Homelab Infrastructure Architecture

Proxmox VE · 7 Docker Compose Stacks · VLAN-Segmented · Zero WAN Port Forwarding

LegendProxmox LXC / VMDocker composePhysical / securityCloudflareTraffic flowSecurity signalNetworkInternetClientsRouter / FirewallMikroTik RB450Gx4NAS StorageUgreen DH2300 · NFSVLAN Segments10 · User / 20 · IoT30 · Server / 40 · Guest99 · ManagementCloudflare EdgeCloudflare DNSalkamfrz.idCloudflare TunnelHTTPSProxmox VE HypervisorCloudflare Tunnel · LXC 102cloudflared daemon, tunnel ingressReverse Proxy · LXC 101HAProxy · SSL termination (Let's Encrypt)DNS Resolver · LXC 100Unbound · DNSSEC · Adblock · Local zonesVPN Gateway · LXC 103Tailscale mesh · Remote admin accessAI Worker · LXC 104Router · OpenCode CLIDocker Host · VM 200Docker engine · TLS · NFS-backed storageManagementTunnelProxyLua bouncerNFScomposeDocker Compose StacksRun on Docker Host · Local intranet (VLAN 30)ArrSuiteqBittorrent · Radarr · Sonarr · Prowlarr · Bazarr · flaresolverrMedia automationJellyfin + SeerrMedia server · Request managementLocal streamingCrowdSec IPSIntrusion prevention · Lua bouncer → HAProxySecurityHomepageDashboardUptimeKumaUptime monitoringUpsnapWake-on-LANWatchtowerAuto-updaterStacks share NAS volumes: configs, media, databases

Proxmox Instances

  • Hypervisor (VLAN 99)
  • Cloudflare Tunnel · LXC 102 (VLAN 30)
  • Reverse Proxy · LXC 101 (VLAN 30)
  • DNS Resolver · LXC 100 (VLAN 30)
  • VPN Gateway · LXC 103 (VLAN 99)
  • AI Worker · LXC 104 (VLAN 30)
  • Docker Host · VM 200 (VLAN 30)

7 Docker Compose Stacks

  • ArrSuite — qBittorrent, Radarr, Sonarr, Prowlarr, Bazarr, flaresolverr
  • Jellyfin + Seerr — Media server + request manager
  • CrowdSec — IPS, Lua bouncer → HAProxy
  • Homepage — Dashboard
  • UptimeKuma — Uptime monitoring
  • Upsnap — Wake-on-LAN
  • Watchtower — Auto-updater

Security Posture

  • Zero WAN port forwarding — Cloudflare Tunnel only
  • Let's Encrypt DNS-01 challenge (no HTTP-01)
  • CrowdSec IPS — Lua bouncer on HAProxy
  • Tailscale VPN mesh for remote admin
  • VLAN segmentation (10/20/30/40/99)
  • Unbound DNSSEC + adblock at network edge

Homelab Infrastructure · home.alkamfrz.id · Infrastructure-as-Code (Bash)