Zabbix reads its web UI, syslog to CT 100 Tailscale Other devices the private way in, the only way in for SSH PROXMOX HOST Zabbix · CT 100 · .100 Zabbix 7.0 LTS, PostgreSQL, nginx built with OpenTofu, set up with Ansible metrics from pve, prod-server, jellyfin and the router: no SNMP there, so it reads the admin pages and takes syslog own disk on local-lvm, not the NFS share UI: zabbix.home.darni.org via Traefik dev-server VM Docker, Tailscale Hawser agent reports to Dockhand on prod no Zabbix agent yet Subnet router LXC Tailscale advertising 192.168.1.0/24, so the tailnet reaches the LAN VM 210 · prod-server NETWORK AND CONTROL Pi-hole DNS for the LAN, gravity.db on tmpfs Gotify every alert lands here, then the phone Dockhand containers, logs on both hosts Traefik fronts all below, DNS-01, LAN-only BEHIND TRAEFIK · OPERATIONS Uptime Kuma checks that every service on this map answers NetAlertX who joined the LAN and when Homarr links homepage, drawn by the kiosk Site telemetry systemd timer, commits telemetry.json daily to the site repo for its card BEHIND TRAEFIK · APPS Joplin Server notes and todos FreshRSS feeds, Readable extension, ReadYou on the phone Kavita ebook library BEHIND TRAEFIK · MEDIA, ONE COMPOSE FILE Seerr requests, from anyone with an account Radarr · Sonarr films and series: decide what to fetch, and from where qBittorrent does the fetching; gluetun wrapper written, off until there is a VPN byparr FlareSolverr stand-in, for indexers behind anti-bot pages Prowlarr one indexer list, pushed to both arrs Bazarr subtitles for what the arrs bring in NFS export media served by this VM to the Jellyfin LXC, and to the Proxmox host itself OTHER GUESTS Jellyfin · CT 211 iGPU via cgroup2 device binding media over NFS Kiosk LXC 107 Debian, cage + Chromium GPU and input bound in shows Homarr Arch VM Sunshine streaming Tailscale THE HOST ITSELF pve, the host web UI LAN only, reached over Tailscale from outside API on :8006 for Zabbix media mount the host mounts the NFS export from VM 210, one of its own guests Backups One alert with nowhere to go Zabbix runs in its own container, so it notices when prod-server goes down, which Uptime Kuma cannot, since Kuma runs on prod-server. But Gotify runs there too, so that alert has nowhere to go yet. A second alert channel is next. private alerts HTTP, every 5 min syslog, UDP 514 agent 2 + Docker webhook The lines in the left margin are Zabbix: solid is agent 2, dashed is the Proxmox API. indexers reads media
← Back