A learning homelab

I built this home lab to learn identity, DNS, TLS, and reverse-proxy design as one system, not a pile of containers. You are on the public copy of the private map and notes. Addresses and internal names are stripped.

Nothing here is a live service login. The Network Topology page is the interactive map.

Why it exists

I use the lab on the same questions that show up in real infrastructure work:

  • How does a browser get from a name to a trusted certificate to the right app?
  • Where should login live when an app has no login of its own?
  • How do you keep a private source of truth and still publish something a stranger can read?
  • What still works when the workstation is off, or when I am on a phone off the LAN?

I care more about the path a request takes than a dashboard screenshot. Each guest has a written job. The public map is a stripped export of that drawing.

How traffic moves

Four layers:

  1. Edge. A fiber gateway in IP-passthrough hands the WAN address to a consumer router. That router is DHCP and the only WAN port-forward for HTTPS. DNS for the house is forwarded to the lab nameserver, not left on the router.
  2. Name and certificate. An authoritative nameserver answers for the domains I operate, with split-horizon so LAN clients and the public internet do not see the same records. A validating resolver handles everything else (DNSSEC). The reverse proxy terminates TLS and routes each name to one guest. A private ACME CA covers hosts that are not behind that proxy.
  3. Identity. Pocket ID is the passkey OIDC issuer. Apps that already know OIDC talk to it directly. Apps that do not get a front-door or a small helper (Tinyauth / oauth2-proxy). The public copy has no identity hop. A recruiter should never hit a login screen.
  4. Remote and egress. Tailscale advertises the LAN to a tailnet (subnet router, not an exit node). A Raspberry Pi stays up for Wake-on-LAN and power commands when the rest of the lab is off. Chosen outbound workloads leave through Gluetun (Mullvad). A public-IP test guest is how I prove those paths.
Internet → fiber gateway → edge router
                ↓
         reverse proxy (TLS)
                ↓
     identity  ·  apps  ·  this site

What is running

The hypervisor is a Dell OptiPlex Micro on Proxmox VE. Guests are mostly LXC, plus Home Assistant as a VM. The daily driver is a Windows 11 workstation for files, the editor, and remote desktop. Living-room media is an Apple TV 4K, which is also the Matter border router. Climate is a Meross thermostat under Home Assistant.

Role Public name on the map Job
Identity Pocket ID, Tinyauth Passkeys and OIDC; helper for apps that already have a login
DNS Nameserver, DNS Resolver Authoritative split-horizon; validating recursion
HTTPS Reverse Proxy, WebFinger, step-ca TLS front door, identity discovery, internal PKI
Remote Tailscale, CortenDesk LAN over the tailnet; browser/client desktop to the workstation
Egress Gluetun HTTP proxy out through Mullvad for chosen workloads
Notes Grav, Homelable, Obsidian Public CMS, private diagram + docs, LLM wiki viewer
Ops Homarr, Custom CLI, Scanopy, IPTest Dashboard, browser CLI, future discovery map, egress prove
Home Home Assistant Matter and the devices that should not be “lab servers”

The Raspberry Pi 3B is the one box I leave on: SSH, Wake-on-LAN, and the power/lock verbs for the workstation and hypervisor.

How I operate it

The private canvas and device notes are the source of truth. This site is a copy. I do not publish Live View of the private drawing.

A one-word command copies role names and short purpose quotes, drops addresses, and refreshes the public map JSON. It is not a timer. I run it when the drawing changes.

WAN HTTPS lands on the reverse proxy only. Lab apps stay on the LAN unless I deliberately publish a name (this site, and the identity issuer). Guests that should only be reached through the proxy are origin-locked after prove. I do not rely on hope that nobody types the IP.

Break-glass stays local. Hypervisor UI, local passwords, and direct console are separate from the proxy path.

Network Topology

The map is a stripped export of the private canvas. Click a device for the short purpose note. Pan, zoom, and pinch work. There are no live health checks and no links into the lab.

Open the Network Topology map Physical and virtual guests, site and role colors, and a short note on each box.

What I left off

This is not a status page or a login portal. The private docs stay private. Addresses, MACs, internal hostnames, and clickable lab URLs stay off this copy.