At a glance
Three Proxmox VE nodes form a cluster running 80+ LXCs and VMs. Block storage for workloads sits on replicated Ceph; bulk user data (media, photos, Nextcloud) on TrueNAS ZFS over NFS. Inbound traffic passes through Cloudflare, terminates at a reverse proxy, and authenticates via Authentik where required. Proxmox Backup Server snapshots systems on-site; library data and PBS archives replicate to Cloudflare R2 offsite.
Physical layer
| Component | Role |
|---|---|
| Dell5820 | Primary node — most services, GPU for Plex/Jellyfin/AI |
| DellPrecision | Second cluster node — capacity and failover |
| ryzen7-pve | Hosts TrueNAS & PBS VMs (storage hardware passthrough) |
| Network gear | Omada router/AP, managed switch, UPS monitoring |
How a web request flows
- You open
drive.nbottini.com(Nextcloud). - DNS (Pi-hole at home, Cloudflare from outside) resolves the name.
- Traffic hits NPMplus on port 443 with a valid TLS certificate.
- Authentik enforces login where the app lacks native OIDC (forward authentication at the proxy).
- Proxy forwards to the Nextcloud container on the LAN.
- Files come from TrueNAS over NFS if needed.
Non-HTTP workloads (e.g. TAK Server on TCP 8089) bypass the HTTP proxy by design; the layered model above applies to the majority of web-facing services.
Service categories
| Category | Examples |
|---|---|
| Platform | Pi-hole, NPMplus, Authentik, Cloudflare Tunnel |
| Family cloud | Nextcloud, Immich, Matrix, Jellyfin/Plex |
| Ops | Ansible/Semaphore, Portainer, BookStack, Gitea |
| Observability | Prometheus, Grafana, Uptime Kuma, Wazuh |
| Media pipeline | Radarr, Sonarr, *arr helpers (automated library) |
| AI | Ollama + Open WebUI (local LLM on GPU) |
Browse live tiles at home.nbottini.com (access may require invite).
Storage design
- Ceph (vmstore) — replicated disks for every VM/LXC; survives a node loss within configured limits.
- TrueNAS — ZFS pools for media, Immich photos, Nextcloud files, and downloads via NFS.
- PBS — scheduled on-site backups of VMs/containers with deduplication; restore path for disasters.
- Cloudflare R2 (offsite) — automated copies of bulk libraries and PBS backups outside the home rack.
For the user-facing explanation (what this means for Immich/Nextcloud), see How we protect your data.
Security model (summary)
- Minimal WAN exposure — default-deny at the edge; only 443 to NPMplus (plus TAK 8089 where the client protocol requires it). Cloudflare WAF/Access on selected apps.
- Identity & access — Authentik SSO with group-scoped entitlements; forward-auth at the proxy for apps without native OIDC.
- Secrets handling — Vaultwarden for API tokens, break-glass accounts, and rotation targets; Ansible and docs reference secret stores, never inline values.
- Host baseline — key-only SSH, fail2ban, and repeatable hardening profiles pushed via Ansible across nodes.
- Assume breach — continuous vuln scanning (Greenbone) and SIEM (Wazuh) on internet-facing services; Pi.Alert for rogue LAN devices.
Separate test environment
A Mini-Rack cluster (four Proxmox nodes on a different subnet) exists for experiments and training — isolated from production Main-Cluster.