I completed Project 1 of my home infrastructure lab. It is a pre-cutover foundation for HA DNS, recursive DNS, monitoring, alerting, secure remote access, Proxmox-hosted services, and operational validation.
This repository intentionally stops at the core infrastructure foundation stage. Managed routing, managed switching, VLAN segmentation, firewall policy, and SSID-to-VLAN mapping are tracked separately in a follow-up network segmentation project.
| Area | Link |
|---|---|
| Current Status | phase-state.md |
| Roadmap | ROADMAP.md |
| Lessons Learned | LESSONS-LEARNED.md |
| Changelog | CHANGELOG.md |
| Project Closeout | docs/project-closeout.md |
| Documentation Hub | docs/ |
| Architecture Diagrams | diagrams/ |
| Config Examples | configs/ |
| Screenshots | screenshots/ |
Status: Complete / Closed Out
This repository documents Project 1 of my home infrastructure lab: a resilient home network foundation built before the managed router/switch cutover and VLAN segmentation work.
The completed scope includes centralized DNS, Pi-hole high availability, Unbound recursive DNS, monitoring and alerting, private remote access, Proxmox-hosted infrastructure services, Docker monitoring services, RustDesk remote access, and backup validation.
- Built a dual-node Pi-hole HA DNS design using Keepalived and a shared DNS VIP.
- Used Gravity Sync on the original Pi nodes. Nebula Sync is what replicates the Pi-hole pair now.
- Added Unbound for local recursive DNS resolution.
- Deployed Prometheus, Grafana, Alertmanager, Blackbox Exporter, and Node Exporter for monitoring and alerting.
- Implemented secure administration with Tailscale without exposing SSH publicly.
- Added LAN-only RustDesk remote access for trusted devices.
- Moved monitoring from workstation dependency to a Proxmox-hosted Docker VM.
- Documented validation evidence, backup coverage, diagrams, and operational lessons learned.
The completed lab provides a documented home infrastructure foundation with high-availability DNS, local recursive resolution, monitoring, alerting, secure remote access, and Proxmox-hosted core services.
Lab addresses in tracked text use the RFC 5737 documentation range
192.0.2.0/24, and machine names use generic roles. These examples preserve the relationships in the recorded layout and are not live connection details. Existing images are unchanged and need a separate visual review.
| Phase | Status | Focus |
|---|---|---|
| Phase 1 | ✅ Complete | Network control and baseline topology |
| Phase 1.5 | ✅ Complete | Xfinity to AT&T Fiber migration |
| Phase 2 | ✅ Complete | Pi-hole DNS control |
| Phase 3 | ✅ Complete | HA DNS with Keepalived and Unbound. Nebula Sync replaced Gravity Sync. |
| Phase 4 | ✅ Complete | Monitoring and alerting |
| Phase 5 | ✅ Complete | Tailscale secure remote access |
| Phase 5.5 | ✅ Complete | Tailscale subnet router and remote LAN access: dedicated subnet router VM advertising 192.0.2.0/24 into Tailscale |
| Phase 6 | ✅ Complete | Proxmox and Docker monitoring migration. The Omada controller from this phase is historical. |
| Phase 6.5 | ✅ Complete | RustDesk VM and hardened access. Portainer was the first Docker manager and is no longer current. It has not been removed. |
| Phase | Focus | Documentation |
|---|---|---|
| Phase 1 | Network Control | docs/phase-1-network-control |
| Phase 1.5 | ISP Migration | docs/phase-1.5-isp-migration |
| Phase 2 | DNS Control | docs/phase-2-dns-control |
| Phase 3 | High Availability DNS | docs/phase-3-ha-dns |
| Phase 4 | Monitoring & Alerting | docs/phase-4-monitoring-alerting |
| Phase 5 | Tailscale Remote Access | docs/phase-5-tailscale-remote-access |
| Phase 5.5 | Tailscale Subnet Router | docs/phase-5.5-tailscale-subnet-router |
| Phase 6 | Proxmox and Docker monitoring. Omada controller is historical. | docs/phase-6-proxmox-omada-foundation |
| Phase 6.5 | RustDesk Remote Access & VM Hardening | docs/phase-6.5-rustdesk-remote-access |
| Phase | Diagram |
|---|---|
| Phase 1, Previous Network / Xfinity | 01-phase-1-previous-network-xfinity.png |
| Phase 1.5, ISP Migration / AT&T Fiber | 02-phase-1-5-isp-migration-att.png |
| Phase 2, DNS Control | 03-phase-2-dns-control.png |
| Phase 3, High Availability DNS | 04-phase-3-ha-dns.png |
| Phase 4, Monitoring & Alerting | 05-phase-4-monitoring-alerting.png |
| Phase 5, Tailscale Remote Access | 06-phase-5-remote-access-tailscale.png |
| Phase 6, Proxmox Service Migration | 07-phase-6-proxmox-service-migration.png |
| Phase 6.5, RustDesk on Proxmox | 08-phase-6-5-rustdesk-proxmox.png |
| Tool / Service | Purpose |
|---|---|
| Pi-hole | DNS filtering and query visibility |
| Nebula Sync | Pi-hole configuration replication. Gravity Sync is retired. |
| Keepalived | HA DNS virtual IP failover |
| Unbound | Local recursive DNS resolution |
| Prometheus | Metrics collection |
| Grafana | Monitoring dashboards |
| Alertmanager | Alert routing |
| Blackbox Exporter | Endpoint and DNS probing |
| Node Exporter | Host metrics |
| Discord Webhooks | Alert delivery |
| Tailscale | Private remote administration |
| Proxmox | Virtualization platform |
| Docker Compose | Container deployment |
| RustDesk | Self-hosted remote access |
| Portainer | Former Docker manager. Not current, and not deleted yet. |
| Validation Area | What Was Confirmed |
|---|---|
| DNS Control | Clients used Pi-hole for DNS resolution |
| HA DNS | VIP remained available during failover testing |
| Nebula Sync | Pi-hole configuration replication in use now. Gravity Sync is retired. |
| Unbound | Local recursive DNS worked on both Pi-hole nodes |
| Monitoring | Prometheus targets and Grafana dashboards loaded correctly |
| Alerting | Alertmanager sent Discord notifications |
| Remote Access | Tailscale allowed secure remote administration |
| RustDesk | LAN-based RustDesk access worked between trusted devices |
| Proxmox | Core services were moved from workstation dependency to Proxmox |
| Backups | Proxmox backups were created for key VMs/LXCs |
Run these from the repo root before opening a PR:
python3 scripts/check-public-safety.py
python3 scripts/check-relative-links.pyThe first fails on unapproved MAC addresses, real network addresses and known internal machine names in tracked text, and reminds you to review every image by eye. The second fails on broken relative Markdown links. The Forgejo validate workflow runs both on push, plus a gitleaks secret scan. The GitHub mirror also runs a docs check on push to main and a gitleaks scan on every push.
The lab covers practical infrastructure engineering across:
- High availability DNS with Pi-hole, Keepalived, and Nebula Sync
- Local recursive DNS resolution with Unbound
- Monitoring and observability with Prometheus, Grafana, Node Exporter, and Blackbox Exporter
- Alert routing through Alertmanager and Discord notifications
- Secure private administration with Tailscale
- Proxmox-hosted infrastructure services
- Self-hosted RustDesk remote access
- Operational validation, failover testing, screenshots, and structured documentation
- No public SSH port forwarding is used.
- Tailscale provides private administrative access.
- RustDesk is kept LAN-only for this project.
- Portainer is no longer the current Docker manager. It has not been deleted, and it stays off the public internet.
- Monitoring services are kept LAN-only.
- Discord webhook secrets are stored locally and excluded from Git.
- Config examples use placeholders where sensitive values would normally exist.
- Screenshots should be reviewed for public IPs, MAC addresses, serial numbers, QR codes, tokens, webhook URLs, and personal identifiers before sharing externally.
- Secrets, passwords, tokens, and private keys are not committed.
- Network architecture planning
- ISP migration troubleshooting
- DNS control and filtering
- High availability service design
- Recursive DNS implementation
- Failover validation
- Monitoring and alerting
- Secret handling
- Secure remote administration
- Proxmox virtualization
- Docker service migration
- Infrastructure backup validation
- Documentation and screenshot-based proof of work
Routing, switching, VLAN, and firewall policy work is out of scope for this repository and is documented separately as a network segmentation project.
That follow-up project covers managed routing and switching (ER605 and Omada at first, UniFi since 2026-09-27). The Omada controller is historical and is not part of the current network. Deco nodes stay in AP mode. VLAN segmentation, firewall policy, and network isolation are still planned.
Build and document a realistic infrastructure foundation: networking, DNS, high availability, monitoring, alerting, virtualization, secure access, and operational validation.
This repository is part of a broader infrastructure lab portfolio.
| Repository | Focus | Relationship |
|---|---|---|
| Home Network Infrastructure Lab | HA DNS, Pi-hole, Unbound, monitoring, Tailscale, Proxmox, RustDesk | Core home infrastructure foundation |
| Home Network Managed Infrastructure Lab | Managed router and switching; VLANs, firewall policy, and segmentation planned | Builds on the home infrastructure foundation |
| VPS Cloud Infrastructure Lab | Linux VPS hardening, Docker, DNS, HTTPS, monitoring, backups, secure access | Extends infrastructure skills into cloud-hosted services |