Homelab

Rather than relying on a single server, my compute layer uses a hybrid, multi-node architecture designed for power efficiency, service isolation, and performance:

• Proxmox Virtual Environment (PVE) Cluster: Deployed across compact Dell OptiPlex small-form-factor units alongside a dedicated Dell PowerEdge rack server. This setup balances lightweight services across high-density LXC containers while isolating persistent workloads inside dedicated virtual machines.

• Hardware Passthrough & Acceleration: Configured low-level Intel GPU passthrough directly to containers, enabling real-time media transcoding on Jellyfin without bottlenecking system CPU cycles.

• Low-Power Edge Nodes: A dedicated Raspberry Pi handles round-the-clock DNS filtering and baseline telemetry, ensuring essential network operations run uninterrupted even during hypervisor maintenance.

Treating my private infrastructure with production-grade security standards starts with centralized identity:

• Direct Microsoft Entra ID (OIDC Federation): Rather than managing fragmented local accounts across hypervisors and appliances, I implemented modern cloud IAM using Microsoft Entra ID. Authentication is federated directly through OpenID Connect (OIDC) with Proxmox VE the UniFi Controller, and Twingate. This enforces centralized Single Sign-On (SSO), modern multi-factor authentication (MFA), and role-based access control (RBAC) across core management planes.

• Zero-Trust Remote Ingress: Default-deny inbound firewall policies keep all external router ports closed. Remote access is brokered through secure Cloudflare Tunnels, Nginx reverse proxy routing, and Twingate software-defined perimeters.

Network security and performance are orchestrated through UniFi hardware, utilizing strict segmentation, tailored wireless environments, and prioritized routing:

• Multi-VLAN Micro-Segmentation: Isolated broadcast domains segregate compute clusters, management interfaces, trusted client hardware, and untrusted endpoints to enforce the principle of least privilege across subnets.

• 
  

• Specialized IoT & Legacy Wireless Profiles: Smart home devices and legacy peripherals often lack support for modern standards like Wi-Fi 6 or 6GHz bands and introduce unique threat vectors. I deploy dedicated 2.4GHz-only, isolated SSIDs for IoT gear, paired with strict inter-VLAN firewall rules that block unsolicited communication back into private subnets.

• 
  

• Traffic Prioritization & QoS: Smart Queue Management (SQM) and traffic prioritization rules ensure low-latency performance for critical workloads—such as gaming servers, voice, and management interfaces—preventing bufferbloat during heavy bandwidth events like media streaming or remote backups.

• 
  

• DNS Hygiene & Firewall Enforcement: Local DNS resolution is anchored by Pi-hole, reinforced by custom firewall rules that intercept and redirect all rogue port 53 traffic, preventing smart devices from bypassing internal ad blocking and telemetry sinkholes.

• Identity & Access

  • Microsoft Entra ID (Direct OIDC for Proxmox & UniFi), Twingate Zero-Trust, Cloudflare Tunnels

• Networking & Security

  • UniFi VLAN segmentation, legacy/IoT 2.4GHz SSIDs, QoS/SQM rules, Pi-hole DNS sinks, honeypots

• Virtualization & Compute

  • Multi-node Proxmox VE, LXC containers, Intel iGPU passthrough, Raspberry Pi edge compute

• Media & Analytics

  • Jellyfin Media Server (hardware-accelerated), self-hosted Spotify listening analytics

• Automation & IoT

  • Isolated Home Assistant OS managing local smart-home integrations

• Game Server Hosting

  • Multi-instance dedicated game servers (Minecraft, Palworld) managed via systemd and tmux

• Observability

  • Homepage dashboard, Uptime Kuma heartbeats, and PRTG Network Monitor