Homelab Infrastructure
📋 Note: The Cost Analysis and Build Your Own tabs are currently being updated with enhanced interactive content. Check back soon!
Homelab Infrastructure
Single physical workstation (WS-01) running Windows 11 Pro and Microsoft Hyper-V, hosting virtualized Proxmox VE 9.2, a dedicated Proxmox Backup Server (PBS 4.2) VM, and active LXC containerized workloads. GPU compute is hosted locally on the RTX 3060 12GB and exposed via Ollama. All public-facing apps reach the internet securely via Cloudflare Tunnel — the WordPress container itself has no outbound internet gateway by design.
Server Overview
Node Status
| Host | Type | CPU Usage | Memory | Guests | Status |
|---|---|---|---|---|---|
| WS-01 | Windows 11 Pro · Hyper-V Host (AMD Ryzen 7 5800X) | ~35 LXCs + VMs · RTX 3060 (Ollama) | Online |
Key Services
Workloads isolated on the internal DMZ bridge (10.0.10.0/24) behind Cloudflare Tunnel, communicating with the Hyper-V host over persistent WinNAT.
Network Architecture
Dual-segment architecture separating the hypervisor virtualization tier from the isolated container workload DMZ, with Cloudflare Zero Trust tunnel ingress and strict iptables egress filtering.
Hyper-V WinNAT Virtual Network
- WS-01 Host Gateway: 172.16.10.1
- Proxmox VE Virtual Host: 172.16.10.10 (vmbr0)
- Dedicated PBS 4.2 VM: 172.16.10.11:8007
- Host Ollama GPU API: 172.16.10.1:11434 (RTX 3060 12GB)
- Physical LAN Uplink: 192.168.1.100 (WS-01 physical NIC)
Isolated Workload DMZ (vmbr1)
- Cloudflare Tunnel: 10.0.10.5 (LXC 301 — Zero Trust edge ingress)
- WordPress: 10.0.10.10 (LXC 300 — LAN-only web container)
- Atomic: 10.0.10.91:8080 (LXC 670 — Knowledge graph)
- Firecrawl: 10.0.10.30:3002 (LXC 635 — Web extraction engine)
- SourceBot: 10.0.10.25:3000 (LXC 420 — Code search indexer)
- Egress Policy: Outbound QUIC/HTTPS only; drops RFC1918 LAN & host ports
Storage & Backup Layer
Proxmox Backup Server 4.2 (Dedicated Gen-2 VM)
Physical Hardware
WS-01 Workstation (Physical Host)
- CPU: AMD Ryzen 7 5800X @ 3.80 GHz (8 cores / 16 threads)
- RAM: 64 GB DDR4
- GPU: NVIDIA GeForce RTX 3060 12 GB (Local AI inference via Ollama)
- Storage: NVMe SSDs (Host/VMs) + 2 TB Passthrough External Disk (PBS)
- OS & Hypervisor: Windows 11 Pro running Microsoft Hyper-V
- Role: Single physical host — runs virtualized Proxmox VE 9.2, PBS 4.2 VM, and ~35 containers
- Network: 192.168.1.100 (Physical LAN) · 172.16.10.1 (WinNAT Virtual DMZ)
Note: This page displays static data. Live metrics from the Proxmox API will be integrated in a future update.
Architecture Deep Dive
Explore the five layers that make up this production homelab infrastructure, from physical hardware through to running applications.
Layer 1: Physical Hardware
A single high-performance physical workstation powers the entire infrastructure, hosting the virtualization platform, containerized workloads, and local GPU acceleration.
WS-01 (Single Physical Host)
- Windows 11 Pro host running Microsoft Hyper-V hypervisor
- AMD Ryzen 7 5800X 8-core / 16-thread processor with 64 GB DDR4 RAM
- NVIDIA GeForce RTX 3060 12 GB powering local AI models via Ollama API
- Persistent WinNAT virtual DMZ (172.16.10.0/20) with netfilter boundary defense
- Dedicated standalone PBS VM with physical SCSI disk passthrough
Layer 2: Hypervisor Layer
Microsoft Hyper-V on Windows 11 hosts the virtualized Proxmox VE node and dedicated Proxmox Backup Server (PBS) VM in a decoupled architecture.
Internal Virtual DMZ Switch (HyperV-NAT · 172.16.10.0/20)
Virtualized Proxmox VE 9.2
- Gen-2 Hyper-V virtual machine with nested virtualization enabled
- Manages internal isolated DMZ bridge (vmbr1) for ~35 LXC/VM guests
- Egress netfilter firewall strictly isolates containers from desktop & LAN
- Direct reverse-NAT proxying to host GPU Ollama API (10.0.10.1:11434)
Decoupled PBS 4.2 Architecture
- Dedicated standalone VM independent of Proxmox VE hypervisor lifecycle
- Physical 2 TB external disk passed through directly via Hyper-V SCSI controller
- Deduplicated, encrypted, verified snapshot chunk stores on dedicated media
- Eliminates memory contention and kernel lockups during heavy backup cycles
Layer 3: Network Architecture
Enterprise-grade defense-in-depth network design with strict virtual DMZ segmentation.
↓ Outbound Encrypted QUIC Tunnels (UDP 7844 / TCP 443) ↓
↓ Isolated Virtual Bridge (vmbr1) ↓
Virtual DMZ (10.0.10.0/24)
Subnet: 10.0.10.0/24 (PVE Bridge vmbr1)
Purpose: Hosted applications and public-facing containers
- Cloudflare Tunnel Gateway: 10.0.10.5 (CT 301)
- WordPress (eddykawira.com): 10.0.10.10 (CT 300)
- Atomic Knowledge Graph: 10.0.10.91 (CT 670)
- FireCrawl Scraping Stack: 10.0.10.30 (CT 635)
- SourceBot Code Indexer: 10.0.10.25 (CT 420)
Hyper-V WinNAT (172.16.10.0/20)
Subnet: 172.16.10.0/20 (HyperV-NAT Switch)
Purpose: Hypervisor management & decoupled backup storage
- Host WinNAT Gateway: 172.16.10.1
- Proxmox VE Host: 172.16.10.10
- Proxmox Backup Server: 172.16.10.11:8007
- Host Ollama API: 172.16.10.1:11434 (RTX 3060 GPU)
- Egress Drop Rules: Strictly block DMZ access to desktop & LAN
Layer 4: Storage Layer
Tiered storage architecture: high-speed NVMe for running guests and dedicated decoupled ZFS chunk stores for backups.
NVMe Workload Storage
- Fast NVMe storage hosting Windows host system and Hyper-V VHDX files
- High-speed ext4/ZFS pools for container root filesystems and MariaDB database engines
- Sub-millisecond query latency for WordPress, Redis Stack, and indexing services
- Optimized TRIM and discard enabled across virtualized disk layers
PBS Backup Architecture
- Content-addressable deduplication chunk store on 2 TB external media
- Fast incremental backups with dirty-bitmap tracking across containers & VMs
- Isolated offline lifecycle: backups verifiable without touching production hypervisor
- Enables complete bare-metal disaster recovery from cold media in under 45 minutes
Layer 5: Application Layer
34 services running across the cluster with high availability protection.
Core Services (6 services)
Standard Services (28 services)
17 additional LXC containers + 11 VMs running across all nodes
- Development environments
- Testing infrastructure
- Network services
- Monitoring tools
- Personal applications
End-to-End Request Flow
How a request reaches this website through the infrastructure layers.
Internet Request
Visitor accesses eddykawira.com
Cloudflare
DNS resolution, CDN caching, DDoS protection
Cloudflare Tunnel (LXC 301)
Secure ingress - no exposed ports
WordPress LXC (300)
10.0.10.10 on WS-01 (Proxmox VE) - Apache + PHP + MariaDB
Response
HTML rendered and returned to visitor
Homelab Topology
WS-01 Hyper-V / Proxmox VE architecture running containerized and virtualized workloads. All public-facing services route through Cloudflare Tunnel — the WordPress container has no outbound gateway by design.
Public Ingress Path
WordPress (LXC 300) has no default gateway — it cannot initiate outbound internet connections. Cloudflare Tunnel (LXC 301) handles all inbound traffic via outbound-only tunnel.