Skip to content
DevSecOps Homelab

Homelab Platform Architecture

Layered Architecture

Section titled “Layered Architecture”
flowchart TB
  internet[Internet] --> vps[VPS: DNS anchor + Zero Trust entrypoint]
  vps --> vpn[Tailscale / WireGuard / Cloudflare Access]
  vpn --> opnsense[OPNsense firewall]


  opnsense --> mgmt[MGMT VLAN: platform administration]
  opnsense --> trust[TRUST VLAN: authentik + OpenBao + PKI]
  opnsense --> k8s[K8S VLAN: Kubernetes nodes]
  opnsense --> goad[GOAD VLAN: vulnerable AD lab]
  opnsense --> backup[BACKUP VLAN: repositories and archives]


  trust --> k8s
  k8s --> apps[Weather staging and production]
  goad --> soc[Wazuh + ELK/OpenSearch detections]

Trust Boundaries

Section titled “Trust Boundaries”
  • Platform administration stays in MGMT.
  • authentik, OpenBao and PKI stay outside Kubernetes to avoid circular dependencies.
  • GOAD is hostile and must not become production identity.
  • The VPS is an entrypoint and external probe, not an unrestricted bridge into the lab.

Open Substrate Decision

Section titled “Open Substrate Decision”

ADR-0013 decides whether the host substrate remains Proxmox or moves to NixOS plus Incus. This architecture keeps the trust boundaries stable while the implementation substrate is evaluated.

Operational Principle

Section titled “Operational Principle”

Every platform change must be previewed first: Terraform plan, Ansible check mode, Kubernetes diff, Helm template, Argo CD app diff or equivalent dry-run.