Architecture

The environment follows a layered design. Each layer has a narrow responsibility, which makes individual parts easier to replace without redesigning everything around them.

Network edge

The edge provides the shared plumbing: local name resolution, reverse proxying, certificate management, and traffic screening. Applications do not each need to reinvent those concerns, and internal-only services can remain internal even when they use familiar web addresses and HTTPS.

Physical network

The managed switch expands the number of wired connections available for servers, the dashboard, workstations, and other fixed devices.

Internet service arrives over Mediacom’s cable network through a cable modem. The household router provides routing, firewalling, and wireless access, while the managed switch connects the wired server and client environment.

    flowchart LR
  internet(("Internet")) --> modem["ARRIS SB6190<br/>cable modem"]

  subgraph lan["HOME NETWORK"]
    direction LR
    router["Netgear R6400v2<br/>router · firewall · Wi-Fi"]
    switch["Netgear GS108E<br/>managed Gigabit switch"]
    wifi(["Wireless clients"])
    wired["Servers · dashboard<br/>wired clients"]
    router --> switch --> wired
    router --> wifi
  end

  modem --> router

  classDef external fill:#18201d,stroke:#718078,color:#dbe8e1;
  classDef network fill:#14242c,stroke:#5ca8c7,color:#c9eafa;
  classDef client fill:#282416,stroke:#c6a95b,color:#f2e4b8;
  class internet external;
  class modem,router,switch network;
  class wifi,wired client;
  

Compute

Virtual machines separate infrastructure roles from the physical hardware beneath them. Docker Compose supplies a lightweight application boundary inside those machines. A service is usually represented as a small project containing an application and its immediate dependencies.

The design favors understandable failure domains over a single enormous container stack. Edge services and application services can be maintained separately, while selected workloads can move to specialized hardware when they need a GPU or another uncommon resource.

Proxmox virtual machines

The primary Proxmox VE host currently provides these machine roles. Resource values describe the declarative definitions where those definitions exist.

    flowchart LR
  subgraph pve["PROXMOX VE HOST"]
    direction TB
    edgevm["Edge VM<br/>DNS · ingress · certificates"]
    gpuapps["GPU application VM<br/>local AI · voice"]
    apps["Primary application VM<br/>Docker Compose"]
    k3s["K3s VM<br/>personal web apps"]
    cicd["CI/CD VM<br/>restricted builds · trusted deploys"]
    pbx["PBX VM<br/>telephony"]
    dev["Development VM<br/>control · automation"]
  end

  gpu["RTX 4060"] -. passthrough .-> gpuapps
  truenas[("TrueNAS SCALE<br/>shared ZFS storage")]
  gpuapps <--> truenas
  apps <--> truenas

  classDef compute fill:#211b32,stroke:#9c82d4,color:#e3d9fa;
  classDef hardware fill:#282416,stroke:#c6a95b,color:#f2e4b8;
  classDef storage fill:#10271e,stroke:#58b184,color:#c7efda;
  class edgevm,gpuapps,apps,k3s,cicd,pbx,dev compute;
  class gpu hardware;
  class truenas storage;
  

Storage

Data placement follows ownership: