Homelab

A segmented home network with SSO, intrusion detection and full observability. The platform everything else here runs on.

stack

pfSense, Proxmox, Authentik, Suricata, CrowdSec, Prometheus, Loki, Grafana

What it is

The infrastructure behind my other projects. A few of the services on it are public, so I try to run it like something people depend on.

How it’s built

• Network. A dedicated firewall with separate segments for servers, game hosts, IoT, guests and management. I lock them down one zone at a time: first a few days in log-only mode, then rules written from what actually flowed, then everything else blocked.
• Identity. Admin UIs sit behind Authentik with passkey-only login, through forward-auth or OIDC. There’s a documented break-glass path for when SSO is down.
• Edge. Public traffic comes in through a VPS running Traefik and CrowdSec. Home ports stay closed.
• Observability. Prometheus, Loki and Grafana, with Alloy on every host. Alerts are per host with severities, including freshness alerts that catch a host that has quietly stopped reporting.
• Config as code. Configs live in git, and a nightly job snapshots live config from an allowlist with secrets redacted and scanned before anything is committed.

Things I learned the hard way

• An alert window that’s too short resolves itself once the failing host ages out of the lookback. The alert said “fine” for a host that had been down for seven hours.
• A DNS blocker can be “running” while blocking nothing. It now has a canary domain that alerts if it resolves.
• Metrics can disappear without a single error. When two sources described the same metric slightly differently, one of them was silently dropped, and a dashboard showed gaps I first blamed on the hosts.

cd ..