Homelab Documentation¶
This site documents the architecture, services, labs, and troubleshooting history of my homelab.
The environment is built on Proxmox VE, with OPNsense providing internal routing, network segmentation, DNS, and WireGuard VPN access.
Start here¶
| Area | Description |
|---|---|
| Architecture | Network topology, VLANs, addressing, hardware, and design decisions |
| Labs | Planned and active learning environments |
| Infrastructure and services | Installation and configuration notes for the core platform |
| Journal | Dated troubleshooting notes, decisions, and lessons learned |
Environment overview¶
- Compute: One Dell mini PC running Proxmox VE
- Firewall and router: OPNsense virtual machine
- Network segmentation: Management, infrastructure, and application VLANs
- Remote access: WireGuard VPN
- Internal DNS: Unbound DNS overrides
- Documentation: MkDocs Material
See the network topology for the current logical map and IPAM for addressing details.
Accessing the homelab¶
Internal lab services are accessed through WireGuard. They are not intended to be published directly to the internet.
1. Install WireGuard¶
Install the official client for the device:
2. Create a peer in OPNsense¶
Create a separate WireGuard peer for each device. Give every peer its own key pair and tunnel address so it can be revoked without affecting other devices.
3. Import the configuration¶
- On a phone or tablet, scan the QR code generated for the peer.
- On a computer, save or copy the configuration and import it into the WireGuard client.
4. Verify access¶
After activating the tunnel:
- Confirm that the client shows a recent handshake.
- Test the WireGuard gateway at
10.10.10.1. - Test an internal service by IP address.
- Test its internal DNS name.
See WireGuard VPN for the complete setup and troubleshooting notes.
Protect peer configurations
A WireGuard QR code or configuration file contains private key material. Do not publish or commit it to the documentation repository. Use one peer per device and revoke peers for lost or retired devices.
Lab roadmap¶
| Lab | Status | Intended outcome |
|---|---|---|
| Linux administration | Planned | Practise storage, LVM, systemd services, permissions, networking, logs, and recovery |
| Hybrid Active Directory and Entra ID | Planned | Build an on-premises identity environment and integrate it with Microsoft Entra ID |
| CI/CD | Planned | Move a change from source control through testing and into a controlled deployment |
| Argo CD and Kubernetes | Planned | Learn Kubernetes fundamentals and GitOps-based reconciliation |
| Monitoring | Planned | Collect useful metrics and logs, create dashboards, and design actionable alerts |
| Automation | Planned | Use Ansible and PowerShell for repeatable configuration and recovery |
| Nginx reverse proxy and load balancing | Planned | Add internal HTTPS entry points, proxy services, health checks, and load balancing |
| SIEM | Planned | Centralize security events and practise detection and investigation |
Documentation approach¶
The documentation should capture:
- the intended design
- the configuration that was implemented
- how the result was validated
- failures encountered along the way
- why one option was chosen over another
- recovery or rollback steps
This keeps the site useful as both a reference and a record of the learning process.