Self-Hosted Infrastructure

Why I Built It

I got tired of relying on random third-party cloud services for things I could run myself, so I built my own rack of bare-metal hardware at home. It started as a single old PC running Docker containers and eventually turned into a fully automated Proxmox cluster running production-grade workloads.

What’s Running

• Bare-Metal Proxmox VE: Hypervisor hosting LXC containers and VMs for all internal and public services.
• Terraform (IaC): I don’t click around in web UIs to spin up infrastructure anymore. All VMs, storage pools, and network routes are written as Terraform code, so if a box dies, I can recreate it in minutes.
• Zero-Trust Security: No open ports forwarded on my router. Everything external routes through authenticated Cloudflare Tunnels backed by OPNSense firewall rules.
• Automated Snapshots & Backups: Daily snapshots sent to isolated storage with tested rollback routines so I can break things without fear.

The Network Layout

• OPNSense Firewall: Custom physical box running OPNSense to handle routing, IDS/IPS, and local DNS.
• VLAN Isolation: Strict network segregation—IoT devices, guest Wi-Fi, internal lab servers, and public-facing services can’t talk to each other unless explicitly allowed.
• Monitoring & Observability: Prometheus and Grafana dashboards tracking CPU thermals, RAM usage, storage pools, and network throughput across every node.

Stuff I Learned

Configuring everything as code takes longer upfront, but it saved me countless hours the first time a drive corrupted and I rebuilt an entire environment with a single terraform apply. Building this gave me a deep appreciation for Linux internals, packet filtering, and why defense-in-depth actually matters.