diff --git a/README.md b/README.md index c134812..532d3c4 100644 --- a/README.md +++ b/README.md @@ -1,281 +1,259 @@ -# 🧠 Ced’s HomeLab (Enterprise Infrastructure & Monitoring Lab) +# Ced's HomeLab β€” Live Infrastructure & Observability Platform -> A production-style infrastructure lab showcasing real-world systems engineering, monitoring, and platform operations. +> A production-style homelab running real infrastructure, real workloads, and a live NOC dashboard β€” built by a Digital Systems Engineer at GE Aerospace who needed a place to practice what he preaches. -This environment functions as a **personal datacenter**, combining virtualization, Kubernetes orchestration, observability, and secure external access. +[![Live NOC](https://img.shields.io/badge/Live%20NOC-noc.chasedumphord.com-1D9E75?style=flat-square)](https://noc.chasedumphord.com) +[![Portfolio](https://img.shields.io/badge/Portfolio-chasedumphord.com-0F6E56?style=flat-square)](https://chasedumphord.com) +[![Nodes](https://img.shields.io/badge/Nodes-12%20K3s%20%2B%206%20Proxmox-085041?style=flat-square)](#infrastructure-layer) +[![VLANs](https://img.shields.io/badge/VLANs-4%20Segments-1D9E75?style=flat-square)](#network--vlan-architecture) --- -## πŸš€ What This Lab Demonstrates +## Why I Built This -- Infrastructure design (Proxmox + virtualized services) -- Kubernetes orchestration (12-node K3s cluster) -- Network segmentation (VLAN architecture) -- Monitoring & observability (Grafana, Prometheus, Uptime Kuma) -- Secure service exposure (Cloudflare Tunnels + reverse proxy) -- Real-world system integration (data, services, automation) +I work on the Digital Team at GE Aerospace building data pipelines, dashboards, and digital inspection systems. Every day I'm working with production infrastructure where downtime has real consequences β€” and I needed a lab environment that could keep up with that. -## πŸ”₯ Featured Project: SOC Lab +This isn't a tutorial setup. Every service running here solves a real problem, every VLAN exists for a real reason, and every monitoring alert has a real threshold. I built this the same way I build at work: start with architecture, document as you go, and make it observable from day one. -A focused project within this homelab that demonstrates monitoring, logging, and security concepts. - -πŸ‘‰ [View SOC Lab Project](soc-lab/README.md) ---- - -## πŸ—οΈ Architecture Overview - -This lab is built around three core layers: - -### πŸ–₯️ Infrastructure Layer -- Proxmox VE hypervisor -- Virtual Machines + LXC containers -- TrueNAS storage backend (ZFS, NFS, SMB) - -### ☸️ Orchestration Layer -- 12-node K3s Kubernetes cluster -- Workload segmentation (ingress, data, monitoring) -- MetalLB + NGINX ingress - -### 🌐 Access & Networking Layer -- VLAN segmented network (UDR) -- Nginx Proxy Manager -- Cloudflare Tunnel (zero port-forwarding) +**What this lab is for:** +- Practicing infrastructure patterns I apply directly at GE +- Building a live, always-on NOC that demonstrates real observability skills +- Running workloads that would otherwise require expensive cloud resources +- Documenting systems well enough that anyone can understand them --- -## 🎯 Purpose +## Architecture Overview -This lab is designed to: +```mermaid +graph TB + subgraph Internet + CF[Cloudflare Edge] + end -- Simulate production-style environments -- Build hands-on infrastructure experience -- Develop monitoring and system visibility skills -- Serve as a real-world engineering portfolio project + subgraph Access Layer + TUNNEL[Cloudflare Tunnel] + NPM[Nginx Proxy Manager] + end ---- + subgraph Network - UniFi UDR + MAIN[Main VLAN
10.10.10.0/24] + IOT[IoT VLAN
10.10.20.0/24] + LAB[HomeLab VLAN
10.10.30.0/24] + GUEST[Guest VLAN
10.10.99.0/24] + end -## πŸ“Έ Key System Views + subgraph Compute - Proxmox VE + PVE[Proxmox Hypervisor
VMs + LXC Containers] + HA[Home Assistant VM] + SERVICES[Service VMs] + end -### πŸ–₯️ Proxmox Infrastructure -![Proxmox](screenshots/proxmox-overview.png) + subgraph Orchestration - K3s + CTRL[Control Plane] + W1[Worker Node x4] + W2[Worker Node x4] + W3[Worker Node x4] + end -### πŸ–₯️ Proxmox Workloads -![Proxmox](screenshots/proxmox-overview2.png) + subgraph Storage - TrueNAS + ZFS[ZFS Pool] + NFS[NFS Exports] + SMB[SMB Shares] + end -### ☸️ K3s Cluster Nodes & Pods -![K3s Nodes](screenshots/K3s-nodes.png) + subgraph Observability - Ced's NOC + PROM[Prometheus] + GRAF[Grafana] + KUMA[Uptime Kuma] + NODE[Node Exporter] + BLACK[Blackbox Exporter] + end -### 🌐 Reverse Proxy (Nginx Proxy Manager) -![Nginx](screenshots/NGN.png) - -### πŸ“Š Service Monitoring (Uptime Kuma) -![Uptime Kuma](screenshots/uptime-kuma.png) - -### πŸ“Š Grafana Dashboard -![Grafana](screenshots/grafana.png) - -### πŸ“Š Grafana Dashboard -![Grafana](screenshots/grafana2.png) - ---- - -## 🌐 Network & VLANs - -The lab runs behind a UniFi Dream Router (UDR) with VLAN segmentation: - -| Network | Subnet | Purpose | -|--------|--------|--------| -| Main | 10.10.10.0/24 | Daily-use devices | -| MyHomeIOT | 10.10.20.0/24 | IoT devices, TVs, consoles | -| HomeLab | 10.10.30.0/24 | Servers, services, K3s, storage | -| Guest | 10.10.99.0/24 | Guest Wi-Fi | - -The HomeLab VLAN (10.10.30.0/24) hosts all core infrastructure. - ---- - -## 🧱 Core Components - -### πŸ–₯️ Proxmox VE -- Main hypervisor for VMs and LXCs -- Future expansion to a Proxmox cluster (+5 nodes) -- Uses TrueNAS for shared storage (NFS / iSCSI) -πŸ“ See: `proxmox/` - ---- - -### πŸ’Ύ TrueNAS (ZFS Storage) -- Manages ZFS pools and datasets -- NFS exports for Proxmox VM storage -- SMB / media dataset for Jellyfin & Arr stack -πŸ“ See: `truenas/` - ---- - -### ☸️ K3s Raspberry Pi Cluster -A 12-node K3s cluster built on Raspberry Pi hardware for orchestrating containerized workloads across the lab. - -Current and planned uses include: - -- Containerized applications -- Ingress-based routing -- Monitoring workloads -- Future GitOps and Helm-based deployments - -πŸ“Œ Full cluster repo: -https://github.com/ced4568/ced-k3s-homelab - ---- - -### 🌐 Reverse Proxy & Cloudflare Tunnel -- Nginx Proxy Manager (NPM) -- Cloudflare Tunnel (no port forwarding) -- Wildcard DNS: `*.cedshomelab.com` - -**Traffic Flow:** -Internet β†’ Cloudflare Edge β†’ Tunnel β†’ NPM β†’ Internal Services - -πŸ“ Docs: `docs/Add_New_Service_Guide.md` - ---- - -### 🏠 Home Automation -- Home Assistant (Proxmox VM) -- IoT isolated on MyHomeIOT VLAN -- Secure access via Cloudflare + NPM -- `trusted_proxies` configured - -πŸ“ Config: `home-assistant/` - ---- - -### πŸ“Š Observability (Ced’s NOC) - -The lab includes an observability stack built around: - -- Prometheus for metrics collection -- Grafana for dashboards and visualization -- Uptime Kuma for service-level monitoring - -Current and planned monitoring coverage includes: -- Proxmox performance -- K3s cluster health -- Service uptime -- Infrastructure visibility improvements over time - -πŸ“ See: `monitoring/` - ---- - -## πŸ“Š Live NOC & Automation Pipeline - -The homelab powers a public-facing live NOC dashboard at **noc.chasedumphord.com**. - -An automated Python script runs on Biggie (Proxmox node 10.10.30.192) every 5 minutes via cron. It pings all 28 systems, records latency and online/offline status, writes a structured JSON file, and pushes it to GitHub. The dashboard updates automatically. - -```text -Biggie (10.10.30.192) β€” cron: */5 * * * * - β†’ noc_update.py - β†’ ICMP ping 28 systems - β†’ record latency + status - β†’ write data/noc-status.json - β†’ git commit + push to ced-portfolio - β†’ GitHub Pages deploys (~30s) - β†’ noc.chasedumphord.com auto-refreshes + CF --> TUNNEL --> NPM + NPM --> LAB + LAB --> PVE + LAB --> CTRL + PVE --> ZFS + ZFS --> NFS --> PVE + CTRL --> W1 & W2 & W3 + NODE --> PROM + BLACK --> PROM + PROM --> GRAF + KUMA --> GRAF ``` -- Script: `~/scripts/noc_update.py` on Biggie -- Log: `/var/log/noc_update.log` -- NOC source: https://github.com/ced4568/ceds-noc -- Live dashboard: https://noc.chasedumphord.com +--- + +## Infrastructure Layers + +### Infrastructure Layer β€” Proxmox VE + +The hypervisor layer runs on a dedicated server hosting all VMs and LXC containers. TrueNAS provides centralized ZFS storage with NFS exports for VM disk images and SMB shares for media workloads. + +| Component | Role | +|-----------|------| +| Proxmox VE | Primary hypervisor β€” VMs and LXC containers | +| TrueNAS | ZFS storage backend β€” NFS for Proxmox, SMB for media | +| Home Assistant | IoT automation, isolated on its own VLAN | + +πŸ“ Configs: [`proxmox/`](./proxmox/) Β· [`truenas/`](./truenas/) Β· [`home-assistant/`](./home-assistant/) --- -## πŸ–₯️ Full Node Inventory (28 Systems) +### Orchestration Layer β€” K3s on Raspberry Pi -### Proxmox Cluster β€” 6 Nodes +A 12-node K3s cluster running on Raspberry Pi hardware. Designed to mirror real Kubernetes production patterns at small scale β€” not just "run some pods." -| Node | IP | Role | -|------|----|------| -| BigWorld | 10.10.30.250 | Proxmox VE Hypervisor | -| Biggie | 10.10.30.192 | Proxmox VE Hypervisor β€” NOC script host | -| Snoop | 10.10.30.153 | Proxmox VE Hypervisor | -| TooShort | 10.10.30.120 | Proxmox VE Hypervisor | -| Tupac | 10.10.30.74 | Proxmox VE Hypervisor | -| DrDre | 10.10.30.227 | Proxmox VE Hypervisor | +| Layer | Detail | +|-------|--------| +| Cluster size | 12 nodes (Raspberry Pi) | +| Ingress | MetalLB + NGINX Ingress Controller | +| DNS | Wildcard `*.cedshomelab.com` via Cloudflare | +| Workloads | Monitoring stack, containerized services, future GitOps | -### K3s Cluster β€” 12 Nodes - -| Role | Node | IP | -|------|------|----| -| Control Plane | django-1 | 10.10.30.72 | -| Control Plane | django-2 | 10.10.30.245 | -| Control Plane | django-3 | 10.10.30.128 | -| Ingress Worker | node-1 | 10.10.30.219 | -| Ingress Worker | node-2 | 10.10.30.134 | -| Ingress Worker | node-3 | 10.10.30.222 | -| Data Worker | node-4 | 10.10.30.126 | -| Data Worker | node-5 | 10.10.30.239 | -| Data Worker | node-6 | 10.10.30.208 | -| Monitoring Worker | node-7 | 10.10.30.198 | -| Monitoring Worker | node-8 | 10.10.30.216 | -| Monitoring Worker | node-9 | 10.10.30.29 | - -### Services, Monitoring & Edge β€” 10 Systems - -| System | IP | Layer | Role | -|--------|----|-------|------| -| TrueNAS | 10.10.30.143 | Infrastructure | Network Attached Storage | -| Nginx Proxy Manager | 10.10.30.210 | Networking | Reverse Proxy | -| Prometheus | 10.10.30.140 | Monitoring | Metrics Scraping (Active) | -| Grafana | 10.10.30.68 | Monitoring | Metrics Dashboard | -| Uptime Kuma | 10.10.30.14 | Monitoring | Service Monitor | -| Dashy | 10.10.30.61 | Services | HomeLab Dashboard | -| Home Assistant | 10.10.30.104 | Services | Home Automation | -| PrimeStation | 10.10.30.233 | Services | Media Server | -| APRS iGate Home | 10.10.30.129 | Edge | RF to APRS-IS Gateway | -| APRS iGate Mobile | 10.10.30.35 | Edge | RF Mobile Node | +πŸ“Œ Full cluster documentation: **[ced-k3s-homelab β†’](https://github.com/ced4568/ced-k3s-homelab)** --- -## 🧭 Documentation +### Network & VLAN Architecture -- Add new service: `docs/Add_New_Service_Guide.md` -- Architecture diagrams: `docs/Ced_Homelab_Diagrams.md` -- Roadmap: `docs/roadmap.md` +All traffic runs through a UniFi Dream Router with hard VLAN segmentation. The HomeLab VLAN is fully isolated from daily-use devices β€” the same principle I apply to industrial OT/IT network segmentation at work. + +| VLAN | Subnet | Purpose | +|------|--------|---------| +| Main | `10.10.10.0/24` | Daily-use devices, workstations | +| IoT | `10.10.20.0/24` | Smart home devices, consoles, TVs | +| HomeLab | `10.10.30.0/24` | All servers, K3s nodes, storage, services | +| Guest | `10.10.99.0/24` | Guest Wi-Fi β€” no internal access | + +**Traffic flow for external access:** +``` +Internet β†’ Cloudflare Edge β†’ Tunnel β†’ Nginx Proxy Manager β†’ Internal Service +``` + +Zero open ports. No port forwarding. All external access goes through Cloudflare Tunnel. + +πŸ“ Configs: [`cloudflare/`](./cloudflare/) Β· [`npm/`](./npm/) Β· [`docs/Add_New_Service_Guide.md`](./docs/Add_New_Service_Guide.md) --- -## πŸš€ Future Plans +### Observability β€” Ced's NOC -- Full Proxmox cluster -- Cloudflare Zero Trust integration -- GitOps for K3s deployments -- Internal container registry -- Advanced monitoring + alerting -- Portfolio site: - - chasedumphord.com - - cedshomelab.com +The centerpiece of this lab. A live Network Operations Center dashboard that gives real-time visibility into every layer of the infrastructure. + +**Stack:** + +| Tool | Role | +|------|------| +| Prometheus | Metrics collection and storage | +| Grafana | Dashboards and visualization | +| Node Exporter | Per-host system metrics (CPU, RAM, disk, network) | +| Blackbox Exporter | External endpoint/service probing | +| Uptime Kuma | Service-level uptime monitoring and alerting | + +**What's monitored:** +- Proxmox host performance and VM resource usage +- K3s cluster node health and pod status +- Per-service uptime with configurable alert thresholds +- Network latency across VLANs +- TrueNAS pool health and disk utilization + +πŸ“Ί **[View Live NOC Dashboard β†’](https://noc.chasedumphord.com)** +πŸ“ Configs: [`monitoring/`](./monitoring/) --- -## ⚠️ Security Practices +## Screenshots -This repo never stores: +### Proxmox β€” Hypervisor Overview +![Proxmox Overview](./screenshots/proxmox-overview.png) -- API tokens -- Private keys -- Passwords -- Sensitive configs +### Proxmox β€” Active Workloads +![Proxmox Workloads](./screenshots/proxmox-overview2.png) -All secrets are handled locally or via `.example` files. +### K3s β€” Cluster Nodes & Pods +![K3s Nodes](./screenshots/K3s-nodes.png) + +### Nginx Proxy Manager β€” Reverse Proxy Routes +![NGM](./screenshots/NGN.png) + +### Uptime Kuma β€” Service Monitoring +![Uptime Kuma](./screenshots/uptime-kuma.png) + +### Grafana β€” Infrastructure Dashboard +![Grafana](./screenshots/grafana.png) --- -## πŸ‘€ Author +## Repository Structure -**Chase Dumphord** -Digital Systems Engineer | Infrastructure | Data Systems | Automation +``` +ceds-homelab/ +β”œβ”€β”€ cloudflare/ # Tunnel configs and DNS setup +β”œβ”€β”€ docs/ # Architecture diagrams, guides, roadmap +β”‚ β”œβ”€β”€ Add_New_Service_Guide.md +β”‚ β”œβ”€β”€ Ced_Homelab_Diagrams.md +β”‚ └── roadmap.md +β”œβ”€β”€ home-assistant/ # HA configuration and automation +β”œβ”€β”€ k3s/ # K3s manifests and configs +β”œβ”€β”€ monitoring/ # Prometheus, Grafana, Uptime Kuma configs +β”œβ”€β”€ npm/ # Nginx Proxy Manager configs +β”œβ”€β”€ proxmox/ # Proxmox VM/LXC templates and notes +β”œβ”€β”€ screenshots/ # Infrastructure screenshots for docs +β”œβ”€β”€ soc-lab/ # Security operations lab project +└── truenas/ # TrueNAS pool and dataset configs +``` -LinkedIn: https://www.linkedin.com/in/toochase-dumphord/ -GitHub: https://github.com/ced4568 +--- + +## Roadmap + +- [x] Proxmox hypervisor with VM/LXC workloads +- [x] 12-node K3s cluster on Raspberry Pi +- [x] VLAN segmentation via UniFi +- [x] Cloudflare Tunnel + Nginx Proxy Manager +- [x] Prometheus + Grafana observability stack +- [x] Uptime Kuma service monitoring +- [x] Live NOC dashboard (noc.chasedumphord.com) +- [ ] GitOps with ArgoCD for K3s deployments +- [ ] Helm chart library for self-hosted services +- [ ] Cloudflare Zero Trust access policies +- [ ] Internal container registry +- [ ] Automated alerting with PagerDuty or Grafana OnCall +- [ ] Full Proxmox cluster expansion (6-node) + +--- + +## Security Practices + +This repository contains **no secrets, tokens, API keys, or passwords.** + +- All sensitive values are stored locally or passed via environment variables +- Template/example files use placeholder values only (`.example` suffix) +- External access is zero-trust via Cloudflare Tunnel β€” no exposed ports +- VLANs enforce hard network segmentation between device classes + +--- + +## Related Projects + +| Project | Description | +|---------|-------------| +| [ced-k3s-homelab](https://github.com/ced4568/ced-k3s-homelab) | Full documentation for the 12-node Raspberry Pi K3s cluster | +| [ceds-aprs-igate](https://github.com/ced4568/ceds-aprs-igate) | Dual-node APRS RF-to-internet iGate (KJ5JCO) | +| [ced-portfolio](https://github.com/ced4568/ced-portfolio) | Source for chasedumphord.com | + +--- + +## Author + +**Chase Dumphord (Ced)** +Digital Systems Engineer Β· GE Aerospace Β· Oxford, MS + +Building systems that connect industrial hardware to actionable data. + +[![Portfolio](https://img.shields.io/badge/Portfolio-chasedumphord.com-0F6E56?style=flat-square)](https://chasedumphord.com) +[![LinkedIn](https://img.shields.io/badge/LinkedIn-chase--dumphord-0A66C2?style=flat-square)](https://www.linkedin.com/in/chase-dumphord/) +[![GitHub](https://img.shields.io/badge/GitHub-ced4568-181717?style=flat-square)](https://github.com/ced4568) +[![Live NOC](https://img.shields.io/badge/Live%20NOC-noc.chasedumphord.com-1D9E75?style=flat-square)](https://noc.chasedumphord.com) \ No newline at end of file diff --git a/README2.md b/README2.md new file mode 100644 index 0000000..532d3c4 --- /dev/null +++ b/README2.md @@ -0,0 +1,259 @@ +# Ced's HomeLab β€” Live Infrastructure & Observability Platform + +> A production-style homelab running real infrastructure, real workloads, and a live NOC dashboard β€” built by a Digital Systems Engineer at GE Aerospace who needed a place to practice what he preaches. + +[![Live NOC](https://img.shields.io/badge/Live%20NOC-noc.chasedumphord.com-1D9E75?style=flat-square)](https://noc.chasedumphord.com) +[![Portfolio](https://img.shields.io/badge/Portfolio-chasedumphord.com-0F6E56?style=flat-square)](https://chasedumphord.com) +[![Nodes](https://img.shields.io/badge/Nodes-12%20K3s%20%2B%206%20Proxmox-085041?style=flat-square)](#infrastructure-layer) +[![VLANs](https://img.shields.io/badge/VLANs-4%20Segments-1D9E75?style=flat-square)](#network--vlan-architecture) + +--- + +## Why I Built This + +I work on the Digital Team at GE Aerospace building data pipelines, dashboards, and digital inspection systems. Every day I'm working with production infrastructure where downtime has real consequences β€” and I needed a lab environment that could keep up with that. + +This isn't a tutorial setup. Every service running here solves a real problem, every VLAN exists for a real reason, and every monitoring alert has a real threshold. I built this the same way I build at work: start with architecture, document as you go, and make it observable from day one. + +**What this lab is for:** +- Practicing infrastructure patterns I apply directly at GE +- Building a live, always-on NOC that demonstrates real observability skills +- Running workloads that would otherwise require expensive cloud resources +- Documenting systems well enough that anyone can understand them + +--- + +## Architecture Overview + +```mermaid +graph TB + subgraph Internet + CF[Cloudflare Edge] + end + + subgraph Access Layer + TUNNEL[Cloudflare Tunnel] + NPM[Nginx Proxy Manager] + end + + subgraph Network - UniFi UDR + MAIN[Main VLAN
10.10.10.0/24] + IOT[IoT VLAN
10.10.20.0/24] + LAB[HomeLab VLAN
10.10.30.0/24] + GUEST[Guest VLAN
10.10.99.0/24] + end + + subgraph Compute - Proxmox VE + PVE[Proxmox Hypervisor
VMs + LXC Containers] + HA[Home Assistant VM] + SERVICES[Service VMs] + end + + subgraph Orchestration - K3s + CTRL[Control Plane] + W1[Worker Node x4] + W2[Worker Node x4] + W3[Worker Node x4] + end + + subgraph Storage - TrueNAS + ZFS[ZFS Pool] + NFS[NFS Exports] + SMB[SMB Shares] + end + + subgraph Observability - Ced's NOC + PROM[Prometheus] + GRAF[Grafana] + KUMA[Uptime Kuma] + NODE[Node Exporter] + BLACK[Blackbox Exporter] + end + + CF --> TUNNEL --> NPM + NPM --> LAB + LAB --> PVE + LAB --> CTRL + PVE --> ZFS + ZFS --> NFS --> PVE + CTRL --> W1 & W2 & W3 + NODE --> PROM + BLACK --> PROM + PROM --> GRAF + KUMA --> GRAF +``` + +--- + +## Infrastructure Layers + +### Infrastructure Layer β€” Proxmox VE + +The hypervisor layer runs on a dedicated server hosting all VMs and LXC containers. TrueNAS provides centralized ZFS storage with NFS exports for VM disk images and SMB shares for media workloads. + +| Component | Role | +|-----------|------| +| Proxmox VE | Primary hypervisor β€” VMs and LXC containers | +| TrueNAS | ZFS storage backend β€” NFS for Proxmox, SMB for media | +| Home Assistant | IoT automation, isolated on its own VLAN | + +πŸ“ Configs: [`proxmox/`](./proxmox/) Β· [`truenas/`](./truenas/) Β· [`home-assistant/`](./home-assistant/) + +--- + +### Orchestration Layer β€” K3s on Raspberry Pi + +A 12-node K3s cluster running on Raspberry Pi hardware. Designed to mirror real Kubernetes production patterns at small scale β€” not just "run some pods." + +| Layer | Detail | +|-------|--------| +| Cluster size | 12 nodes (Raspberry Pi) | +| Ingress | MetalLB + NGINX Ingress Controller | +| DNS | Wildcard `*.cedshomelab.com` via Cloudflare | +| Workloads | Monitoring stack, containerized services, future GitOps | + +πŸ“Œ Full cluster documentation: **[ced-k3s-homelab β†’](https://github.com/ced4568/ced-k3s-homelab)** + +--- + +### Network & VLAN Architecture + +All traffic runs through a UniFi Dream Router with hard VLAN segmentation. The HomeLab VLAN is fully isolated from daily-use devices β€” the same principle I apply to industrial OT/IT network segmentation at work. + +| VLAN | Subnet | Purpose | +|------|--------|---------| +| Main | `10.10.10.0/24` | Daily-use devices, workstations | +| IoT | `10.10.20.0/24` | Smart home devices, consoles, TVs | +| HomeLab | `10.10.30.0/24` | All servers, K3s nodes, storage, services | +| Guest | `10.10.99.0/24` | Guest Wi-Fi β€” no internal access | + +**Traffic flow for external access:** +``` +Internet β†’ Cloudflare Edge β†’ Tunnel β†’ Nginx Proxy Manager β†’ Internal Service +``` + +Zero open ports. No port forwarding. All external access goes through Cloudflare Tunnel. + +πŸ“ Configs: [`cloudflare/`](./cloudflare/) Β· [`npm/`](./npm/) Β· [`docs/Add_New_Service_Guide.md`](./docs/Add_New_Service_Guide.md) + +--- + +### Observability β€” Ced's NOC + +The centerpiece of this lab. A live Network Operations Center dashboard that gives real-time visibility into every layer of the infrastructure. + +**Stack:** + +| Tool | Role | +|------|------| +| Prometheus | Metrics collection and storage | +| Grafana | Dashboards and visualization | +| Node Exporter | Per-host system metrics (CPU, RAM, disk, network) | +| Blackbox Exporter | External endpoint/service probing | +| Uptime Kuma | Service-level uptime monitoring and alerting | + +**What's monitored:** +- Proxmox host performance and VM resource usage +- K3s cluster node health and pod status +- Per-service uptime with configurable alert thresholds +- Network latency across VLANs +- TrueNAS pool health and disk utilization + +πŸ“Ί **[View Live NOC Dashboard β†’](https://noc.chasedumphord.com)** +πŸ“ Configs: [`monitoring/`](./monitoring/) + +--- + +## Screenshots + +### Proxmox β€” Hypervisor Overview +![Proxmox Overview](./screenshots/proxmox-overview.png) + +### Proxmox β€” Active Workloads +![Proxmox Workloads](./screenshots/proxmox-overview2.png) + +### K3s β€” Cluster Nodes & Pods +![K3s Nodes](./screenshots/K3s-nodes.png) + +### Nginx Proxy Manager β€” Reverse Proxy Routes +![NGM](./screenshots/NGN.png) + +### Uptime Kuma β€” Service Monitoring +![Uptime Kuma](./screenshots/uptime-kuma.png) + +### Grafana β€” Infrastructure Dashboard +![Grafana](./screenshots/grafana.png) + +--- + +## Repository Structure + +``` +ceds-homelab/ +β”œβ”€β”€ cloudflare/ # Tunnel configs and DNS setup +β”œβ”€β”€ docs/ # Architecture diagrams, guides, roadmap +β”‚ β”œβ”€β”€ Add_New_Service_Guide.md +β”‚ β”œβ”€β”€ Ced_Homelab_Diagrams.md +β”‚ └── roadmap.md +β”œβ”€β”€ home-assistant/ # HA configuration and automation +β”œβ”€β”€ k3s/ # K3s manifests and configs +β”œβ”€β”€ monitoring/ # Prometheus, Grafana, Uptime Kuma configs +β”œβ”€β”€ npm/ # Nginx Proxy Manager configs +β”œβ”€β”€ proxmox/ # Proxmox VM/LXC templates and notes +β”œβ”€β”€ screenshots/ # Infrastructure screenshots for docs +β”œβ”€β”€ soc-lab/ # Security operations lab project +└── truenas/ # TrueNAS pool and dataset configs +``` + +--- + +## Roadmap + +- [x] Proxmox hypervisor with VM/LXC workloads +- [x] 12-node K3s cluster on Raspberry Pi +- [x] VLAN segmentation via UniFi +- [x] Cloudflare Tunnel + Nginx Proxy Manager +- [x] Prometheus + Grafana observability stack +- [x] Uptime Kuma service monitoring +- [x] Live NOC dashboard (noc.chasedumphord.com) +- [ ] GitOps with ArgoCD for K3s deployments +- [ ] Helm chart library for self-hosted services +- [ ] Cloudflare Zero Trust access policies +- [ ] Internal container registry +- [ ] Automated alerting with PagerDuty or Grafana OnCall +- [ ] Full Proxmox cluster expansion (6-node) + +--- + +## Security Practices + +This repository contains **no secrets, tokens, API keys, or passwords.** + +- All sensitive values are stored locally or passed via environment variables +- Template/example files use placeholder values only (`.example` suffix) +- External access is zero-trust via Cloudflare Tunnel β€” no exposed ports +- VLANs enforce hard network segmentation between device classes + +--- + +## Related Projects + +| Project | Description | +|---------|-------------| +| [ced-k3s-homelab](https://github.com/ced4568/ced-k3s-homelab) | Full documentation for the 12-node Raspberry Pi K3s cluster | +| [ceds-aprs-igate](https://github.com/ced4568/ceds-aprs-igate) | Dual-node APRS RF-to-internet iGate (KJ5JCO) | +| [ced-portfolio](https://github.com/ced4568/ced-portfolio) | Source for chasedumphord.com | + +--- + +## Author + +**Chase Dumphord (Ced)** +Digital Systems Engineer Β· GE Aerospace Β· Oxford, MS + +Building systems that connect industrial hardware to actionable data. + +[![Portfolio](https://img.shields.io/badge/Portfolio-chasedumphord.com-0F6E56?style=flat-square)](https://chasedumphord.com) +[![LinkedIn](https://img.shields.io/badge/LinkedIn-chase--dumphord-0A66C2?style=flat-square)](https://www.linkedin.com/in/chase-dumphord/) +[![GitHub](https://img.shields.io/badge/GitHub-ced4568-181717?style=flat-square)](https://github.com/ced4568) +[![Live NOC](https://img.shields.io/badge/Live%20NOC-noc.chasedumphord.com-1D9E75?style=flat-square)](https://noc.chasedumphord.com) \ No newline at end of file