DNS — name resolution
DNS (Domain Name System) maps hostnames to IP addresses. When you open grafana.example.com, a resolver walks the DNS hierarchy and returns an address like 192.168.0.18 that your client can reach.
Internally, Pi-hole handles split-horizon resolution: ad blocking, local overrides (*.home.lan), and upstream forwarding. Externally, authoritative records at Cloudflare publish how the world reaches services on this network.
Reverse proxy — centralized ingress
A reverse proxy terminates inbound connections and routes them to backend services by hostname, path, or header. One public IP and HTTPS on port 443 can front dozens of apps without exposing each container directly.
photos.example.com and music.example.com share the same edge address; the proxy selects the correct upstream from the Host header.
Here, NPMplus (Nginx Proxy Manager) is the ingress layer — TLS termination, routing rules, and certificate lifecycle (Let's Encrypt).
Distinct from: a VPN tunnel or a forward proxy (outbound filtering). Those solve different problems.
VPN — encrypted tunnel between networks
A VPN (Virtual Private Network) encapsulates traffic in an encrypted tunnel between endpoints. Typical homelab patterns:
- Remote access — join the home LAN remotely with the same reachability as on-site
- Egress isolation — route specific workloads through a different exit IP without sending all household traffic through the tunnel
- Site-to-site — link two locations as if they shared a private network
This lab uses WireGuard for selective container egress (e.g. download clients) with kill switches — if the tunnel drops, affected traffic stops rather than falling back to the home WAN IP.
TLS / HTTPS — encryption and server identity
HTTPS is HTTP over TLS. The handshake encrypts the session and validates the server's identity via an X.509 certificate chained to a trusted CA — here, mostly Let's Encrypt through the reverse proxy.
Internal services may use a private CA or self-signed certs; clients must trust that root explicitly. Public-facing apps always terminate TLS at the edge with publicly trusted certificates.
Firewalls & ports
A firewall enforces allow/deny rules on traffic by source, destination, protocol, and port. Common ports: HTTPS 443, SSH 22, DNS 53.
Default deny at the perimeter: expose only what must be reachable from the WAN. This lab keeps inbound exposure narrow — primarily 443 to the reverse proxy — and uses Cloudflare where additional edge filtering helps.
Containers vs virtual machines
A VM runs a full guest OS on emulated hardware — strong isolation, higher overhead. Used here for storage appliances (TrueNAS, PBS), Windows workloads, and anything that needs its own kernel.
A container shares the host kernel with cgroup/namespace isolation — lower overhead, faster lifecycle. LXC on Proxmox hosts most services; Docker appears where upstream packaging expects it.
SSO — centralized identity
Single Sign-On delegates authentication to an identity provider — here, Authentik — so Grafana, Portainer, and other apps trust a single login session via OIDC or forward-auth at the proxy.
Group-based entitlements control who reaches which service. Revoking one identity disables access everywhere instead of chasing per-app credentials.
Backups & the 3-2-1 rule
3-2-1: three copies, two media types, one offsite (separate failure domain). Replication — Ceph, RAID, sync — is not backup; it propagates deletes and corruption as faithfully as good data.
This lab uses Proxmox Backup Server for VM/LXC snapshots, TrueNAS ZFS for large user libraries (photos, Nextcloud files), and automated sync of both paths to Cloudflare R2 for the offsite copy. Read the full walkthrough: How we protect your data.
IP addressing & LAN basics
Internal hosts use RFC 1918 addresses (192.168.x.x, 10.x.x.x). The router performs NAT so many private hosts share one public IPv4 address outbound.
Infrastructure services (DNS, proxy, storage) get static assignments so restarts and DHCP leases do not break dependencies. SSH on port 22 with key-based auth is the standard remote admin path for Linux hosts.