monk97.mewritingarchitecture

The lab, as built.

Reference · the map the series ends on

as of 2026-10-08 the series behind it

Where the series ends up: one Proxmox host on a home network, fourteen guests each doing one job, storage split by whether losing it would matter, and two ways in. This page names the products and the roles. Addresses, hostnames and guest IDs stay private, and so does the list of what is still weak; that is a to-do list, not a map. The live numbers for all of it are on the status page.

THE SHAPE OF IT

INTERNET cloudflare · public dns, this site tailscale · remote access HOME NETWORK router family devices, homekit synology nas wan PROXMOX VE · ONE HOST dell precision 7810 · xeon e5-2697a v4, 16c/32t · 64 gb · rtx pro 2000 blackwell, 16 gb vmbr0 bridge EDGE & IDENTITY APPS & TOOLS FILES & DESKTOP AI & BACKUP tailscalesubnet router adguard homedns nginx proxy managertls, routes by name authentiksingle sign-on uptime kuma+ netdata, logs, portal homebridgehomekit bridge mkdocslab documentation browserisolated, remote linux desktopthe one vm · novnc filestashfiles, read-only inference · gpumodels, voice, images chatopen webui, no gpu workbench · gpujupyter notebooks backup serverproxmox backup server STORAGE ON THE HOST, AND OFF IT sata ssd · lvm-thin every guest's own disk backed up nightly nvme shared files, models not backed up nas share · nfs backup datastore deduplicated models nightly
Every guest has its own place on the home network through the host's bridge (part 2). Dashed lines are folders shared in from the NVMe drive, which backups skip on purpose (part 6). Backups leave the host for the NAS over the home network (part 4).

HOW A REQUEST FINDS A SERVICE

your browser cloudflare dns · wildcard 1 · look up the name nginx proxy manager 2a · at home tailscale router 2b · away the service 3 authentik sign-in, some apps
The public record points at a private address, on purpose. At home that is one hop; away, only devices on the tailnet can follow it. Adding a service is one proxy entry, with no DNS change.

WHAT LEAVES THE HOST

NIGHTLY BACKUP · 02:30 guest disks backup server nas share snapshot chunks STATUS PAGE · EVERY 60 S uptime kuma collector cloudflare edge results labels only
Nothing calls into the lab. Backups go out to the NAS on the same network; the status page is fed by a push outward, and the edge refuses anything shaped like an address (case study).

THE GUESTS

ROLEKINDRUNS
remote accessLXCTailscale subnet router
dnsLXCAdGuard Home
edge proxyLXCNginx Proxy Manager, wildcard TLS
identityLXCauthentik
servicesLXCUptime Kuma, Netdata, Dozzle, IT-Tools, the app portal
home automationLXCHomebridge (where it all began)
documentationLXCMkDocs
browserLXCan isolated remote browser
filesLXCFilestash, read-only
inferenceLXC + GPUllama-swap with llama.cpp, Speaches, ComfyUI; owns the GPU (part 8)
chatLXCOpen WebUI, no GPU
workbenchLXC + GPUJupyter, for short training runs
backupsLXCProxmox Backup Server
desktopVMa full Linux desktop over noVNC

Thirteen containers and one VM on 32 threads and 64 GB. Each one can be snapshotted, backed up and restored on its own, which was the point of the whole rebuild.

← writing press / for a prompt