Personal Infrastructure & Homelab Architecture (v2.0)
Overview
A comprehensive, fully self-hosted infrastructure designed to eliminate reliance on proprietary cloud providers. Evolving from a monolithic appliance-based setup (v1.0), the current architecture (v2.0) is a hybrid environment utilizing bare-metal Debian machine as a NAS, Proxmox VE, and cloud-based VPS for robust containerization, virtualization, and AI/ML model training.
The environment relies exclusively on Open Source Software (OSS) and emphasizes security and data sovereignty.
Infrastructure & Hardware
The infrastructure relies on a decoupled architecture, separating storage from compute to allow flexible workload scaling and hardware utilization.
- Hypervisors (Proxmox VE): Two dedicated desktop nodes running Proxmox to host VMs and LXC containers. This enables snapshotting, easy workload migration, and isolated testing environments.
- Storage/NAS (Bare Metal Debian 12): Built on a physical machine to bypass IOMMU/PCIe passthrough complications in Proxmox. Configured with a 4-disk enterprise-grade array running a Btrfs RAID1C3 topology for maximum data resilience.
- AI Compute Node: My Desktop computer is equipped with an Nvidia RTX 4060ti (16GB) and utilizes the Nvidia Container Toolkit for GPU-accelerated Docker workloads.
- Power Management: A Raspberry Pi 2W runs
NUTserveras a standalone UPS monitoring node, ensuring safe shutdowns during power loss for all machines. - External VPS (Hetzner): A cloud-hosted node utilized strictly for high-deliverability services (Mail).
- Cloud Storage Space (Hetzner): A cloud-hosted storage space utilized as remote WebDAV and BorgBackup endpoint.
Networking, Security & Edge Services
Security is handled at the edge using Linux VM to isolate external-facing entry points from internal services.
- Edge / Reverse Proxy (VM): Nginx configured with strict security headers (HSTS), rate-limiting for basic DDoS mitigation, and Let's Encrypt SSL/TLS certificates managed via Certbot (OVH DNS challenge).
Fail2banis deployed to monitor and ban malicious traffic. UFW is utilized as firewall on the LXC. - DNS & Ad-Blocking (LXC): Pi-hole acts as the internal DNS sinkhole, providing network-wide ad and tracker blocking. It's also utilized to mitigate my ISP router NAT problems via Split DNS.
- Standard VPN Gateway (LXC): Wireguard facilitates secure remote administration and access to internal services.
- Xray VPN Gateway (LXC) (Planned): 3X-UI with Xray
- Identity Provider (LXC - Docker) (Planned): Transitioning to Authentik for centralized SSO (Single Sign-On), OAuth2 access delegation, and multitenancy management across 20+ services.
Data Resilience & Backup Strategy
Backups strictly follow the 3-2-1 backup methodology utilizing BorgBackup for deduplicated, client side encrypted archives.
The primary NAS acts as a Borg server. Docker data that has to be retained and DBs are backed up locally to the NAS. Also remote VPS and other machines backup to this Borg sserver.
- Off-site Replication: The NAS acts also as a Borg client and securely uses a Hetzner Storage Box as a client side encrypted repository.
- Filesystems & Protocols: Core storage relies on Btrfs and exposes NFS (internally, for Proxmox backup and some docker containers) and SFTP.
- Future Roadmap: Deployment of Proxmox Backup Server (PBS) for native, deduplicated hypervisor backups.
Containerized & Virtualized Services
Microservices are 100% dockerized and configured using Docker Compose or running as Proxmox VM/LXC to ensure portability, IaaC readiness and Proxmox High Availability readiness.
| Category | Hosted Services |
|---|---|
| Mail & Communications | Mailcow (dockerized on Hetzner VPS) (correctly configured A, MX, SPF, DKIM, DMARC, CNAME (for autoconfig) records on domain), Addy.io, Mastodon |
| Cloud & Media | Nextcloud (CalDAV/CardDAV), Syncthing, Transmission, Filebrowser, Immich, Jellyfin |
| Productivity | Vaultwarden (Bitwarden-compatible server), 2FAuth, Forgejo, Opengist, SplitPro, OpenWebUI |
| Home Automation | Home Assistant OS, Scrypted (NVR) |
AI & Machine Learning Compute
A dedicated AI stack is deployed for local inference, coding assistance, and remote model training without relying on external APIs (like ChatGPT).
- Local LLMs: Ollama running via Docker (Nvidia passthrough), interfaced globally via OpenWebUI.
- AI Pair Programming: Integration with the VS-Code Continue extension for in-IDE chat and autocomplete.
- Remote ML Training: A containerized Jupyter Web Server instance equipped with TensorFlow. Secured behind the Nginx reverse proxy, enabling remote Python kernel execution from any machine via VS-Code.
Future improvement
Horizontal scaling with Proxmox High Availability or parital migration to Hetzner Cloud VPS and shift to Bucket oriented architecture with Garage.
Conversion of LXCs, VMs and server deployment into Ansible Playbooks.