homelab

a full lab on a college budget: dedicated edge hardware, one oversized hypervisor, a pi that never sleeps, and a simple rule: nothing listens from the outside, ever.

        ┌─────────────┐
        │   internet  │
        └──────┬──────┘
               │
        ┌──────┴──────┐
        │   flint 3   │
        │  wireguard  │
        └──────┬──────┘
               │
        ┌──────┴──────┐
        │  protectli  │
        │  vault fw4c │
        └──────┬──────┘
               │
        ┌──────┴──────┐
        │   netgear   │
        │ ms305e 2.5g │
        └──────┬──────┘
               │
     ┌─────────┴─────────┐
     │    lan segment    │
     └─┬───┬───┬───┬─────┘
       │   │   │   │
       │   │   │   └─ thinkpad · debian netinstall
       │   │   └─ main rig · windows + wsl2 ubuntu
       │   └─ rpi 5 · always-on services
       │
 ┌─────┴───────┐
 │  proxmox ve │
 │ ryzen 9 16c │
 └─────────────┘

 tailscale mesh overlays every node

edge

a gl.inet flint 3 terminates a wireguard tunnel at the perimeter, and every packet egresses through it, no raw isp exit. behind it a protectli vault fw4c does dedicated firewalling, and a netgear ms305e pushes 2.5gbe across the lan. no port forwards. remote access rides the mesh, not the firewall.

compute

the main hypervisor runs proxmox ve on a ryzen 9 5900xt (16c/32t) on an asus rog strix b550-f, cooled by a 360mm arctic liquid freezer iii, fed by a corsair rm850e in a lian li lancool 216. the bridge is vlan-aware for logical segmentation, guests run as unprivileged containers wherever possible, and the hypervisor ui and ssh are gated behind a yubikey via webauthn.

always-on

a raspberry pi 5 (16gb) on dietpi carries the 24/7 stack so the big box can sleep. an nvme hat is next on the bench so it can boot off pcie instead of microsd.

rpi 5 ── gitea · grafana · nginx

clients

daily driver is a windows rig with wsl2 ubuntu for the unix side of life. the thinkpad runs a debian netinstall, nothing on it that didn't earn its place.

overlay

tailscale meshes every node, so nothing is ever exposed to reach it. if a device isn't on the mesh, it doesn't exist.

storage

nvme ── vm disks · lvm-thin
ssd  ── fast scratch · isos · templates
hdd  ── bulk archive · cold storage

rules

unprivileged containers only. secrets never leave the host. every experiment gets torn down to a known-clean snapshot. the lab is treated as hostile by default, the same posture i'd want in production.