Everything as code
No machine or rule created by hand. OpenTofu describes the infrastructure, Ansible configures it; a second run must change nothing.
Homelab · Infrastructure as Code
A personal infrastructure, run like production.
One server, one firewall, sealed network zones and services my family uses every day. Everything is described as code, reviewed before it is applied, and documented — mistakes included.
$ tofu plan ✓ No changes. Your infrastructure matches the configuration.
$ ansible-playbook plateforme.yml ✓ changed=0 failed=0
$ curl -I https://photos.… ✓ WAF → SSO → application · TLS verified
$ netbox-synchro --simulation ✓ 0 created, 0 modified
$
1
server
hypervisor, storage and firewall
7
network zones
everything between them denied by default
100 %
as code
machines, firewall, DNS, services
2FA
wherever possible
single sign-on portal
Defence in depth
The path of a request
Each layer stops what the previous one let through. If one gives way, the next one holds.
- 1 Internet A single inbound port, no other door open.
- 2 Firewall Forwards only to the WAF, isolates every zone.
- 3 WAF OWASP rules, geo-filtering, rate limiting.
- 4 SSO One directory, two-factor authentication.
- 5 Application In its own zone, with no access to the rest.
Method
Four principles, applied everywhere
Minimal exposure
Anything public goes through a firewall, a WAF and a sign-in portal. Administration is reachable only over VPN.
Sealed zones
Each service lives in its own zone. A compromise stays contained; every allowed flow is justified in a matrix.
Everything can be restored
Automatic snapshots, encrypted and versioned secrets, written procedures — so nothing depends on memory or on a single person.
Tools
The tech stack
Open-source tools, each chosen for a written reason — the ADRs explain every choice.
Hypervisor & storage
- Proxmox VE
- ZFS RAIDZ2
- virtiofs
- sanoid
- restic
Network & security
- OPNsense
- WireGuard
- BunkerWeb
- CrowdSec
- DNSSEC
Identity & secrets
- LLDAP
- Authelia
- OpenID Connect
- WebAuthn
- OpenBao
Infrastructure as Code
- OpenTofu
- Ansible
- SOPS + age
- GitHub Actions
Services & monitoring
- Docker Compose
- Traefik
- Let's Encrypt
- NetBox
- Prometheus
- Grafana
- VictoriaLogs
Publishing
- Cloudflare DNS
- Cloudflare Tunnel
- Hugo
Decisions
Latest decisions
- 0024 A graphics card handed to the applications VM accepted
- 0023 Fleet updates and security watch accepted
- 0022 An internal certificate authority and verified TLS on internal flows accepted
- 0021 Intrusion detection and prevention in lightweight layers accepted
- 0020 Centralised logs with VictoriaLogs, agentless collection accepted
- 0019 Encrypted off-site backups, focused on what cannot be replaced accepted
Journal
Along the way
-
Login watch, and the WAF again
An alert when login attempts come from an address never seen to succeed, without noise from 5G; dashboards fixed; and a night when the WAF was killed 139 times.
-
A fifth disk, then a disk replaced
Full burn-in of a second-hand disk, RAIDZ2 expanded from 4 to 5 disks without downtime, then a disk with growing bad sectors replaced, with no free bay.
-
Security audit, fleet updates and email
A black-box and grey-box audit, schedulable updates for the whole fleet with vulnerability watch, readable logs, and emails that finally get past the filters.
-
Group-based access, quotas and documentation in the homelab's colours
Access to each service is granted by ticking a group, administration rights follow the directory, and allocated space is set from a single page.