The Lab

Enterprise-grade infrastructure, built and operated by one engineer. A personal datacenter for learning, building, and securing everything.

0 Running Pods
0 K3s Nodes
70TB Storage
0 SIEM Agents
0 MCP Tools

Infrastructure Overview

A full-stack datacenter environment running on enterprise hardware with redundancy, segmentation, and monitoring at every layer.

External / Internet
Cloudflare DNS
Tailscale VPN
Let's Encrypt
Edge / Gateway
UDM Pro Max
IPS/IDS
DPI
Traefik Ingress
Compute
Proxmox VE
K3s Cluster (9 nodes)
LXC Containers
Frigate + RTX 3080 Ti
Storage & Data
Synology DS1821+ (70TB)
NVMe Cache
NFS / SMB
Monitoring & Security
Wazuh SIEM
Prometheus
Grafana
Alertmanager
AdGuard Home

Compute

High-performance hypervisor hosting the entire stack.

  • AMD Ryzen 9 5950X (16 cores / 32 threads)
  • 128 GB DDR4 ECC RAM
  • Multiple NVMe SSDs
  • Proxmox VE Hypervisor
  • VMs + LXC containers

Storage

Enterprise NAS with redundant parity and NVMe caching.

  • Synology DS1821+ (8-bay)
  • 70 TB raw capacity
  • SHR-2 dual parity RAID
  • NVMe read/write cache
  • NFS + SMB for services

Network

Full UniFi SDN stack with enterprise security features.

  • UniFi Dream Machine Pro Max
  • 5 managed PoE switches
  • 5 WiFi 6E access points
  • 6 VLANs with full isolation
  • IPS/IDS + DPI enabled

Kubernetes Cluster

A 9-node K3s cluster running ~190 pods with ArgoCD GitOps for fully declarative, version-controlled deployments.

Cluster Topology

High-availability control plane with dedicated worker nodes for different workload types.

Control Plane
ctrl-01
10.x.30.30
Control Plane
ctrl-02
10.x.30.31
Control Plane
ctrl-03
10.x.30.32
Worker
worker-01
10.x.30.40
Worker
worker-02
10.x.30.41
Worker
worker-03
10.x.30.42
Worker
worker-04
10.x.30.43
Worker
worker-05
10.x.30.44
Worker
worker-06
10.x.30.45

GitOps with ArgoCD

Every workload is defined in Git and automatically synced. No manual kubectl applies, no drift.

  • All manifests version-controlled in GitHub
  • Auto-sync with self-healing enabled
  • Application-of-applications pattern
  • Secrets managed via sealed-secrets
  • Automated image updates
Git Push
GitHub
ArgoCD
K3s Cluster
Running

Workload Types

  • Deployments & StatefulSets
  • CronJobs for scheduled tasks
  • DaemonSets for node agents
  • Jobs for one-off operations

Networking

  • Traefik IngressRoute CRDs
  • MetalLB for LoadBalancer IPs
  • CoreDNS for service discovery
  • Network policies per namespace

Storage

  • NFS CSI driver for persistent volumes
  • Local path provisioner
  • Synology NAS backing store
  • Volume snapshots for backups

Network Architecture

Enterprise VLAN segmentation with purpose-built security zones. Every network boundary is a firewall boundary.

Management VLAN 10
10.x.10.0/24
Restricted access to switches, APs, and management interfaces. Admin-only with certificate-based authentication.
Admin-only access Cert-based auth Isolated from users
Servers VLAN 30
10.x.30.0/24
Core infrastructure: Proxmox, K3s cluster, NAS, and all containerized services. The backbone of the lab.
Per-service firewall rules SIEM on all hosts Inter-VLAN controls
IoT VLAN 40
10.x.40.0/24
Isolated smart home devices with controlled access to Home Assistant. No direct internet for untrusted devices.
Restricted internet HA gateway only DNS filtering
Guest VLAN 50
10.x.50.0/24
Completely isolated guest WiFi. Bandwidth throttled, no internal access, content filtering enabled.
Client isolation Bandwidth limits No LAN access
Cameras VLAN 70
10.x.70.0/24
Fully air-gapped camera network. Zero internet access. Only the Frigate NVR has cross-VLAN access for recording and AI detection.
Internet blocked NVR-only inbound No outbound Dedicated PoE switch
External / DMZ VLAN 100
10.x.100.0/24
Demilitarized zone for externally-facing services. Strict ingress/egress with Cloudflare WAF in front.
Strict ingress/egress Cloudflare WAF Rate limiting DDoS protection

Wireless

  • 5 UniFi WiFi 6E access points
  • Band steering & fast roaming
  • Per-SSID VLAN assignment
  • Enterprise WPA3 for management

Switching

  • 5 managed PoE+ switches
  • 802.1Q VLAN trunking
  • STP with root guard
  • IGMP snooping for multicast

DNS & Proxy

  • AdGuard Home (internal DNS)
  • Cloudflare DNS (external)
  • Split-horizon DNS
  • Traefik reverse proxy with auto HTTPS
  • Tailscale VPN (dual HA routers)

Security Stack

Defense in depth: network segmentation, endpoint monitoring, AI surveillance, and continuous vulnerability assessment.

Wazuh SIEM

Full security information and event management platform with 25 agents across all infrastructure hosts. Centralized log analysis, vulnerability scanning, file integrity monitoring, rootcheck, and security configuration assessment.

25 Agents Vuln Scanning FIM Rootcheck SCA Compliance MITRE ATT&CK

AI-Powered Surveillance

Frigate NVR with 7 cameras running real-time AI object detection on an NVIDIA RTX 3080 Ti. Person, vehicle, and animal detection with zone-based alerting and 24/7 recording.

7 Cameras RTX 3080 Ti Real-time Detection Zone Alerts 24/7 Recording

Network Security

UniFi IPS/IDS with deep packet inspection at the gateway. Country-based geo-blocking, content filtering, and real-time threat intelligence feeds.

IPS/IDS DPI Geo-blocking Threat Intel

DNS Filtering

Network-wide ad and tracker blocking via AdGuard Home. Custom filter lists, per-client rules, and DNS-over-HTTPS for outbound queries.

AdGuard Home Network-wide DoH Custom Rules

Certificate Management

Automated TLS certificate provisioning via Let's Encrypt with Traefik. Wildcard certificates for internal services, auto-renewal, and HTTPS everywhere.

Let's Encrypt Wildcard Certs Auto-renewal HTTPS Everywhere

Security Principles

  • Zero trust by default
  • Least privilege access
  • Network segmentation
  • Defense in depth
  • Continuous monitoring
  • Automated remediation
  • Encrypted at rest & in transit
  • Regular vulnerability scans
  • Incident response playbooks
  • Audit logging on everything

Monitoring & Observability

Full observability stack with metrics, alerting, and dashboards for every layer of the infrastructure.

Prometheus

Time-series metrics database scraping every host, service, and application in the stack.

  • Custom scrape configs per service
  • Node Exporter on all hosts
  • Service-specific exporters
  • Long-term retention

Grafana

Visualization platform with custom dashboards for every subsystem in the lab.

  • Infrastructure dashboards
  • Network traffic analytics
  • K3s cluster health
  • Application-specific views

Alerting

PrometheusRule-based alerting with multi-channel notification delivery.

  • CPU, memory, disk alerts
  • Service health checks
  • Network anomaly detection
  • Discord + Telegram notifications

What Gets Measured

  • Host CPU, memory, disk I/O, network
  • K3s pod resource consumption
  • NAS disk health & utilization
  • Camera stream health & FPS
  • Traefik request rates & latency
  • Wazuh alert frequency
  • AdGuard query volume
  • UPS battery status

Alert Conditions

  • CPU sustained above 90% for 5 minutes
  • Memory usage above 85%
  • Disk usage above 80%
  • Pod restart count exceeds threshold
  • Service endpoint unreachable
  • SSL certificate expiry within 14 days
  • SIEM critical event detected
  • NAS disk health degradation

Services Catalog

~190 pods running across 9 Kubernetes nodes. Every service deployed via ArgoCD GitOps, monitored by Prometheus, and secured by VLAN isolation.

Media & Entertainment

Plex

Media streaming server with hardware transcoding and remote access

Sonarr

TV series management and automated download orchestration

Radarr

Movie collection management with quality profiles and upgrades

Lidarr

Music library management and automated acquisition

Prowlarr

Unified indexer manager for all media automation services

Overseerr

Request management portal for media library additions

Home Automation

Home Assistant

Central home automation hub with 200+ entities across lighting, climate, and sensors

Node-RED

Visual flow-based automation for complex multi-service workflows

Zigbee2MQTT

Zigbee device bridge supporting 50+ devices without vendor lock-in

WLED

Addressable LED controller for ambient and accent lighting effects

Security & Surveillance

Wazuh SIEM

Security information and event management with 25 monitored agents

Frigate NVR

AI-powered NVR with 7 cameras and RTX 3080 Ti object detection

AdGuard Home

Network-wide DNS filtering and ad blocking with query analytics

Monitoring & Observability

Prometheus

Time-series metrics collection with custom scrape configs for every host

Grafana

Visualization dashboards for infrastructure, network, and application metrics

Alertmanager

Alert routing and notification delivery via Discord, Telegram, and email

AI & Automation Platform

Thor MCP Server

Custom AI management platform with 264+ tools across 30 tool groups

Discord Bot

AI-powered bot for infrastructure management via slash commands

Telegram Bot

Mobile-first infrastructure control and monitoring

Ollama

Local LLM inference on RTX 3080 Ti for AI object detection and analysis

Documents & Productivity

Paperless-NGX

Document management system with OCR, tagging, and full-text search

Vikunja

Task management and project tracking with Kanban boards

Infrastructure & Networking

Traefik

Reverse proxy and ingress controller with automatic Let's Encrypt certificates

ArgoCD

GitOps continuous deployment for all Kubernetes workloads

Cloudflare DNS

External DNS management with DDoS protection and CDN

Tailscale VPN

Zero-config mesh VPN with dual subnet routers for high availability

AI Management Platform

A custom-built AI platform (Thor) that provides intelligent infrastructure management through 264+ MCP tools, 10 specialized agents, and multi-channel interfaces.

Thor MCP Server

Model Context Protocol server providing AI assistants with direct access to every system in the infrastructure. Built on Claude AI with Anthropic's SDK.

  • 264+ tools across 30 tool groups
  • Proxmox, K3s, NAS, network, DNS control
  • Security scanning & SIEM integration
  • Media stack management
  • Home automation control
  • Monitoring & alerting management

Agent Architecture

10 specialized AI agents, each with scoped tool access and domain expertise. Hot-reloadable registry with persistent memory.

  • Thor (Overseer) — primary coordinator
  • Heimdall — security monitoring
  • Jarvis — infrastructure management
  • Ada — home automation
  • Apollo — media stack
  • Offsec — pentesting & red team
  • + 4 more specialized agents

Interfaces

  • Claude Code CLI (primary)
  • Discord bot with slash commands
  • Telegram bot for mobile
  • Web dashboard (HTMX + Hono)

Memory System

  • Vector embeddings for semantic search
  • Daily logs & session tracking
  • Topic-based knowledge base
  • Incident history & resolution

AI Hardware

  • NVIDIA RTX 3080 Ti (12 GB VRAM)
  • Local Ollama inference
  • Object detection models
  • Image analysis pipelines

Maker Space

Beyond software: a workshop for physical prototyping, custom fabrication, and creative projects.

Laser Cutting

xTool P1

40W diode laser for cutting and engraving wood, acrylic, leather, and more. Enclosed workspace with exhaust filtration.

Fiber & Diode Laser

xTool F1 Ultra

Dual-laser system (fiber + diode) for engraving metals, plastics, wood, and stone. High-speed galvo marking.

FDM 3D Printing

Bambu Lab X1-Carbon

Multi-material FDM printer with AMS (Automatic Material System). Carbon fiber, PETG, TPU, and 16-color prints.

Resin 3D Printing

Elegoo Saturn 16K

16K resolution MSLA resin printer for ultra-detailed miniatures, prototypes, and jewelry molds.

Vinyl Cutting

Cricut

Precision cutting machine for vinyl, paper, fabric, and thin materials. Custom stickers, decals, and craft projects.

By the Numbers

The scale of a personal infrastructure that rivals small enterprise deployments.

0+
Running Pods
Across 9 K3s nodes
0+
MCP Tools
Across 30 tool groups
0TB
Storage
SHR-2 protected NAS
0GB
RAM
DDR4 ECC memory
0
SIEM Agents
Wazuh-monitored endpoints
0
Cameras
AI-powered with RTX 3080 Ti
0
VLANs
Full network segmentation
0
AI Agents
Specialized domain experts
0
CPU Threads
Ryzen 9 5950X
0
Maker Machines
3D printers, lasers, CNC

Built to Learn, Secured to Last

This homelab is a living platform for continuous learning in security, infrastructure, and automation.

Get in Touch Back to Resume