Homelab
Architecture decisions
Every structural choice is explained in an ADR (Architecture Decision Record) — context, options, decision, consequences. A superseded decision is never erased.
A graphics card handed to the applications VM
An entry-level GeForce is handed whole to the applications VM (PCI passthrough) for photo recognition and video conversion, with a driver maintained by Debian and containers that request it through CDI.
Fleet updates and security watch
Each machine publishes its update status, a nightly watch compares versions and known vulnerabilities, and maintenance is launched in two clicks in Semaphore (announcement, then scheduled update).
An internal certificate authority and verified TLS on internal flows
An internal authority (offline root, intermediate on the firewall) to encrypt and authenticate every flow between machines, and make DNS or ARP spoofing useless.
Intrusion detection and prevention in lightweight layers
Suricata on the firewall, CrowdSec shared by every machine with blocking at the firewall, detection rules on the centralised logs; no heavy SIEM.
Centralised logs with VictoriaLogs, agentless collection
Logs from every machine reach VictoriaLogs on the monitoring VM through mechanisms already in place (journald, syslog), and can be searched in Grafana.
Encrypted off-site backups, focused on what cannot be replaced
Every night, VM exports, photos and files leave encrypted for a 1 TB remote storage; anything that can be copied again from its source is left out.
One group per service, with administration rights and quotas derived from the directory
Access to each service is granted by adding someone to a group; applications' administration rights follow the administrators group; quotas are set from the accounts page.
Inviting people without sending a password, from an accounts page
Accounts are created without a password and the person chooses their own through a one-time link; an administration page, behind the VPN and SSO, replaces the command line.
An OpenBao secrets vault, alongside SOPS
Secrets move into an OpenBao vault (SSO sign-in, identity-based access, audit); SOPS remains the bootstrap store.
Semaphore UI to run Ansible from the homelab
An internal web interface, protected by SSO, runs the versioned playbooks; its access is restricted and verified.
Monitoring with Prometheus, a custom public NOC behind SSO
Prometheus collects, Alertmanager notifies by email and on the phone (ntfy), and a custom page publishes a NOC viewable after authentication.
A custom public site, generated by Hugo and served by the homelab
The portfolio is a static site with its own design, built from docs/ and published through a Cloudflare tunnel.
Nextcloud for file storage
Nextcloud is chosen for the family drive, for its compatibility with every device.
LLDAP directory and Authelia single sign-on
A single LDAP directory for accounts and an SSO portal with two-factor authentication for every published service.
A single server, with a virtualised firewall
The Dell T330 runs the hypervisor, the storage and OPNsense as a VM; no cluster and no bastion host for now.
A single domain, maximebertrand.net
maximebertrand.net is used for everything (showcase site, public services, internal zone), replacing ADR 0004.
Exposing personal services directly behind OPNsense and BunkerWeb
Photos and the drive are published without Cloudflare, through a port forward to a BunkerWeb WAF in the DMZ.
A LAB isolated behind its own firewall
The LAB has its own OPNsense, connected to PROD through a routed transit without NAT.
A low-power mini-PC Proxmox cluster for PROD
Three ThinkCentre Tiny machines in a cluster, with local ZFS and replication, within an energy budget of €40 a month.
OpenTofu and Ansible from day one
No resource created by hand, even if getting started is slower.
Splitting the domains
maximebertrand.eu for the public showcase site, the existing .fr domain for the lab.
OPNsense on a dedicated box, in the DMZ behind the Freebox Pop
The Freebox stays in router mode; a dedicated OPNsense mini-PC receives all inbound traffic in the DMZ.
Public exposure through Cloudflare Tunnel
The showcase site is exposed through an outbound tunnel, with no inbound port open.
The Dell T330 dedicated to storage
The T330 becomes the storage machine (ZFS RAIDZ2, PBS); compute moves to a dedicated cluster.