traceroute ~/lab

Architecture

The lab is segmented for defense-in-depth: identity-brokered remote access at the edge, a hardened perimeter, detection and threat intel, self-hosted services and private AI, and full-stack observability, all running on a 12-node Proxmox cluster of 59 guests.

Home lab network topology: zero-trust access, perimeter, detection and intel, self-hosted services, AI, and observability tiers on a 12-node Proxmox cluster

Zero-Trust Access

Twingate broker · Apache Guacamole · hardened jumpbox · RustDesk

Edge / Perimeter

pfSense firewall · Suricata IDS/IPS · Kemp load balancer (SSL offload) · reverse proxy

Detection & Intel

Wazuh SIEM/EDR · MISP vulnerability feed · OpenCanary honeypots

Self-Hosted Services

KASM isolated browser · SearXNG metasearch

Self-Hosted AI

Ollama · OpenWebUI · ComfyUI · Qwen3-TTS

Observability

InfluxDB + Telegraf · Loki · Grafana · Uptime Kuma

Compute & Inventory

12-node Proxmox cluster (59 guests) · ProxDoc inventory & compliance platform