Hypervisor · Proxmox VE
The single host everything runs on, carved into VMs and LXC containers. Each guest carries its own default-deny firewall, so the host isn't the only thing standing between services and the network, and guests stay portable.
Homelab
A Proxmox VE node run with production discipline. Not a pile of containers that happen to work, but infrastructure with backups that get restored, traffic that can't leak, and services that heal themselves after a reboot.
Design decisions
Each of these was a choice with a reason, not a default I inherited.
- Mirrored ZFS vdevs over RAIDZ. Expansion by matched pairs and faster resilver, which matters more to me than raw capacity efficiency.
- Backups are restore-tested. A backup that has never been restored is a hope, not a backup.
- Default-deny nftables inside each guest instead of the cluster firewall. One landmine avoided, and the guests stay portable.
- Download and indexer traffic runs in a VPN network namespace. The apps cannot leak around the tunnel because they have no route that bypasses it. It's structural, not a setting they could ignore.
- TLS terminates at a dedicated reverse proxy. Services are never exposed directly.
- systemd recovery units, so a reboot heals the stack without a human in the loop.
- Netdata monitoring wired into LLM tooling over MCP. The infrastructure is queryable in plain English.
GPU passthrough (an RTX 3070 for NVENC transcoding), nightly image-based backups, and Discord webhook alerting round it out.
Architecture
Select a component to see what it runs and one design decision behind it. With scripting off, every description is listed below the diagram.
Tip: click a box, or focus it and press Enter.
Select a component to see what it runs and one design decision.
Media VM · GPU passthrough
Runs media playback and transcoding with an RTX 3070 passed through for NVENC. The GPU belongs to this VM alone, so transcoding never has to fight the rest of the stack for it.
Proxy VM · Caddy
All TLS terminates here and every service sits behind it. Nothing is exposed to the network directly, so there's one front door to harden instead of a dozen.
Requests LXC
The front door for "add this to the library" requests, kept separate from the apps that actually fetch and organize media. A blast-radius decision: the public-facing piece can't reach the tooling directly.
Dashboard LXC
A single overview of the stack's health and quick links, so checking on things doesn't mean remembering ports and addresses.
Docker LXC · VPN namespace
Runs the download and indexer apps. Their outbound traffic is locked into a VPN network namespace (gluetun), so the apps have no route that bypasses the tunnel. It's structural: there's nothing for them to misconfigure around.
Monitoring · Netdata
Per-second metrics across the node, wired into LLM tooling over MCP. I can ask about the infrastructure's health in plain English and get real numbers back instead of guessing.
ZFS storage · mirrored vdevs
Mirrored vdevs rather than RAIDZ: expansion by matched pairs and faster resilvering. Backups run nightly and get restore-tested, because a backup that's never been restored is a hope, not a backup.
what it demonstrates
Virtualization, storage design, network segmentation, backup discipline, Linux operations, and AI-augmented operations. Same control mindset as the day job, applied at home.