saumer.cloud

Homelab map · sample layout

The homelab

How the pieces at home fit together, and the path a request takes to reach this site. A sample layout for now; the real lab is on its way.

HTTPSISPWireGuardNFSSMBInternetvisitors, anywherePangolinreverse proxy · TLSRouterfirewall · uplinkSwitchmanagedNewttunnel clientCaddysaumer.cloudRybbitanalyticsNFS exportappdataSMB sharefilesDesktops & laptopswired + Wi-Fi
HTTPSEthernetWireGuard tunnelProxied HTTPNFSSMB

The same map, in words

  • Internet visitors, anywhere

    Where requests come from. DNS for saumer.cloud points at the VPS, never at the house.

  • VPS rented, off-site

    A small rented server. It is the only part of the setup the internet talks to.

    • Pangolin reverse proxy · TLS

      Answers on port 443, terminates TLS and sends each request down a WireGuard tunnel to the lab. How it is locked down gets its own write-up.

  • Homelab St. Paul, MN

    Everything at home: one router, one switch, a Docker host and a TrueNAS box.

    • Router firewall · uplink

      The connection to the ISP and the firewall between the lab and the internet.

    • Switch managed

      The middle of it all. Every box at home plugs in here, and the NFS and SMB traffic crosses it.

    • Docker host containers

      Runs the containers. Its app data lives on TrueNAS over NFS, so the host itself is disposable.

      • Newt tunnel client

        Pangolin’s connector. Keeps the WireGuard tunnel to the VPS up and hands each request to the right container.

      • Caddy saumer.cloud

        Serves this website, read from the NFS share.

      • Rybbit analytics

        Self-hosted, cookieless analytics. Its database lives on the NFS share too.

    • TrueNAS ZFS storage

      The storage box. ZFS underneath, shared out over NFS for servers and SMB for people.

      • NFS export appdata

        Mounted by the Docker host. Holds container data and the website’s files.

      • SMB share files

        Plain file shares for the desktops and laptops in the house.

    • Desktops & laptops wired + Wi-Fi

      The everyday machines. They use the SMB share and nothing else on this map.

A request, hop by hop

  1. You ask for saumer.cloud. DNS sends you to the VPS, not to the house.
  2. Pangolin on the VPS answers over HTTPS and terminates TLS.
  3. The request rides the WireGuard tunnel home. On the wire it passes the router and switch; logically it comes out at Newt on the Docker host.
  4. Newt hands it to the Caddy container, which serves the site.
  5. Caddy reads the page from TrueNAS over NFS, across the switch.
  6. The response goes back the same way. Total trip: two boxes at home, one in a data centre.