Homelab Map

Environments

VLANs & Subnets

Network Topology

GFiber (1Gbps) → Unifi UDM → Unifi 16-port PoE Switch
│
├── LenovoMini 1 (Prod Docker) → UnRaid NAS
├── LenovoMini 2 (Test Docker) → Synology NAS
├── ProxMox Host (Dev) → DevDocker VM, DevNode VMs
├── LenovoMini 3–5 (Dev OCP cluster)
├── Intel NUC (Prod management / Komodo Controller)
├── Gaming PC (User)
├── IoT VLAN (Reolink, Google Home)
└── DMZ VLAN (qBittorrent, shared storage mount)

Tailscale Overlay: All nodes

Services & Dependencies

Tailscale Services (on all Docker hosts):

• docktail (logging)
• uptimekuma (monitoring)

Dev Services (ProxMox DevDocker VM):

• Forgejo (Git)
• tsflow (CI/CD)
• Experimental containers

Prod Services shared with Dev (LenovoMini 1 & ProxMox DevDocker VM):

• komga (media)

Test & Prod Services (LenovoMini 1 & LenovoMini 2):

• Signal (chat)
• Vault (secrets)
• tsidp (identity)
• syncthing (file sync)
• scaletail (logging)
• miniflux (RSS)
• transmission (torrent)
• mongodb (database)

Prod-Only Services (LenovoMini 1):

• -arr suite (media automation: Sonarr, Radarr, etc.)
• plex (media server)
• audiobookshelf (audiobook management)

DMZ Services (shared NIC on LenovoMini 1 / ProxMox, or dedicated seed box):

• qBittorrent (torrent client for Internet Archive backups)
• Shared storage mount (NFS from UnRaid NAS for downloaded content — accessible by Prod services)

Intel NUC (10.0.1.0/24) - Komodo Controller
├── Komodo Core (orchestrates)
├── GitHub Runner (executes)
└── → Ansible/Terraform → LenovoMini 1, LenovoMini 2, ProxMox

LenovoMini 1 (Prod)
├── Periphery Agent
├── Docker services
│   ├── komga          ├── transmission   ├── plex
│   ├── uptimekuma     ├── mongodb        ├── sonarr/radarr
│   ├── docktail       ├── miniflux       └── audiobookshelf
│   ├── Signal         ├── scaletail
│   └── Vault/tsidp
└── UnRaid NAS (mounted)

LenovoMini 2 (Test)
├── Periphery Agent
├── Docker services
│   ├── komga          ├── transmission   ├── Signal
│   ├── uptimekuma     ├── mongodb        ├── Vault/tsidp
│   ├── docktail       ├── miniflux       ├── syncthing
│   └── scaletail
└── Synology NAS (mounted)

ProxMox Host (Dev)
├── DevDocker VM
│   ├── Periphery Agent
│   ├── Forgejo (Git)
│   ├── tsflow (CI/CD)
│   └── Experimental containers
└── DevNode VMs (unmanaged sandbox)

DMZ (10.0.5.0/24)
├── Option A: Shared NICs on existing hosts via VLAN tagging
│   ├── LenovoMini 1 (Docker container on DMZ network)
│   └── ProxMox Host (VM with DMZ network)
├── Option B: Dedicated seed box
│   └── MiniPC (qBittorrent, other DMZ services)
└── Shared storage: NFS mount from UnRaid NAS (Prod VLAN)
    └── Firewall exception: allow DMZ → UnRaid NAS (NFS port 2049)

Future

• Guest Network: VLAN (10.0.20.0/24) on Unifi SSID Guest
• Tailscale SSH: Secure remote CLI access to all nodes
• DMZ expansion: Additional public-facing services beyond qBittorrent

Observability (in progress)

Goals and acceptance criteria: observability/status-and-operator-dashboard.md (see also observability/README.md).