The
infrastructure
stack
| Nodes | 4 · Proxmox VE 9.1 |
| SIEM agents | 9 · Wazuh 4.11.2 |
| SSO providers | 5 · Authentik OIDC |
| Public routes | 7 · no inbound ports |
Services
- Proxmox VE Cluster online
-
Four nodes running Proxmox VE 9.1 with Ceph distributed storage across all of them. HA-capable, with VMs and LXC containers spread across the cluster. PBS takes nightly backups to the Synology NAS.
- Wazuh SIEM online
-
Wazuh 4.11.2 as a VM, with 9 agents reporting in. OPNsense forwards firewall events over syslog. The SOC dashboard is the default view, so alerts, agent health, and the event timeline are all on one screen.
- Authentik SSO online
-
Authentik in Docker, with OIDC providers for Homarr, Grafana, AdGuard Home, Nginx Proxy Manager, and all four Proxmox nodes. One login for the whole stack.
- Grafana · Prometheus online
-
Prometheus scrapes Node Exporter on all four Proxmox nodes. Grafana charts CPU, memory, disk, and network per node, behind Authentik SSO.
- NPM · Cloudflare Tunnel online
-
Nginx Proxy Manager reverse-proxies every internal service. Cloudflare Tunnel carries the 7 public routes, so nothing is exposed by an inbound port forward. Certificates come from Let's Encrypt over the Cloudflare DNS-01 challenge.
- PBS · Synology NAS online
-
Proxmox Backup Server runs nightly against every VM and container, writing to the Synology over NFSv3. Retention is keep-last=3, and verification jobs re-read the chunks rather than trusting that the job exited zero.
- OPNsense Firewall online
-
OPNsense on bare metal at the network edge. It owns the firewall rules and the VLAN split between the lab and the personal network, and ships its logs to Wazuh over syslog.
- Immich online
-
Self-hosted photo library in an LXC container, syncing from two phones. Storage moves to the Synology next. It replaced Google Photos here.
- Uptime Kuma online
-
Uptime Kuma in Docker, watching 12 monitors across the cluster, the firewall, the NAS, and every service on this page. It also publishes the public status page, which is where the states in this list are read from.
These states are live, polled by my own Uptime Kuma instance. See the status page.
Hardware
| Role | Device | Spec |
|---|---|---|
| Firewall | OPNsense (Baremetal) | Edge · WAN → LAN · VLAN · syslog |
| Core Switch | Dell PowerConnect 2824 | 24-port managed · uplink to OPNsense |
| Lab Switch | Luxul XMS-2624P | 26-port PoE managed · lab segment |
| Proxmox Nodes | 4-Node Cluster | PVE 9.1 · Ceph · all on Luxul switch |
| NAS | Synology NAS | PBS backup target · NFSv3 · lab switch |
| Access Point | Wireless AP | Off Dell core switch · personal devices |
Running right now
This is not a lab that gets switched on for screenshots. It runs continuously, takes real updates, occasionally breaks, and gets fixed. The writeups cover how each piece is built and what broke on the way there.