The Lab
A personal datacenter running production-grade systems — because security engineers should practice what they preach.
Infrastructure Overview
A full-stack lab: two hypervisors, a DGX Spark for local AI inference, a 70 TB NAS, network segmentation, and monitoring at every layer.
Compute
Two Proxmox hypervisors plus an NVIDIA DGX Spark for local AI inference.
- 2 Proxmox VE hypervisors
- AMD Ryzen 9 5950X, ~126 GB RAM
- AMD Ryzen 9 7950X, ~124 GB RAM
- NVIDIA DGX Spark (GB10, 121 GB unified memory) serving a local 27B model via vLLM + LiteLLM
- VMs + LXC containers
Storage
Synology NAS with redundant parity and NVMe caching.
- Synology DS1821+ (8-bay)
- 70 TB raw capacity
- SHR-2 dual parity RAID
- NVMe read/write cache
- NFS + SMB for services
Network
Full UniFi SDN stack: gateway, switching, and Wi-Fi.
- UniFi Dream Machine Pro Max
- 2 managed PoE switches
- 6 WiFi access points
- 8 segmented networks (VLANs)
- IPS/IDS + DPI enabled
Kubernetes Cluster
A 9-node K3s cluster running ~245 pods with ArgoCD GitOps for fully declarative, version-controlled deployments.
Cluster Topology
High-availability control plane with dedicated worker nodes for different workload types.
GitOps with ArgoCD
Every workload is defined in Git and automatically synced. No manual kubectl applies, no drift.
- All manifests version-controlled in GitHub
- Auto-sync with self-healing enabled
- Application-of-applications pattern
- Secrets managed via sealed-secrets
Workload Types
- Deployments & StatefulSets
- CronJobs for scheduled tasks
- DaemonSets for node agents
- Jobs for one-off operations
Networking
- Traefik IngressRoute CRDs
- MetalLB for LoadBalancer IPs
- CoreDNS for service discovery
- Network policies per namespace
Storage
- NFS CSI driver for persistent volumes
- Local path provisioner
- Synology NAS backing store
- Volume snapshots for backups
Network Architecture
Eight segmented networks managed by a UniFi gateway, which also serves internal DNS.
Wireless
- 6 UniFi WiFi 6E access points
- Band steering & fast roaming
- Per-SSID VLAN assignment
- Enterprise WPA3 for management
Switching
- 2 managed PoE+ switches
- 802.1Q VLAN trunking
- STP with root guard
- IGMP snooping for multicast
DNS & Proxy
- UniFi gateway (internal DNS)
- Cloudflare DNS (external)
- Traefik reverse proxy with auto HTTPS
- Tailscale VPN (dual HA routers)
Security Stack
Defense in depth: network segmentation, endpoint monitoring with Wazuh, blocking at three layers (UniFi, CrowdSec, Cloudflare edge), and a highly available credential vault.
Wazuh SIEM
Full security information and event management platform with 27 agents across infrastructure hosts. Centralized log analysis, vulnerability scanning, file integrity monitoring, rootcheck, and security configuration assessment.
Camera Surveillance
Frigate NVR with 7 cameras on an isolated camera VLAN. Object detection runs on a Coral EdgeTPU; an NVIDIA RTX 3080 Ti handles video decode and local vision-LLM descriptions of events (Ollama). Person, vehicle, and animal detection with zone-based alerting and 24/7 recording.
Network Security
UniFi IPS/IDS with deep packet inspection at the gateway. Country-based geo-blocking, content filtering, and real-time threat intelligence feeds.
Three-Layer Blocking
Wazuh detections trigger blocks at the UniFi firewall, in CrowdSec, and at the Cloudflare edge. Cloudflare WAF rules are managed automatically across 18 zones, with expiring IP blocks and merge-safe rule updates.
Credential Vault
A 3-node OpenBao cluster (Raft storage, auto-unseal) tolerates the loss of one node and holds the AI platform's credentials, with SSO for human logins and drift detection.
Certificate Management
Automated TLS certificate provisioning via Let's Encrypt with Traefik. Wildcard certificates for internal services, auto-renewal, and HTTPS everywhere.
Security Principles
- Zero trust by default
- Least privilege access
- Network segmentation
- Defense in depth
- Continuous monitoring
- Automated remediation
- Encrypted at rest & in transit
- Regular vulnerability scans
- Incident response playbooks
- Audit logging on everything
Monitoring & Observability
Full observability stack with metrics, alerting, and dashboards for every layer of the infrastructure.
Prometheus
Time-series metrics database scraping every host, service, and application in the stack.
- Custom scrape configs per service
- Node Exporter on all hosts
- Service-specific exporters
- Long-term retention
Grafana
Visualization platform with custom dashboards for every subsystem in the lab.
- Infrastructure dashboards
- Network traffic analytics
- K3s cluster health
- Application-specific views
Alerting
PrometheusRule-based alerting with multi-channel notification delivery.
- CPU, memory, disk alerts
- Service health checks
- Network anomaly detection
- Discord + Telegram notifications
What Gets Measured
- Host CPU, memory, disk I/O, network
- K3s pod resource consumption
- NAS disk health & utilization
- Camera stream health & FPS
- Traefik request rates & latency
- Wazuh alert frequency
- Cloudflare edge traffic & firewall events
- UPS battery status
Alert Conditions
- CPU sustained above 90% for 5 minutes
- Memory usage above 85%
- Disk usage above 80%
- Pod restart count exceeds threshold
- Service endpoint unreachable
- SSL certificate expiry within 14 days
- SIEM critical event detected
- NAS disk health degradation
Services Catalog
~245 pods running across 9 Kubernetes nodes. Services are deployed via ArgoCD GitOps and monitored by Prometheus.
Media & Entertainment
Plex
Media streaming server with hardware transcoding and remote access
Sonarr
TV series management and automated download orchestration
Radarr
Movie collection management with quality profiles and upgrades
Lidarr
Music library management and automated acquisition
Prowlarr
Unified indexer manager for all media automation services
Overseerr
Request management portal for media library additions
Home Automation
Home Assistant
Central home automation hub with 200+ entities across lighting, climate, and sensors
Node-RED
Visual flow-based automation for complex multi-service workflows
Zigbee2MQTT
Zigbee device bridge supporting 50+ devices without vendor lock-in
WLED
Addressable LED controller for ambient and accent lighting effects
Security & Surveillance
Wazuh SIEM
Security information and event management with 27 monitored agents
Frigate NVR
NVR with object detection on a Coral EdgeTPU; the RTX 3080 Ti handles video decode
CrowdSec
Behavior-based detection and IP bans behind Traefik, alongside the Cloudflare WAF
Monitoring & Observability
Prometheus
Time-series metrics collection with custom scrape configs for every host
Grafana
Visualization dashboards for infrastructure, network, and application metrics
Alertmanager
Alert routing and notification delivery via Discord, Telegram, and email
AI & Automation Platform
Thor MCP Server
Custom AI management platform with 490+ tools across 45 tool groups
Discord Bot
AI-powered bot for infrastructure management via slash commands
Telegram Bot
Mobile-first infrastructure control and monitoring
Ollama
Local vision-LLM on the RTX 3080 Ti that writes descriptions of camera events
vLLM + LiteLLM
Self-hosted 27B model on an NVIDIA DGX Spark, the last-resort provider in Thor's LLM failover chain
Documents & Productivity
Paperless-NGX
Document management system with OCR, tagging, and full-text search
Vikunja
Task management and project tracking with Kanban boards
Infrastructure & Networking
Traefik
Reverse proxy and ingress controller with automatic Let's Encrypt certificates
ArgoCD
GitOps continuous deployment for all Kubernetes workloads
Cloudflare DNS
External DNS management with DDoS protection and CDN
Tailscale VPN
Zero-config mesh VPN with dual subnet routers for high availability
AI Management Platform
A custom-built AI platform (Thor) that manages the lab through 490+ MCP tools, 13 specialized agents plus 2 review roles, and multi-channel interfaces.
Thor MCP Server
Model Context Protocol server providing AI assistants with direct access to every system in the infrastructure. Built on Claude AI with Anthropic's SDK.
- 490+ tools across 45 tool groups
- Proxmox, K3s, NAS, network, DNS control
- Security scanning & SIEM integration
- Media stack management
- Home automation control
- Monitoring & alerting management
Agent Architecture
13 specialized AI agents plus 2 review roles, each with scoped tool access and domain expertise. Hot-reloadable registry with persistent memory.
- Thor (Overseer) — primary coordinator
- Heimdall — security monitoring
- Jarvis — infrastructure management
- Ada — home automation
- Apollo — media stack
- Offsec — pentesting & red team
- + 7 more specialized agents
Interfaces
- Claude Code CLI (primary)
- Discord bot with slash commands
- Telegram bot for mobile
- Web dashboard (HTMX + Hono)
Memory System
- Vector embeddings for semantic search
- Daily logs & session tracking
- Topic-based knowledge base
- Incident history & resolution
AI Hardware
- NVIDIA DGX Spark (GB10, 121 GB unified)
- Local 27B model via vLLM + LiteLLM
- RTX 3080 Ti: video decode + Ollama vision-LLM
- Coral EdgeTPU for camera object detection
Platform Engineering Highlights
- 3-node OpenBao HA credential vault (Raft, auto-unseal)
- Cloudflare WAF automation across 18 zones: Wazuh detections trigger blocks at UniFi, CrowdSec and the Cloudflare edge
- Tiered auto-remediation engine: pattern library, LLM risk judge, tiers A/B/C, circuit breakers, and post-fix verification
- LLM failover chain Claude → Codex → self-hosted Qwen on the DGX Spark, with active health probes and breakers
- Observability by default: every service ships Prometheus metrics, alert rules, and a Grafana dashboard
Maker Space
Beyond software: a workshop for physical prototyping, custom fabrication, and creative projects.
Laser Cutting
40W diode laser for cutting and engraving wood, acrylic, leather, and more. Enclosed workspace with exhaust filtration.
Fiber & Diode Laser
Dual-laser system (fiber + diode) for engraving metals, plastics, wood, and stone. High-speed galvo marking.
FDM 3D Printing
Multi-material FDM printer with AMS (Automatic Material System). Carbon fiber, PETG, TPU, and 16-color prints.
Resin 3D Printing
16K resolution MSLA resin printer for ultra-detailed miniatures, prototypes, and jewelry molds.
UV Printing
Desktop UV printer for full-color, raised-texture prints directly onto wood, acrylic, metal, leather, and other flat or curved surfaces.
Vinyl Cutting
Precision cutting machine for vinyl, paper, fabric, and thin materials. Custom stickers, decals, and craft projects.
By the Numbers
The scale of a personal infrastructure, measured.
Built to Learn, Secured to Last
This homelab is a living platform for continuous learning in security, infrastructure, and automation.
Get in Touch Back to Resume