You Need a Homelab!

A homelab isn't just a cluster of blinking servers in a corner of your house — it's a live test bench, a personal production system, and an excellent way to learn about network infrastructure, security, and systems administration.

In this article I walk through the current architecture of my homelab, designed with perimeter security, high service availability, and centralised identity management in mind.

flowchart TD
    classDef internet fill:#f9f9f9,stroke:#333,stroke-width:2px;
    classDef vps fill:#e1f5fe,stroke:#01579b,stroke-width:2px;
    classDef lan fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px;
    classDef security fill:#fff3e0,stroke:#ef6c00,stroke-width:2px;
    classDef apps fill:#e3f2fd,stroke:#1565c0,stroke-width:2px;
    classDef storage fill:#eceff1,stroke:#37474f,stroke-width:2px;
    classDef proxmox fill:#f3e5f5,stroke:#6a1b9a,stroke-width:2px;

    subgraph Internet [Internet]
        ExtNet([Internet User])
    end

    subgraph VPS [External VPS]
        ExtNPM[External NGINX]
    end

    subgraph Proxmox [Proxmox VE — Bare Metal]
        subgraph LAN [Network Layer]
            Router["pfSense (VM)"]
            IntNPM["Internal NGINX (LXC)"]
            Dashy["Dashy Dashboard (LXC)"]
        end

        subgraph Security [Security Layer]
            Authentik["Authentik SSO (LXC)"]
            AD["Samba 4 AD DC (VM)"]
            Vault["Vault (LXC)"]
        end

        subgraph Apps [Application Layer]
            HomeAssistant["Home Assistant (LXC)"]
            Nextcloud["Nextcloud (LXC)"]
            Vaultwarden["Vaultwarden (LXC)"]
            Joplin["Joplin (LXC)"]
            Forgejo["Forgejo (LXC)"]
        end

        subgraph Storage [Storage Layer]
            TrueNAS[("TrueNAS ZFS (VM)")]
        end
    end

    ExtNet --> ExtNPM
    ExtNPM --> Router
    Router --> IntNPM

    IntNPM --> Dashy
    IntNPM --> Authentik
    Authentik --> AD
    Authentik --> Vault

    IntNPM --> HomeAssistant
    IntNPM --> Nextcloud
    IntNPM --> Vaultwarden
    IntNPM --> Joplin
    IntNPM --> Forgejo

    HomeAssistant --> TrueNAS
    Nextcloud --> TrueNAS
    Vaultwarden --> TrueNAS
    Joplin --> TrueNAS
    Forgejo --> TrueNAS

    class ExtNet internet;
    class ExtNPM vps;
    class Router,IntNPM,Dashy lan;
    class Authentik,AD,Vault security;
    class HomeAssistant,Nextcloud,Vaultwarden,Joplin,Forgejo apps;
    class TrueNAS storage;

Why this architecture?

1. Perimeter and external access

To avoid exposing my home network directly to the internet and to protect my home IP, I use an approach based on an external VPS that acts as a protective shield.

• External VPS — receives all incoming traffic from the internet
• Nginx Proxy Manager — manages SSL/TLS certificates and redirects traffic securely
• WireGuard tunnel — all traffic validated and filtered on the external VPS is channelled securely and encrypted to the local network through a WireGuard tunnel initiated from home

2. Virtualization platform

Every service in the lab runs on a single bare-metal server managed by Proxmox VE, an open-source Type-1 hypervisor built on Debian. Proxmox lets you run both lightweight containers and full virtual machines from a single web interface, which was the first major technology challenge to master.

• LXC containers — used for most application workloads (Authentik, Nextcloud, Forgejo, Vaultwarden…). They share the host kernel, giving near-native performance at a fraction of the memory overhead of a full VM. Understanding cgroup namespaces, unprivileged containers, and bind mounts for persistent storage was essential.
• KVM virtual machines — used for services that require a dedicated kernel or hardware-level isolation: pfSense (firewall/router), TrueNAS (storage), and the Samba AD DC. Running the AD DC as a VM is critical for stable Kerberos clock synchronisation and avoiding kernel conflicts with the host.
• Proxmox storage — local ZFS pool on the hypervisor for VM disks and container rootfs, with automated snapshots and replication to TrueNAS for off-node backup.

3. Local network and access layer

Once inside the local network, traffic passes through a system structured in distinct logical layers:

• Front Portal (Dashy) — a centralised dashboard giving one-click access to all network services from any internal client
• Internal Ingress — distributes requests within the local network to the appropriate containers and applications

4. Identity and security

This is the most technically demanding part of the homelab, requiring deep familiarity with several interdependent systems. Getting SSO, Active Directory, and secrets management to work together correctly took significant time and learning.

• Samba 4 AD DC — a full Microsoft-compatible Active Directory Domain Controller running on Linux. Samba 4 implements the complete AD protocol stack: Kerberos KDC, LDAP directory, DNS, and SYSVOL. Windows and Linux clients join the domain transparently, enabling centralised group policy and Kerberos-based authentication across the network. Mastering Samba on Linux means understanding DNS delegation, Kerberos realm configuration, LDAP schema, and the subtleties of time synchronisation (a Kerberos hard requirement).
• Authentik — open-source identity provider acting as the SSO gateway for all web applications. It binds to the Samba AD DC via LDAP to inherit users and groups, then exposes them to applications via OIDC/OAuth2. For apps that don't natively support OIDC, Authentik's Forward Auth mode is used: Nginx sends each request to Authentik for validation before proxying it, providing transparent authentication without modifying the application at all.
• HashiCorp Vault — secrets management for the entire environment. Vault's PKI secrets engine acts as the internal Certificate Authority, issuing short-lived TLS certificates for all internal services. The KV engine stores application credentials. Vault's own authentication is federated to Authentik via OIDC, so there is a single identity source for both users and operators.

5. Application layer

The day-to-day services covering productivity, home automation, and personal storage:

• Nextcloud — private cloud for file sync, calendars, and collaboration
• Vaultwarden — lightweight, Bitwarden-compatible password manager
• Joplin Server — self-hosted note sync server
• Home Assistant — home automation brain, integrated with local security and automations
• Forgejo — internal Git host for dotfiles and website source code

6. Storage layer

The physical and backup foundation of the entire system:

• TrueNAS — fault-tolerant mass storage via a ZFS disk pool, running as a KVM VM with direct PCI passthrough to the disk controller for maximum ZFS integrity
• Network protocols — integrates with applications via NFS shares for general data (Nextcloud) and SMB shares authenticated against the Samba AD DC
• Backups — native ZFS snapshots for point-in-time recovery, combined with Proxmox replication for VM-level backups

Conclusion

This architecture lets me enjoy the benefits of public cloud (secure remote access from anywhere) while keeping full control of my data at home. Mastering Proxmox, Samba 4 on Linux, and a full OIDC/Forward Auth SSO stack turned the homelab into a genuine learning environment — and the result is an infrastructure as robust as a small business, at homelab cost.