Home Lab Infrastructure

Proxmox HA k3s OPNsense Zenarmor

A production-style home lab built around high availability, segmentation, secure service exposure, and recoverability. The environment runs Proxmox HA hypervisors, k3s-hosted containers, dedicated VMs, Traefik-routed internal services, hardened VLAN firewalling, DNS filtering, Home Assistant, Tailscale exit nodes, and automated backup replication to NAS and cloud storage.

Architecture

Proxmox HA hypervisors hosting both virtual machines and container workloads
k3s cluster for containerized internal services and lab applications
Tailscale VM exit nodes for private remote access and controlled egress paths
Traefik reverse proxy in front of self-hosted services including Excalidraw, draw.io, Obsidian, Paint, regex101, OneTimeSecret, and secrss

Network Security

OPNsense edge firewall with hardened rules per VLAN
Zenarmor NGFW tooling for traffic visibility and policy enforcement
AdGuard Home for DNS filtering and local resolver control
Full VLAN segmentation across trust, semi-trust, IoT, guest, DMZ, and sandbox networks

Operations

Hosted Home Assistant with integrated automation and supporting tools
Service exposure designed around reverse proxy routing instead of broad network access
Automated backups to NAS with cloud replication for offsite resilience
Lab structure designed to test infrastructure, security controls, and self-hosted workflows without weakening the trusted network

Tech Stack

Proxmox k3s OPNsense Zenarmor Traefik Tailscale AdGuard Home Home Assistant VLAN Segmentation NAS Backups Cloud Replication