This is an overview of my homelab, where I run and experiment with various services focused on infrastructure, security, and self-hosting.
The setup is designed to simulate real-world systems and architectures rather than just running isolated applications.
Hardware
My homelab is built around a Dell PowerEdge R640 with dual Intel Xeon Gold 6138 CPUs and 176 GB of RAM, running Proxmox VE as the virtualization platform.
This allows me to run multiple virtual machines and experiment with more advanced infrastructure setups without having to worry about resource limitations.
It also enables me to quickly implement and test ideas in isolated environments.
Network
The network has two parts.
LAN. The core infrastructure lives on the LAN bridge: Traefik, Authentik, Vault, Warpgate and the VyOS router itself.
Isolated VLANs. Around thirty VMs sit on a separate VLAN-aware bridge with no physical uplink. Each VM gets its own VLAN behind VyOS, and every VLAN is denied by default. Traefik can only reach the backend ports a VM declares, VMs can't talk to each other, and outbound traffic is set per VM.
Identity services stay outside the router's failure domain on purpose. If VyOS goes down, the isolated VMs lose connectivity, but login, secrets and SSH access keep working.
Access
Public. Cloudflare Tunnel is the only way in from the internet. Cloudflare applies WAF and bot rules and requires a valid client certificate before a request reaches the login page. The tunnel always forwards to Traefik, never directly to a service.
Private. Everything else goes through Tailscale with ACLs. At home, my workstation takes the same paths without Tailscale: local DNS resolves the same hostnames to Traefik, so every URL works the same everywhere and goes through the same checks.
Direct. The services everything else depends on aren't only reachable through Traefik. Authentik, Vault, Warpgate and the Proxmox UI can be reached directly on the LAN and over the tailnet.
Security and identity
The setup is built around central identity and zero-trust principles.
- Authentik is the identity provider. It handles SSO and MFA for web apps, Tailscale, Vault and Warpgate, and Traefik attaches it per route as forward auth.
- Vault stores secrets and issues short-lived SSH certificates instead of static keys.
- Warpgate is the single entry point for SSH, with login through Authentik.
- Tailscale restricts private access by identity and ACLs.
- Fallback accounts on Proxmox and iDRAC make sure an identity problem never stops me from fixing the identity provider.
Automation
Every VM starts as an entry in a versioned inventory: compute, VLAN, IP, egress and Traefik ports. A Terraform runner creates the VM on Proxmox from an Ubuntu template, cloud-init handles the first boot, and the runner configures VyOS through its API. Ansible keeps the VMs up to date afterwards. Services run as Docker Compose stacks, with one repository per service.
Services
Besides the infrastructure, I self-host services like Ghost for this blog, Immich for photos and Beszel for monitoring. Smaller projects and lab environments change with my current needs and run in their own VLANs. I tend to prefer enterprise-grade solutions, and I replace cloud services with self-hosted ones where it makes sense.
Monitoring and recovery
Beszel for host and VM metrics.
Proxmox Backup Server at an off-site location: incremental, deduplicated and encrypted on the client.
iDRAC 9 for console access when nothing else works.
Direct paths to the core services that don't depend on Traefik.
Approach
My focus is on building practical, secure, and maintainable systems that reflect real-world environments.
I prioritize centralized identity, secure access, and clear architecture over quick or temporary solutions.
At the same time, I value usability and smooth workflows, as seen in my SSO setup. Secure solutions are often not only safer, but also more seamless to use in practice.