Ceds-HomeLab/ceds-homelab
1
1
Fork 0
mirror of https://github.com/ced4568/ceds-homelab.git synced 2026-08-13 04:04:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Initial commit: Ced's HomeLab docs and structure

Browse Source
This commit is contained in:
ced4568
2025-12-08 22:17:44 -06:00
commit 7650e6f459
18 changed files with 643 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/Add_New_Service_Guide.md
+134
View File
@@ -0,0 +1,134 @@
# Adding a New Service to Cloudflare Tunnel + NGINX Proxy Manager
## Architecture Flow
```text
Browser
│
▼
Cloudflare DNS (cedshomelab.com)
│
▼
Cloudflare Edge (SSL, Zero Trust)
│
▼
Cloudflare Tunnel (cloudflared)
│
▼
NGINX Proxy Manager (10.10.30.210)
│
▼
Internal Service (10.10.30.X:PORT)
```
---
## Step-By-Step Checklist
### 1. Gather Service Info
- **Subdomain:** `service.cedshomelab.com`
- **Internal IP:** `10.10.30.X`
- **Port:** `PORT`
- **Scheme:** `http` or `https`
Test local access:
- LAN: `http://10.10.30.X:PORT`
---
### 2. (Optional) Create DNS Route in Tunnel
Inside NPM container:
```bash
cloudflared tunnel route dns npm-tunnel service.cedshomelab.com
```
---
### 3. Add Proxy Host in NGINX Proxy Manager
Open NPM: `http://10.10.30.210:81`
Go to:
**Hosts → Proxy Hosts → Add Proxy Host**
**Details tab:**
- **Domain Names:** `service.cedshomelab.com`
- **Scheme:** `http` or `https`
- **Forward Hostname/IP:** `10.10.30.X`
- **Forward Port:** `PORT`
Enable:
- Block Common Exploits
- Websockets Support
---
### 4. HTTPS Self-Signed Backends (Optional)
If backend uses self-signed HTTPS (e.g., Proxmox, TrueNAS):
In NPM **Advanced tab:**
```nginx
proxy_ssl_verify off;
proxy_ssl_verify_depth 1;
proxy_ssl_name 10.10.30.X;
```
---
### 5. SSL Tab
Since Cloudflare provides SSL:
- **SSL Certificate:** `None`
- Force SSL: Off
- HSTS: Off
- HTTP/2: Off
Save.
---
### 6. Test External Access
Open:
`https://service.cedshomelab.com`
If issues:
- 404: hostname not in ingress
- 502/504: NPM can’t reach backend
- Cloudflare 52x: tunnel or DNS issue
---
## Notes
- Wildcard routing `*.cedshomelab.com` sends all new subdomains to NPM automatically.
- Only NPM needs to be updated for new services.
- No need to open router ports.
---
## Example
For Jellyfin on `http://10.10.30.143:30013`:
```bash
cloudflared tunnel route dns npm-tunnel jellyfin.cedshomelab.com
```
In NPM:
- Domain: `jellyfin.cedshomelab.com`
- Scheme: `http`
- IP: `10.10.30.143`
- Port: `30013`
- Block Exploits: On
- Websockets: On
Save & test:
`https://jellyfin.cedshomelab.com`
docs/Ced_Homelab_Diagrams.md
+177
View File
@@ -0,0 +1,177 @@
# Ced's HomeLab – Network & Cloud Architecture Diagrams
This file contains **Mermaid diagrams** for:
- Cloud & homelab architecture
- VLAN segmentation
- Request flows (Proxmox, Home Assistant)
You can view or edit them with:
- Mermaid Live Editor: https://mermaid.live
- Draw.io (Arrange → Insert → Advanced → Mermaid)
- GitHub / Obsidian / VS Code (Mermaid support)
---
## 1. High-Level Cloud & Homelab Architecture
```mermaid
graph TD
subgraph Internet["🌐 Internet"]
User[User Browser]
end
subgraph Cloudflare["Cloudflare Edge"]
CF_DNS[DNS & SSL]
CF_ZT[Zero Trust (future)]
end
subgraph Tunnel["Cloudflare Tunnel"]
CF_Tunnel[cloudflared<br/>NPM LXC]
end
subgraph HomeLab_VLAN["HomeLab VLAN 10.10.30.0/24"]
NPM[Nginx Proxy Manager<br/>10.10.30.210]
PVE[Proxmox VE Host<br/>10.10.30.250]
TRUENAS[TrueNAS & Media<br/>10.10.30.143]
HA[Home Assistant<br/>10.10.30.104]
subgraph K3S["Raspberry Pi K3s Cluster<br/>12 nodes"]
K3S_M[Masters]
K3S_W[Workers]
end
subgraph OBS["Observability Stack"]
GRAF[Grafana]
PROM[Prometheus]
UPTK[Uptime Kuma]
end
subgraph MEDIA["Media & Arr Suite"]
ARR[Sonarr/Radarr/etc.]
JF[Jellyfin]
end
end
User -->|"https://*.cedshomelab.com"| CF_DNS --> CF_ZT
CF_ZT --> CF_Tunnel --> NPM
NPM -->|"dashy.cedshomelab.com"| NPM
NPM -->|"pve.cedshomelab.com"| PVE
NPM -->|"truenas.cedshomelab.com"| TRUENAS
NPM -->|"ha.cedshomelab.com"| HA
NPM -->|"jellyfin.cedshomelab.com"| JF
NPM -->|"grafana.cedshomelab.com"| GRAF
NPM -->|"prometheus.cedshomelab.com"| PROM
NPM -->|"uptime.cedshomelab.com"| UPTK
NPM -->|"arr.cedshomelab.com"| ARR
PVE -.-> OBS
PVE -.-> MEDIA
PVE -.-> K3S
TRUENAS -. Storage .- PVE
TRUENAS -. Media Storage .- JF
```
---
## 2. VLAN & Network Segmentation Diagram
```mermaid
flowchart LR
subgraph UDR["UniFi Dream Router (UDR)"]
GW_MAIN["VLAN Main 10.10.10.1"]
GW_IOT["VLAN IoT 10.10.20.1"]
GW_LAB["VLAN HomeLab 10.10.30.1"]
GW_GUEST["VLAN Guest 10.10.99.1"]
end
subgraph VLAN_MAIN["Main Network 10.10.10.0/24"]
DEV1[Phones / Laptops / PCs]
end
subgraph VLAN_IOT["MyHomeIOT 10.10.20.0/24"]
IOT1[IoT Devices]
TV[Smart TVs / Consoles]
end
subgraph VLAN_LAB["Ced's HomeLab 10.10.30.0/24"]
PVE[Proxmox Host(s)]
NPM[Nginx Proxy Manager<br/>+ cloudflared]
TRUENAS[TrueNAS]
HA[Home Assistant]
K3S["K3s Pi Cluster"]
OBS[Grafana / Prometheus / Uptime Kuma]
MEDIA[Arr Suite / Jellyfin]
end
subgraph VLAN_GUEST["Guest Network 10.10.99.0/24"]
GUEST_DEV[Guest Devices]
end
UDR --- VLAN_MAIN
UDR --- VLAN_IOT
UDR --- VLAN_LAB
UDR --- VLAN_GUEST
VLAN_MAIN -->|Restricted Access| VLAN_LAB
VLAN_IOT -->|HA API Only| HA
VLAN_GUEST -->|Internet Only| UDR
VLAN_LAB -->|Cloudflare Tunnel<br/>Outbound Only| NPM
```
---
## 3. Request Flow – Proxmox via `pve.cedshomelab.com`
```mermaid
sequenceDiagram
participant User as User Browser
participant CF as Cloudflare Edge
participant Tunnel as cloudflared (NPM LXC)
participant NPM as Nginx Proxy Manager
participant PVE as Proxmox (10.10.30.250:8006)
User->>CF: HTTPS GET pve.cedshomelab.com
CF->>CF: DNS resolve / SSL terminate / (Zero Trust auth)
CF-->>Tunnel: Encrypted Tunnel Connection
Tunnel-->>NPM: HTTP request (Host: pve.cedshomelab.com)
NPM->>PVE: HTTPS to 10.10.30.250:8006<br/>proxy headers
PVE-->>NPM: Proxmox login HTML
NPM-->>Tunnel: Response
Tunnel-->>CF: Encrypted tunnel response
CF-->>User: HTTPS response (Proxmox UI)
```
---
## 4. Request Flow – Home Assistant via `ha.cedshomelab.com`
```mermaid
sequenceDiagram
participant User as User (Phone/Laptop)
participant CF as Cloudflare Edge
participant Tunnel as cloudflared (NPM LXC)
participant NPM as Nginx Proxy Manager
participant HA as Home Assistant (10.10.30.104:8123)
User->>CF: HTTPS GET ha.cedshomelab.com
CF->>CF: DNS / SSL / (Zero Trust future)
CF-->>Tunnel: Encrypted tunnel connection
Tunnel-->>NPM: HTTP request with X-Forwarded-For
NPM->>HA: HTTP to 10.10.30.104:8123
HA->>HA: Check trusted_proxies & use_x_forwarded_for
HA-->>NPM: HA UI / API response
NPM-->>Tunnel: Response
Tunnel-->>CF: Response
CF-->>User: HTTPS response (HA UI)
```
---
## 5. Notes
- Cloudflare Zero Trust can be layered in front of any critical service.
- External entrypoint is always `*.cedshomelab.com`.
- Only outbound traffic from the HomeLab VLAN is required.
docs/homelab_notes.md
+5
View File
@@ -0,0 +1,5 @@
# Homelab Notes
Freeform scratchpad for commands, quick fixes, and ideas.
- TODO: add commonly used Proxmox, K3s, and TrueNAS commands here.
docs/roadmap.md
+33
View File
@@ -0,0 +1,33 @@
# Ced's HomeLab Roadmap
## Short Term
- Document current services and IPs
- Export Grafana "Ced's NOC" dashboard JSON
- Add Prometheus scrape configs for:
- Proxmox
- K3s
- TrueNAS
- Set up standardized NPM host naming
## Medium Term
- Build `*.apps.cedshomelab.com` routing for K3s
- Add Cloudflare Zero Trust in front of:
- Proxmox
- TrueNAS
- Grafana
- Home Assistant
- Set up backup strategies:
- Proxmox → TrueNAS
- TrueNAS snapshots
## Long Term
- Full Proxmox cluster with HA
- GitOps flows for K3s (ArgoCD or Flux)
- Internal Docker/OCI registry
- Portfolio site hosted on:
- `chasedumphord.com` or
- `cedshome.com`
- More detailed, automated documentation