Skip to content
← All builds
MB-401InfrastructureRunning2024–2026

The Homelab

A five-node Proxmox cluster with 218 TB of ZFS, a segmented 10 GbE network, and around twenty services. It hosts every app on this site, and it's run as documented infrastructure with an AI agent that keeps the runbook current.

Fig. 1 · Block diagram

This is where everything else on this site runs: the store, the invoicing app, the wine cellar, the camera viewer, and the lab tools.

Architecture

  • Compute: five Proxmox nodes with defined roles. One NVMe storage node holds the VM template, one storage node carries two dual-path SAS enclosures, one media node has GPUs passed through for transcoding and camera object detection, and two nodes run applications. Every VM is cloned from one Debian template, never built fresh.
  • Storage: 12 × 24 TB SAS in RAIDZ2 for about 218 TB usable, grown from 10 to 12 drives in place with RAIDZ expansion. Mirrored SSDs for hot data, mirrored NVMe for VM disks.
  • Network: UniFi with a 10 GbE core and bonded links on the storage nodes, six VLANs with intrusion prevention on each, and redundant ad-blocking DNS pointing every lab service at one reverse proxy with a wildcard certificate.
  • Edge: remote access only through a VPN; public services only through an outbound tunnel. No inbound ports.
  • Power: a 6 kVA online UPS with about 150 minutes of runtime and a metered PDU, both monitored.

Hard-won rules

  • Regenerate the MAC address on every cloned VM; the template’s MAC causes silent layer-2 conflicts.
  • Build ZFS pools from stable drive IDs, because dual-path SAS shows every drive twice.
  • Docker’s published ports bypass the host firewall, so they’re filtered in Docker’s own chain by a script that runs at boot.
  • Changing a cluster node’s IP only works in a strict order: cluster config, hosts, DNS, certificates, rejoin.

Operated with an agent

The infrastructure is documented in one runbook in its own git repository, on a VM dedicated to Claude Code. The agent has a standing rule: after any real infrastructure change, update the runbook, commit and push. Non-secret facts are mirrored into my notes vault, so any future session, mine or an agent’s, starts from the current truth.