mirror of
https://github.com/ced4568/ceds-homelab.git
synced 2026-08-13 04:04:01 +00:00
my message
This commit is contained in:
@@ -1,281 +1,259 @@
|
|||||||
# 🧠 Ced’s HomeLab (Enterprise Infrastructure & Monitoring Lab)
|
# Ced's HomeLab — Live Infrastructure & Observability Platform
|
||||||
|
|
||||||
> A production-style infrastructure lab showcasing real-world systems engineering, monitoring, and platform operations.
|
> A production-style homelab running real infrastructure, real workloads, and a live NOC dashboard — built by a Digital Systems Engineer at GE Aerospace who needed a place to practice what he preaches.
|
||||||
|
|
||||||
This environment functions as a **personal datacenter**, combining virtualization, Kubernetes orchestration, observability, and secure external access.
|
[](https://noc.chasedumphord.com)
|
||||||
|
[](https://chasedumphord.com)
|
||||||
|
[](#infrastructure-layer)
|
||||||
|
[](#network--vlan-architecture)
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 🚀 What This Lab Demonstrates
|
## Why I Built This
|
||||||
|
|
||||||
- Infrastructure design (Proxmox + virtualized services)
|
I work on the Digital Team at GE Aerospace building data pipelines, dashboards, and digital inspection systems. Every day I'm working with production infrastructure where downtime has real consequences — and I needed a lab environment that could keep up with that.
|
||||||
- Kubernetes orchestration (12-node K3s cluster)
|
|
||||||
- Network segmentation (VLAN architecture)
|
|
||||||
- Monitoring & observability (Grafana, Prometheus, Uptime Kuma)
|
|
||||||
- Secure service exposure (Cloudflare Tunnels + reverse proxy)
|
|
||||||
- Real-world system integration (data, services, automation)
|
|
||||||
|
|
||||||
## 🔥 Featured Project: SOC Lab
|
This isn't a tutorial setup. Every service running here solves a real problem, every VLAN exists for a real reason, and every monitoring alert has a real threshold. I built this the same way I build at work: start with architecture, document as you go, and make it observable from day one.
|
||||||
|
|
||||||
A focused project within this homelab that demonstrates monitoring, logging, and security concepts.
|
**What this lab is for:**
|
||||||
|
- Practicing infrastructure patterns I apply directly at GE
|
||||||
👉 [View SOC Lab Project](soc-lab/README.md)
|
- Building a live, always-on NOC that demonstrates real observability skills
|
||||||
---
|
- Running workloads that would otherwise require expensive cloud resources
|
||||||
|
- Documenting systems well enough that anyone can understand them
|
||||||
## 🏗️ Architecture Overview
|
|
||||||
|
|
||||||
This lab is built around three core layers:
|
|
||||||
|
|
||||||
### 🖥️ Infrastructure Layer
|
|
||||||
- Proxmox VE hypervisor
|
|
||||||
- Virtual Machines + LXC containers
|
|
||||||
- TrueNAS storage backend (ZFS, NFS, SMB)
|
|
||||||
|
|
||||||
### ☸️ Orchestration Layer
|
|
||||||
- 12-node K3s Kubernetes cluster
|
|
||||||
- Workload segmentation (ingress, data, monitoring)
|
|
||||||
- MetalLB + NGINX ingress
|
|
||||||
|
|
||||||
### 🌐 Access & Networking Layer
|
|
||||||
- VLAN segmented network (UDR)
|
|
||||||
- Nginx Proxy Manager
|
|
||||||
- Cloudflare Tunnel (zero port-forwarding)
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 🎯 Purpose
|
## Architecture Overview
|
||||||
|
|
||||||
This lab is designed to:
|
```mermaid
|
||||||
|
graph TB
|
||||||
|
subgraph Internet
|
||||||
|
CF[Cloudflare Edge]
|
||||||
|
end
|
||||||
|
|
||||||
- Simulate production-style environments
|
subgraph Access Layer
|
||||||
- Build hands-on infrastructure experience
|
TUNNEL[Cloudflare Tunnel]
|
||||||
- Develop monitoring and system visibility skills
|
NPM[Nginx Proxy Manager]
|
||||||
- Serve as a real-world engineering portfolio project
|
end
|
||||||
|
|
||||||
---
|
subgraph Network - UniFi UDR
|
||||||
|
MAIN[Main VLAN<br/>10.10.10.0/24]
|
||||||
|
IOT[IoT VLAN<br/>10.10.20.0/24]
|
||||||
|
LAB[HomeLab VLAN<br/>10.10.30.0/24]
|
||||||
|
GUEST[Guest VLAN<br/>10.10.99.0/24]
|
||||||
|
end
|
||||||
|
|
||||||
## 📸 Key System Views
|
subgraph Compute - Proxmox VE
|
||||||
|
PVE[Proxmox Hypervisor<br/>VMs + LXC Containers]
|
||||||
|
HA[Home Assistant VM]
|
||||||
|
SERVICES[Service VMs]
|
||||||
|
end
|
||||||
|
|
||||||
### 🖥️ Proxmox Infrastructure
|
subgraph Orchestration - K3s
|
||||||
|
CTRL[Control Plane]
|
||||||
|
W1[Worker Node x4]
|
||||||
|
W2[Worker Node x4]
|
||||||
|
W3[Worker Node x4]
|
||||||
|
end
|
||||||
|
|
||||||
### 🖥️ Proxmox Workloads
|
subgraph Storage - TrueNAS
|
||||||
|
ZFS[ZFS Pool]
|
||||||
|
NFS[NFS Exports]
|
||||||
|
SMB[SMB Shares]
|
||||||
|
end
|
||||||
|
|
||||||
### ☸️ K3s Cluster Nodes & Pods
|
subgraph Observability - Ced's NOC
|
||||||
|
PROM[Prometheus]
|
||||||
|
GRAF[Grafana]
|
||||||
|
KUMA[Uptime Kuma]
|
||||||
|
NODE[Node Exporter]
|
||||||
|
BLACK[Blackbox Exporter]
|
||||||
|
end
|
||||||
|
|
||||||
### 🌐 Reverse Proxy (Nginx Proxy Manager)
|
CF --> TUNNEL --> NPM
|
||||||
|
NPM --> LAB
|
||||||
|
LAB --> PVE
|
||||||
### 📊 Service Monitoring (Uptime Kuma)
|
LAB --> CTRL
|
||||||
|
PVE --> ZFS
|
||||||
|
ZFS --> NFS --> PVE
|
||||||
### 📊 Grafana Dashboard
|
CTRL --> W1 & W2 & W3
|
||||||
|
NODE --> PROM
|
||||||
|
BLACK --> PROM
|
||||||
### 📊 Grafana Dashboard
|
PROM --> GRAF
|
||||||
|
KUMA --> GRAF
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## 🌐 Network & VLANs
|
|
||||||
|
|
||||||
The lab runs behind a UniFi Dream Router (UDR) with VLAN segmentation:
|
|
||||||
|
|
||||||
| Network | Subnet | Purpose |
|
|
||||||
|--------|--------|--------|
|
|
||||||
| Main | 10.10.10.0/24 | Daily-use devices |
|
|
||||||
| MyHomeIOT | 10.10.20.0/24 | IoT devices, TVs, consoles |
|
|
||||||
| HomeLab | 10.10.30.0/24 | Servers, services, K3s, storage |
|
|
||||||
| Guest | 10.10.99.0/24 | Guest Wi-Fi |
|
|
||||||
|
|
||||||
The HomeLab VLAN (10.10.30.0/24) hosts all core infrastructure.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## 🧱 Core Components
|
|
||||||
|
|
||||||
### 🖥️ Proxmox VE
|
|
||||||
- Main hypervisor for VMs and LXCs
|
|
||||||
- Future expansion to a Proxmox cluster (+5 nodes)
|
|
||||||
- Uses TrueNAS for shared storage (NFS / iSCSI)
|
|
||||||
📁 See: `proxmox/`
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### 💾 TrueNAS (ZFS Storage)
|
|
||||||
- Manages ZFS pools and datasets
|
|
||||||
- NFS exports for Proxmox VM storage
|
|
||||||
- SMB / media dataset for Jellyfin & Arr stack
|
|
||||||
📁 See: `truenas/`
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### ☸️ K3s Raspberry Pi Cluster
|
|
||||||
A 12-node K3s cluster built on Raspberry Pi hardware for orchestrating containerized workloads across the lab.
|
|
||||||
|
|
||||||
Current and planned uses include:
|
|
||||||
|
|
||||||
- Containerized applications
|
|
||||||
- Ingress-based routing
|
|
||||||
- Monitoring workloads
|
|
||||||
- Future GitOps and Helm-based deployments
|
|
||||||
|
|
||||||
📌 Full cluster repo:
|
|
||||||
https://github.com/ced4568/ced-k3s-homelab
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### 🌐 Reverse Proxy & Cloudflare Tunnel
|
|
||||||
- Nginx Proxy Manager (NPM)
|
|
||||||
- Cloudflare Tunnel (no port forwarding)
|
|
||||||
- Wildcard DNS: `*.cedshomelab.com`
|
|
||||||
|
|
||||||
**Traffic Flow:**
|
|
||||||
Internet → Cloudflare Edge → Tunnel → NPM → Internal Services
|
|
||||||
|
|
||||||
📁 Docs: `docs/Add_New_Service_Guide.md`
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### 🏠 Home Automation
|
|
||||||
- Home Assistant (Proxmox VM)
|
|
||||||
- IoT isolated on MyHomeIOT VLAN
|
|
||||||
- Secure access via Cloudflare + NPM
|
|
||||||
- `trusted_proxies` configured
|
|
||||||
|
|
||||||
📁 Config: `home-assistant/`
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### 📊 Observability (Ced’s NOC)
|
|
||||||
|
|
||||||
The lab includes an observability stack built around:
|
|
||||||
|
|
||||||
- Prometheus for metrics collection
|
|
||||||
- Grafana for dashboards and visualization
|
|
||||||
- Uptime Kuma for service-level monitoring
|
|
||||||
|
|
||||||
Current and planned monitoring coverage includes:
|
|
||||||
- Proxmox performance
|
|
||||||
- K3s cluster health
|
|
||||||
- Service uptime
|
|
||||||
- Infrastructure visibility improvements over time
|
|
||||||
|
|
||||||
📁 See: `monitoring/`
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## 📊 Live NOC & Automation Pipeline
|
|
||||||
|
|
||||||
The homelab powers a public-facing live NOC dashboard at **noc.chasedumphord.com**.
|
|
||||||
|
|
||||||
An automated Python script runs on Biggie (Proxmox node 10.10.30.192) every 5 minutes via cron. It pings all 28 systems, records latency and online/offline status, writes a structured JSON file, and pushes it to GitHub. The dashboard updates automatically.
|
|
||||||
|
|
||||||
```text
|
|
||||||
Biggie (10.10.30.192) — cron: */5 * * * *
|
|
||||||
→ noc_update.py
|
|
||||||
→ ICMP ping 28 systems
|
|
||||||
→ record latency + status
|
|
||||||
→ write data/noc-status.json
|
|
||||||
→ git commit + push to ced-portfolio
|
|
||||||
→ GitHub Pages deploys (~30s)
|
|
||||||
→ noc.chasedumphord.com auto-refreshes
|
|
||||||
```
|
```
|
||||||
|
|
||||||
- Script: `~/scripts/noc_update.py` on Biggie
|
---
|
||||||
- Log: `/var/log/noc_update.log`
|
|
||||||
- NOC source: https://github.com/ced4568/ceds-noc
|
## Infrastructure Layers
|
||||||
- Live dashboard: https://noc.chasedumphord.com
|
|
||||||
|
### Infrastructure Layer — Proxmox VE
|
||||||
|
|
||||||
|
The hypervisor layer runs on a dedicated server hosting all VMs and LXC containers. TrueNAS provides centralized ZFS storage with NFS exports for VM disk images and SMB shares for media workloads.
|
||||||
|
|
||||||
|
| Component | Role |
|
||||||
|
|-----------|------|
|
||||||
|
| Proxmox VE | Primary hypervisor — VMs and LXC containers |
|
||||||
|
| TrueNAS | ZFS storage backend — NFS for Proxmox, SMB for media |
|
||||||
|
| Home Assistant | IoT automation, isolated on its own VLAN |
|
||||||
|
|
||||||
|
📁 Configs: [`proxmox/`](./proxmox/) · [`truenas/`](./truenas/) · [`home-assistant/`](./home-assistant/)
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 🖥️ Full Node Inventory (28 Systems)
|
### Orchestration Layer — K3s on Raspberry Pi
|
||||||
|
|
||||||
### Proxmox Cluster — 6 Nodes
|
A 12-node K3s cluster running on Raspberry Pi hardware. Designed to mirror real Kubernetes production patterns at small scale — not just "run some pods."
|
||||||
|
|
||||||
| Node | IP | Role |
|
| Layer | Detail |
|
||||||
|------|----|------|
|
|-------|--------|
|
||||||
| BigWorld | 10.10.30.250 | Proxmox VE Hypervisor |
|
| Cluster size | 12 nodes (Raspberry Pi) |
|
||||||
| Biggie | 10.10.30.192 | Proxmox VE Hypervisor — NOC script host |
|
| Ingress | MetalLB + NGINX Ingress Controller |
|
||||||
| Snoop | 10.10.30.153 | Proxmox VE Hypervisor |
|
| DNS | Wildcard `*.cedshomelab.com` via Cloudflare |
|
||||||
| TooShort | 10.10.30.120 | Proxmox VE Hypervisor |
|
| Workloads | Monitoring stack, containerized services, future GitOps |
|
||||||
| Tupac | 10.10.30.74 | Proxmox VE Hypervisor |
|
|
||||||
| DrDre | 10.10.30.227 | Proxmox VE Hypervisor |
|
|
||||||
|
|
||||||
### K3s Cluster — 12 Nodes
|
📌 Full cluster documentation: **[ced-k3s-homelab →](https://github.com/ced4568/ced-k3s-homelab)**
|
||||||
|
|
||||||
| Role | Node | IP |
|
|
||||||
|------|------|----|
|
|
||||||
| Control Plane | django-1 | 10.10.30.72 |
|
|
||||||
| Control Plane | django-2 | 10.10.30.245 |
|
|
||||||
| Control Plane | django-3 | 10.10.30.128 |
|
|
||||||
| Ingress Worker | node-1 | 10.10.30.219 |
|
|
||||||
| Ingress Worker | node-2 | 10.10.30.134 |
|
|
||||||
| Ingress Worker | node-3 | 10.10.30.222 |
|
|
||||||
| Data Worker | node-4 | 10.10.30.126 |
|
|
||||||
| Data Worker | node-5 | 10.10.30.239 |
|
|
||||||
| Data Worker | node-6 | 10.10.30.208 |
|
|
||||||
| Monitoring Worker | node-7 | 10.10.30.198 |
|
|
||||||
| Monitoring Worker | node-8 | 10.10.30.216 |
|
|
||||||
| Monitoring Worker | node-9 | 10.10.30.29 |
|
|
||||||
|
|
||||||
### Services, Monitoring & Edge — 10 Systems
|
|
||||||
|
|
||||||
| System | IP | Layer | Role |
|
|
||||||
|--------|----|-------|------|
|
|
||||||
| TrueNAS | 10.10.30.143 | Infrastructure | Network Attached Storage |
|
|
||||||
| Nginx Proxy Manager | 10.10.30.210 | Networking | Reverse Proxy |
|
|
||||||
| Prometheus | 10.10.30.140 | Monitoring | Metrics Scraping (Active) |
|
|
||||||
| Grafana | 10.10.30.68 | Monitoring | Metrics Dashboard |
|
|
||||||
| Uptime Kuma | 10.10.30.14 | Monitoring | Service Monitor |
|
|
||||||
| Dashy | 10.10.30.61 | Services | HomeLab Dashboard |
|
|
||||||
| Home Assistant | 10.10.30.104 | Services | Home Automation |
|
|
||||||
| PrimeStation | 10.10.30.233 | Services | Media Server |
|
|
||||||
| APRS iGate Home | 10.10.30.129 | Edge | RF to APRS-IS Gateway |
|
|
||||||
| APRS iGate Mobile | 10.10.30.35 | Edge | RF Mobile Node |
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 🧭 Documentation
|
### Network & VLAN Architecture
|
||||||
|
|
||||||
- Add new service: `docs/Add_New_Service_Guide.md`
|
All traffic runs through a UniFi Dream Router with hard VLAN segmentation. The HomeLab VLAN is fully isolated from daily-use devices — the same principle I apply to industrial OT/IT network segmentation at work.
|
||||||
- Architecture diagrams: `docs/Ced_Homelab_Diagrams.md`
|
|
||||||
- Roadmap: `docs/roadmap.md`
|
| VLAN | Subnet | Purpose |
|
||||||
|
|------|--------|---------|
|
||||||
|
| Main | `10.10.10.0/24` | Daily-use devices, workstations |
|
||||||
|
| IoT | `10.10.20.0/24` | Smart home devices, consoles, TVs |
|
||||||
|
| HomeLab | `10.10.30.0/24` | All servers, K3s nodes, storage, services |
|
||||||
|
| Guest | `10.10.99.0/24` | Guest Wi-Fi — no internal access |
|
||||||
|
|
||||||
|
**Traffic flow for external access:**
|
||||||
|
```
|
||||||
|
Internet → Cloudflare Edge → Tunnel → Nginx Proxy Manager → Internal Service
|
||||||
|
```
|
||||||
|
|
||||||
|
Zero open ports. No port forwarding. All external access goes through Cloudflare Tunnel.
|
||||||
|
|
||||||
|
📁 Configs: [`cloudflare/`](./cloudflare/) · [`npm/`](./npm/) · [`docs/Add_New_Service_Guide.md`](./docs/Add_New_Service_Guide.md)
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 🚀 Future Plans
|
### Observability — Ced's NOC
|
||||||
|
|
||||||
- Full Proxmox cluster
|
The centerpiece of this lab. A live Network Operations Center dashboard that gives real-time visibility into every layer of the infrastructure.
|
||||||
- Cloudflare Zero Trust integration
|
|
||||||
- GitOps for K3s deployments
|
**Stack:**
|
||||||
- Internal container registry
|
|
||||||
- Advanced monitoring + alerting
|
| Tool | Role |
|
||||||
- Portfolio site:
|
|------|------|
|
||||||
- chasedumphord.com
|
| Prometheus | Metrics collection and storage |
|
||||||
- cedshomelab.com
|
| Grafana | Dashboards and visualization |
|
||||||
|
| Node Exporter | Per-host system metrics (CPU, RAM, disk, network) |
|
||||||
|
| Blackbox Exporter | External endpoint/service probing |
|
||||||
|
| Uptime Kuma | Service-level uptime monitoring and alerting |
|
||||||
|
|
||||||
|
**What's monitored:**
|
||||||
|
- Proxmox host performance and VM resource usage
|
||||||
|
- K3s cluster node health and pod status
|
||||||
|
- Per-service uptime with configurable alert thresholds
|
||||||
|
- Network latency across VLANs
|
||||||
|
- TrueNAS pool health and disk utilization
|
||||||
|
|
||||||
|
📺 **[View Live NOC Dashboard →](https://noc.chasedumphord.com)**
|
||||||
|
📁 Configs: [`monitoring/`](./monitoring/)
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## ⚠️ Security Practices
|
## Screenshots
|
||||||
|
|
||||||
This repo never stores:
|
### Proxmox — Hypervisor Overview
|
||||||
|
|
||||||
|
|
||||||
- API tokens
|
### Proxmox — Active Workloads
|
||||||
- Private keys
|
|
||||||
- Passwords
|
|
||||||
- Sensitive configs
|
|
||||||
|
|
||||||
All secrets are handled locally or via `.example` files.
|
### K3s — Cluster Nodes & Pods
|
||||||
|
|
||||||
|
|
||||||
|
### Nginx Proxy Manager — Reverse Proxy Routes
|
||||||
|
|
||||||
|
|
||||||
|
### Uptime Kuma — Service Monitoring
|
||||||
|
|
||||||
|
|
||||||
|
### Grafana — Infrastructure Dashboard
|
||||||
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 👤 Author
|
## Repository Structure
|
||||||
|
|
||||||
**Chase Dumphord**
|
```
|
||||||
Digital Systems Engineer | Infrastructure | Data Systems | Automation
|
ceds-homelab/
|
||||||
|
├── cloudflare/ # Tunnel configs and DNS setup
|
||||||
|
├── docs/ # Architecture diagrams, guides, roadmap
|
||||||
|
│ ├── Add_New_Service_Guide.md
|
||||||
|
│ ├── Ced_Homelab_Diagrams.md
|
||||||
|
│ └── roadmap.md
|
||||||
|
├── home-assistant/ # HA configuration and automation
|
||||||
|
├── k3s/ # K3s manifests and configs
|
||||||
|
├── monitoring/ # Prometheus, Grafana, Uptime Kuma configs
|
||||||
|
├── npm/ # Nginx Proxy Manager configs
|
||||||
|
├── proxmox/ # Proxmox VM/LXC templates and notes
|
||||||
|
├── screenshots/ # Infrastructure screenshots for docs
|
||||||
|
├── soc-lab/ # Security operations lab project
|
||||||
|
└── truenas/ # TrueNAS pool and dataset configs
|
||||||
|
```
|
||||||
|
|
||||||
LinkedIn: https://www.linkedin.com/in/toochase-dumphord/
|
---
|
||||||
GitHub: https://github.com/ced4568
|
|
||||||
|
## Roadmap
|
||||||
|
|
||||||
|
- [x] Proxmox hypervisor with VM/LXC workloads
|
||||||
|
- [x] 12-node K3s cluster on Raspberry Pi
|
||||||
|
- [x] VLAN segmentation via UniFi
|
||||||
|
- [x] Cloudflare Tunnel + Nginx Proxy Manager
|
||||||
|
- [x] Prometheus + Grafana observability stack
|
||||||
|
- [x] Uptime Kuma service monitoring
|
||||||
|
- [x] Live NOC dashboard (noc.chasedumphord.com)
|
||||||
|
- [ ] GitOps with ArgoCD for K3s deployments
|
||||||
|
- [ ] Helm chart library for self-hosted services
|
||||||
|
- [ ] Cloudflare Zero Trust access policies
|
||||||
|
- [ ] Internal container registry
|
||||||
|
- [ ] Automated alerting with PagerDuty or Grafana OnCall
|
||||||
|
- [ ] Full Proxmox cluster expansion (6-node)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Security Practices
|
||||||
|
|
||||||
|
This repository contains **no secrets, tokens, API keys, or passwords.**
|
||||||
|
|
||||||
|
- All sensitive values are stored locally or passed via environment variables
|
||||||
|
- Template/example files use placeholder values only (`.example` suffix)
|
||||||
|
- External access is zero-trust via Cloudflare Tunnel — no exposed ports
|
||||||
|
- VLANs enforce hard network segmentation between device classes
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Related Projects
|
||||||
|
|
||||||
|
| Project | Description |
|
||||||
|
|---------|-------------|
|
||||||
|
| [ced-k3s-homelab](https://github.com/ced4568/ced-k3s-homelab) | Full documentation for the 12-node Raspberry Pi K3s cluster |
|
||||||
|
| [ceds-aprs-igate](https://github.com/ced4568/ceds-aprs-igate) | Dual-node APRS RF-to-internet iGate (KJ5JCO) |
|
||||||
|
| [ced-portfolio](https://github.com/ced4568/ced-portfolio) | Source for chasedumphord.com |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Author
|
||||||
|
|
||||||
|
**Chase Dumphord (Ced)**
|
||||||
|
Digital Systems Engineer · GE Aerospace · Oxford, MS
|
||||||
|
|
||||||
|
Building systems that connect industrial hardware to actionable data.
|
||||||
|
|
||||||
|
[](https://chasedumphord.com)
|
||||||
|
[](https://www.linkedin.com/in/chase-dumphord/)
|
||||||
|
[](https://github.com/ced4568)
|
||||||
|
[](https://noc.chasedumphord.com)
|
||||||
+259
@@ -0,0 +1,259 @@
|
|||||||
|
# Ced's HomeLab — Live Infrastructure & Observability Platform
|
||||||
|
|
||||||
|
> A production-style homelab running real infrastructure, real workloads, and a live NOC dashboard — built by a Digital Systems Engineer at GE Aerospace who needed a place to practice what he preaches.
|
||||||
|
|
||||||
|
[](https://noc.chasedumphord.com)
|
||||||
|
[](https://chasedumphord.com)
|
||||||
|
[](#infrastructure-layer)
|
||||||
|
[](#network--vlan-architecture)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Why I Built This
|
||||||
|
|
||||||
|
I work on the Digital Team at GE Aerospace building data pipelines, dashboards, and digital inspection systems. Every day I'm working with production infrastructure where downtime has real consequences — and I needed a lab environment that could keep up with that.
|
||||||
|
|
||||||
|
This isn't a tutorial setup. Every service running here solves a real problem, every VLAN exists for a real reason, and every monitoring alert has a real threshold. I built this the same way I build at work: start with architecture, document as you go, and make it observable from day one.
|
||||||
|
|
||||||
|
**What this lab is for:**
|
||||||
|
- Practicing infrastructure patterns I apply directly at GE
|
||||||
|
- Building a live, always-on NOC that demonstrates real observability skills
|
||||||
|
- Running workloads that would otherwise require expensive cloud resources
|
||||||
|
- Documenting systems well enough that anyone can understand them
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Architecture Overview
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
graph TB
|
||||||
|
subgraph Internet
|
||||||
|
CF[Cloudflare Edge]
|
||||||
|
end
|
||||||
|
|
||||||
|
subgraph Access Layer
|
||||||
|
TUNNEL[Cloudflare Tunnel]
|
||||||
|
NPM[Nginx Proxy Manager]
|
||||||
|
end
|
||||||
|
|
||||||
|
subgraph Network - UniFi UDR
|
||||||
|
MAIN[Main VLAN<br/>10.10.10.0/24]
|
||||||
|
IOT[IoT VLAN<br/>10.10.20.0/24]
|
||||||
|
LAB[HomeLab VLAN<br/>10.10.30.0/24]
|
||||||
|
GUEST[Guest VLAN<br/>10.10.99.0/24]
|
||||||
|
end
|
||||||
|
|
||||||
|
subgraph Compute - Proxmox VE
|
||||||
|
PVE[Proxmox Hypervisor<br/>VMs + LXC Containers]
|
||||||
|
HA[Home Assistant VM]
|
||||||
|
SERVICES[Service VMs]
|
||||||
|
end
|
||||||
|
|
||||||
|
subgraph Orchestration - K3s
|
||||||
|
CTRL[Control Plane]
|
||||||
|
W1[Worker Node x4]
|
||||||
|
W2[Worker Node x4]
|
||||||
|
W3[Worker Node x4]
|
||||||
|
end
|
||||||
|
|
||||||
|
subgraph Storage - TrueNAS
|
||||||
|
ZFS[ZFS Pool]
|
||||||
|
NFS[NFS Exports]
|
||||||
|
SMB[SMB Shares]
|
||||||
|
end
|
||||||
|
|
||||||
|
subgraph Observability - Ced's NOC
|
||||||
|
PROM[Prometheus]
|
||||||
|
GRAF[Grafana]
|
||||||
|
KUMA[Uptime Kuma]
|
||||||
|
NODE[Node Exporter]
|
||||||
|
BLACK[Blackbox Exporter]
|
||||||
|
end
|
||||||
|
|
||||||
|
CF --> TUNNEL --> NPM
|
||||||
|
NPM --> LAB
|
||||||
|
LAB --> PVE
|
||||||
|
LAB --> CTRL
|
||||||
|
PVE --> ZFS
|
||||||
|
ZFS --> NFS --> PVE
|
||||||
|
CTRL --> W1 & W2 & W3
|
||||||
|
NODE --> PROM
|
||||||
|
BLACK --> PROM
|
||||||
|
PROM --> GRAF
|
||||||
|
KUMA --> GRAF
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Infrastructure Layers
|
||||||
|
|
||||||
|
### Infrastructure Layer — Proxmox VE
|
||||||
|
|
||||||
|
The hypervisor layer runs on a dedicated server hosting all VMs and LXC containers. TrueNAS provides centralized ZFS storage with NFS exports for VM disk images and SMB shares for media workloads.
|
||||||
|
|
||||||
|
| Component | Role |
|
||||||
|
|-----------|------|
|
||||||
|
| Proxmox VE | Primary hypervisor — VMs and LXC containers |
|
||||||
|
| TrueNAS | ZFS storage backend — NFS for Proxmox, SMB for media |
|
||||||
|
| Home Assistant | IoT automation, isolated on its own VLAN |
|
||||||
|
|
||||||
|
📁 Configs: [`proxmox/`](./proxmox/) · [`truenas/`](./truenas/) · [`home-assistant/`](./home-assistant/)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Orchestration Layer — K3s on Raspberry Pi
|
||||||
|
|
||||||
|
A 12-node K3s cluster running on Raspberry Pi hardware. Designed to mirror real Kubernetes production patterns at small scale — not just "run some pods."
|
||||||
|
|
||||||
|
| Layer | Detail |
|
||||||
|
|-------|--------|
|
||||||
|
| Cluster size | 12 nodes (Raspberry Pi) |
|
||||||
|
| Ingress | MetalLB + NGINX Ingress Controller |
|
||||||
|
| DNS | Wildcard `*.cedshomelab.com` via Cloudflare |
|
||||||
|
| Workloads | Monitoring stack, containerized services, future GitOps |
|
||||||
|
|
||||||
|
📌 Full cluster documentation: **[ced-k3s-homelab →](https://github.com/ced4568/ced-k3s-homelab)**
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Network & VLAN Architecture
|
||||||
|
|
||||||
|
All traffic runs through a UniFi Dream Router with hard VLAN segmentation. The HomeLab VLAN is fully isolated from daily-use devices — the same principle I apply to industrial OT/IT network segmentation at work.
|
||||||
|
|
||||||
|
| VLAN | Subnet | Purpose |
|
||||||
|
|------|--------|---------|
|
||||||
|
| Main | `10.10.10.0/24` | Daily-use devices, workstations |
|
||||||
|
| IoT | `10.10.20.0/24` | Smart home devices, consoles, TVs |
|
||||||
|
| HomeLab | `10.10.30.0/24` | All servers, K3s nodes, storage, services |
|
||||||
|
| Guest | `10.10.99.0/24` | Guest Wi-Fi — no internal access |
|
||||||
|
|
||||||
|
**Traffic flow for external access:**
|
||||||
|
```
|
||||||
|
Internet → Cloudflare Edge → Tunnel → Nginx Proxy Manager → Internal Service
|
||||||
|
```
|
||||||
|
|
||||||
|
Zero open ports. No port forwarding. All external access goes through Cloudflare Tunnel.
|
||||||
|
|
||||||
|
📁 Configs: [`cloudflare/`](./cloudflare/) · [`npm/`](./npm/) · [`docs/Add_New_Service_Guide.md`](./docs/Add_New_Service_Guide.md)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Observability — Ced's NOC
|
||||||
|
|
||||||
|
The centerpiece of this lab. A live Network Operations Center dashboard that gives real-time visibility into every layer of the infrastructure.
|
||||||
|
|
||||||
|
**Stack:**
|
||||||
|
|
||||||
|
| Tool | Role |
|
||||||
|
|------|------|
|
||||||
|
| Prometheus | Metrics collection and storage |
|
||||||
|
| Grafana | Dashboards and visualization |
|
||||||
|
| Node Exporter | Per-host system metrics (CPU, RAM, disk, network) |
|
||||||
|
| Blackbox Exporter | External endpoint/service probing |
|
||||||
|
| Uptime Kuma | Service-level uptime monitoring and alerting |
|
||||||
|
|
||||||
|
**What's monitored:**
|
||||||
|
- Proxmox host performance and VM resource usage
|
||||||
|
- K3s cluster node health and pod status
|
||||||
|
- Per-service uptime with configurable alert thresholds
|
||||||
|
- Network latency across VLANs
|
||||||
|
- TrueNAS pool health and disk utilization
|
||||||
|
|
||||||
|
📺 **[View Live NOC Dashboard →](https://noc.chasedumphord.com)**
|
||||||
|
📁 Configs: [`monitoring/`](./monitoring/)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Screenshots
|
||||||
|
|
||||||
|
### Proxmox — Hypervisor Overview
|
||||||
|
|
||||||
|
|
||||||
|
### Proxmox — Active Workloads
|
||||||
|
|
||||||
|
|
||||||
|
### K3s — Cluster Nodes & Pods
|
||||||
|
|
||||||
|
|
||||||
|
### Nginx Proxy Manager — Reverse Proxy Routes
|
||||||
|
|
||||||
|
|
||||||
|
### Uptime Kuma — Service Monitoring
|
||||||
|
|
||||||
|
|
||||||
|
### Grafana — Infrastructure Dashboard
|
||||||
|
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Repository Structure
|
||||||
|
|
||||||
|
```
|
||||||
|
ceds-homelab/
|
||||||
|
├── cloudflare/ # Tunnel configs and DNS setup
|
||||||
|
├── docs/ # Architecture diagrams, guides, roadmap
|
||||||
|
│ ├── Add_New_Service_Guide.md
|
||||||
|
│ ├── Ced_Homelab_Diagrams.md
|
||||||
|
│ └── roadmap.md
|
||||||
|
├── home-assistant/ # HA configuration and automation
|
||||||
|
├── k3s/ # K3s manifests and configs
|
||||||
|
├── monitoring/ # Prometheus, Grafana, Uptime Kuma configs
|
||||||
|
├── npm/ # Nginx Proxy Manager configs
|
||||||
|
├── proxmox/ # Proxmox VM/LXC templates and notes
|
||||||
|
├── screenshots/ # Infrastructure screenshots for docs
|
||||||
|
├── soc-lab/ # Security operations lab project
|
||||||
|
└── truenas/ # TrueNAS pool and dataset configs
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Roadmap
|
||||||
|
|
||||||
|
- [x] Proxmox hypervisor with VM/LXC workloads
|
||||||
|
- [x] 12-node K3s cluster on Raspberry Pi
|
||||||
|
- [x] VLAN segmentation via UniFi
|
||||||
|
- [x] Cloudflare Tunnel + Nginx Proxy Manager
|
||||||
|
- [x] Prometheus + Grafana observability stack
|
||||||
|
- [x] Uptime Kuma service monitoring
|
||||||
|
- [x] Live NOC dashboard (noc.chasedumphord.com)
|
||||||
|
- [ ] GitOps with ArgoCD for K3s deployments
|
||||||
|
- [ ] Helm chart library for self-hosted services
|
||||||
|
- [ ] Cloudflare Zero Trust access policies
|
||||||
|
- [ ] Internal container registry
|
||||||
|
- [ ] Automated alerting with PagerDuty or Grafana OnCall
|
||||||
|
- [ ] Full Proxmox cluster expansion (6-node)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Security Practices
|
||||||
|
|
||||||
|
This repository contains **no secrets, tokens, API keys, or passwords.**
|
||||||
|
|
||||||
|
- All sensitive values are stored locally or passed via environment variables
|
||||||
|
- Template/example files use placeholder values only (`.example` suffix)
|
||||||
|
- External access is zero-trust via Cloudflare Tunnel — no exposed ports
|
||||||
|
- VLANs enforce hard network segmentation between device classes
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Related Projects
|
||||||
|
|
||||||
|
| Project | Description |
|
||||||
|
|---------|-------------|
|
||||||
|
| [ced-k3s-homelab](https://github.com/ced4568/ced-k3s-homelab) | Full documentation for the 12-node Raspberry Pi K3s cluster |
|
||||||
|
| [ceds-aprs-igate](https://github.com/ced4568/ceds-aprs-igate) | Dual-node APRS RF-to-internet iGate (KJ5JCO) |
|
||||||
|
| [ced-portfolio](https://github.com/ced4568/ced-portfolio) | Source for chasedumphord.com |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Author
|
||||||
|
|
||||||
|
**Chase Dumphord (Ced)**
|
||||||
|
Digital Systems Engineer · GE Aerospace · Oxford, MS
|
||||||
|
|
||||||
|
Building systems that connect industrial hardware to actionable data.
|
||||||
|
|
||||||
|
[](https://chasedumphord.com)
|
||||||
|
[](https://www.linkedin.com/in/chase-dumphord/)
|
||||||
|
[](https://github.com/ced4568)
|
||||||
|
[](https://noc.chasedumphord.com)
|
||||||
Reference in New Issue
Block a user