Infrastructure

The homelab runs on a single Proxmox hypervisor hosting one VM — OPNsense, the router and firewall — while the workloads themselves live on two bare-metal uCore servers. The guiding principle is reproducibility: the operating system is immutable and image-based, so there is no in-place configuration to drift, and everything above it is provisioned declaratively with Ansible. The hypervisor and both uCore servers are managed that way, and since September 2026 most of the router is too — its DNS, DHCP, reverse proxy and traffic shaper are declared over its API, while the HTTPS front end and the certificate chain stay deliberately in its own web interface and are recovered from backups rather than rebuilt from a definition. For the hosts that are covered, a lost machine could be rebuilt from an Ignition config plus the Ansible repository; there is a written runbook for that path, though it has not yet been exercised on real hardware.

Storage is centralised on a Synology DS920+ and shared to the servers over NFS, which keeps the containers stateless where possible and the bulk data in one place that is itself backed up off-site. The two servers split responsibilities cleanly: monitoring runs the observability stack (Prometheus, Grafana, Loki), and kontti runs the media, AI and application workloads. Both run rootful Podman; the security boundary comes from pinning each container to its own unprivileged UID rather than from a rootless runtime. Why each of these choices was made — immutable OS, Podman over Kubernetes, per-service UID hardening — is documented on the Architecture decisions page.

graph TD
    proxmox[Proxmox hypervisor] --> opnsense[OPNsense VM<br/>router · firewall · DNS]
    opnsense --> monitoring[monitoring<br/>Prometheus · Grafana · Loki<br/>rootful Podman · per-UID]
    opnsense --> kontti[kontti<br/>media · AI · apps<br/>rootful Podman · per-UID]
    opnsense --> nas[Synology DS920+<br/>NFS · backup target]
    kontti -.->|NFS| nas
    monitoring -.->|scrape| kontti
    monitoring -.->|scrape| proxmox
    nas -.->|Hyper Backup| b2[(Backblaze B2<br/>off-site)]