Homelab Documentation¶

This site documents the architecture, services, labs, and troubleshooting history of my homelab.

The environment is built on Proxmox VE, with OPNsense providing internal routing, network segmentation, DNS, and WireGuard VPN access.

Start here¶

Area	Description
Architecture	Network topology, VLANs, addressing, hardware, and design decisions
Labs	Planned and active learning environments
Infrastructure and services	Installation and configuration notes for the core platform
Journal	Dated troubleshooting notes, decisions, and lessons learned

Environment overview¶

Compute: One Dell mini PC running Proxmox VE
Firewall and router: OPNsense virtual machine
Network segmentation: Management, infrastructure, and application VLANs
Remote access: WireGuard VPN
Internal DNS: Unbound DNS overrides
Identity lab: DC-05 and domain client CL-01 on VLAN 20; both are temporary guests with rebuild instructions retained in the lab runbooks
Documentation: MkDocs Material

See the network topology for the current logical map and IPAM for addressing details.

Accessing the homelab¶

Internal lab services are accessed through WireGuard. They are not intended to be published directly to the internet.

1. Install WireGuard¶

Install the official client for the device:

2. Create a peer in OPNsense¶

Create a separate WireGuard peer for each device. Give every peer its own key pair and tunnel address so it can be revoked without affecting other devices.

3. Import the configuration¶

On a phone or tablet, scan the QR code generated for the peer.
On a computer, save or copy the configuration and import it into the WireGuard client.

4. Verify access¶

After activating the tunnel:

Confirm that the client shows a recent handshake.
Test the WireGuard gateway at the sanitized example 10.42.5.1.
Test an internal service by IP address.
Test its internal DNS name.

See WireGuard VPN for the complete setup and troubleshooting notes.

Protect peer configurations

A WireGuard QR code or configuration file contains private key material. Do not publish or commit it to the documentation repository. Use one peer per device and revoke peers for lost or retired devices.

Lab roadmap¶

Lab	Intended outcome
Linux administration	Practise storage, LVM, systemd services, permissions, networking, logs, and recovery
Active Directory	Manage AD DS, DNS, identities, delegation, domain clients, Group Policy, and application control
CI/CD	Move a change from source control through testing and into a controlled deployment
Argo CD and Kubernetes	Learn Kubernetes fundamentals and GitOps-based reconciliation
Monitoring	Collect useful metrics and logs, create dashboards, and design actionable alerts
Automation	Use Ansible and PowerShell for repeatable configuration and recovery
Nginx reverse proxy and load balancing	Add internal HTTPS entry points, proxy services, health checks, and load balancing
SIEM	Centralize security events and practise detection and investigation

Documentation approach¶

The documentation should capture:

the intended design
the configuration that was implemented
how the result was validated
failures encountered along the way
why one option was chosen over another
recovery or rollback steps

This keeps the site useful as both a reference and a record of the learning process.