Homelab Infrastructure Platform

Overview

I have been building this out over several years. It is a learning environment and a practical place to host personal projects and experiments, and I run it with production principles in mind. The platform covers virtualization, storage, networking, monitoring, and secure remote access, all of it designed to work together as one system.

Features

• Proxmox runs multiple isolated VMs and containers on an enterprise-grade hypervisor.
• TrueNAS centralizes storage, with snapshot-based data protection.
• Tailscale carries remote administration without exposing ports.
• Prometheus and Grafana provide observability: metrics, dashboards, and alerting.
• Unifi segments the network with controlled ingress.
• Backups are layered for recoverability, using snapshots and offsite copies.

Technical highlights

Virtualization layer

Proxmox VE is the compute foundation. VMs get dedicated resource allocations, containers handle the lightweight workloads, and new services are provisioned from templates. Snapshots make experimentation safe: if a change goes badly, I roll it back.

Each workload runs in isolation, which keeps the blast radius small when something goes wrong and lets me upgrade or rebuild one service without touching the others.

Storage architecture

TrueNAS holds the persistent data. It is ZFS underneath, which is where the data integrity guarantees come from, snapshots run on a schedule for point-in-time recovery, and the shares are reachable from every VM. Critical data and rebuildable data live on separate tiers, because they do not need the same treatment.

The storage layer is designed around one idea: data protection is a workflow, not a checkbox. Recoverability is layered, with local snapshots for the ordinary case and offsite backups for the case where the hardware is gone.

Network design

Unifi gear runs the network. VLANs separate the trust zones, firewall rules control what crosses between them, and the management plane is kept off the same segment as service traffic. Ingress is deliberately narrow. The whole architecture follows least-privilege principles: devices and services only have the access they need.

Secure remote access

Administration goes over Tailscale instead, an overlay network with no management ports exposed to the public internet at all. Access is authenticated per device and encrypted end to end, and it works from anywhere without the usual VPN setup.

Closing the management plane to the internet removes a whole class of attack surface, and it costs nothing in operational access.

Observability stack

Prometheus scrapes metrics from every host and service, Grafana draws custom dashboards for infrastructure and application health, and alert rules fire into Discord. The historical data feeds trend analysis and capacity planning, and the stack makes operations proactive: it catches issues before they become user-visible problems.

Architecture

graph TB
    subgraph internet [Internet]
        Users[Users]
        Admin[Admin Devices]
    end
    
    subgraph edge [Edge Layer]
        Cloudflare[Cloudflare DNS]
        VPS[VPS Ingress]
    end
    
    subgraph homelab [Homelab]
        subgraph network [Network Layer]
            Unifi[Unifi Router]
            Tailscale[Tailscale Mesh]
        end
        
        subgraph compute [Compute Layer]
            Proxmox[Proxmox Host]
            VMs[Service VMs]
            Containers[Containers]
        end
        
        subgraph storage [Storage Layer]
            TrueNAS[TrueNAS]
            Backups[Backup Storage]
        end
        
        subgraph observability [Observability]
            Prometheus[Prometheus]
            Grafana[Grafana]
            Alerts[Discord Alerts]
        end
    end
    
    Users --> Cloudflare --> VPS --> Unifi
    Admin --> Tailscale --> Proxmox
    Unifi --> VMs
    VMs --> TrueNAS
    VMs --> Prometheus --> Grafana --> Alerts
    TrueNAS --> Backups

Operations

Change management

Changes follow the same routine every time. Snapshot first if the operation is risky, test in isolation where that is possible, write down what changed and why, then watch for side effects after it is deployed.

Incident response

When something breaks, Discord alerts me, the dashboards give me enough context to start investigating, and rollback is quick because the snapshots are already there. Afterwards I write down what happened and what I learned from it.

Capacity planning

Capacity planning runs off the same monitoring data: utilization trends, storage consumption projections, and how demand for each service moves over time. Upgrades happen when the graphs say so.

Lessons learned

Isolation reduces complexity. Clear boundaries tell you where a problem can and cannot be.

Documentation is operational. Future me has to understand what current me decided.

Monitoring buys confidence. Visibility allows bold changes with safety nets, and I will try something risky on a box I can watch.

Security is architectural. Good design prevents the problems that patching can only chase.

What's next

Currently on the list:

• better inventory documentation and a real network map
• more backup destinations, with retention policies to match
• container orchestration for the stateless workloads
• continued hardening, based on security best practices