Infrastructure

The homelab runs on a single Proxmox hypervisor hosting one VM — OPNsense, the router and firewall — while the workloads themselves live on two bare-metal uCore servers. The guiding principle is reproducibility: the operating system is immutable and image-based, so there is no in-place configuration to drift, and everything above it is provisioned declaratively with Ansible. The hypervisor and both uCore servers are managed that way. The router is the deliberate exception — it is configured through its own web interface, and recovered from backups rather than rebuilt from a definition. For the hosts that are covered, a lost machine could be rebuilt from an Ignition config plus the Ansible repository; there is a written runbook for that path, though it has not yet been exercised on real hardware.

Storage is centralised on a Synology DS920+ and shared to the servers over NFS, which keeps the containers stateless where possible and the bulk data in one place that is itself backed up off-site. The two servers split responsibilities cleanly: monitoring runs the observability stack (Prometheus, Grafana, Loki), and kontti runs the media, AI and application workloads. Both run rootful Podman; the security boundary comes from pinning each container to its own unprivileged UID rather than from a rootless runtime. Why each of these choices was made — immutable OS, Podman over Kubernetes, per-service UID hardening — is documented on the Architecture decisions page.

graph TD
    proxmox[Proxmox hypervisor] --> opnsense[OPNsense VM<br/>router · firewall · DNS]
    opnsense --> monitoring[monitoring<br/>Prometheus · Grafana · Loki<br/>rootful Podman · per-UID]
    opnsense --> kontti[kontti<br/>media · AI · apps<br/>rootful Podman · per-UID]
    opnsense --> nas[Synology DS920+<br/>NFS · backup target]
    kontti -.->|NFS| nas
    monitoring -.->|scrape| kontti
    monitoring -.->|scrape| proxmox
    nas -.->|Hyper Backup| b2[(Backblaze B2<br/>off-site)]