Inside My Homelab - 2026

Hardware

Compute

Network Gear

Power Protection

Cloud

Network

Three dedicated physical interfaces on pfSense:

1
WAN Interface → Orange ISP (Bridge Mode)
2
LAN Interface → Homelab Network
3
WiFi Interface → Guest/IoT Isolation

Tailscale creates a flat network across all locations — homelab and Oracle both appear on the same mesh.

pfSense

A fanless mini PC from AliExpress (~200€) running pfSense for 3+ years: 👉 XCY X44 on AliExpress

Tailscale Subnet Router exposes the entire homelab to cloud VPS without installing Tailscale on every device. Also the solution to CGNAT — when your ISP doesn’t give you a public IP, this gets you in. Setup guide →

Unbound DNS runs as a local recursive resolver with domain overrides for *.k8s.merox.dev pointing to K8s-Gateway.

Telegraf pushes system metrics to Grafana.

Firewall rules: WiFi → LAN blocks everything except whitelisted apps; LAN → WAN allows all; WAN → Internal blocks all except explicitly exposed services.

Virtualization

Proxmox Cluster

Three-node cluster across the mini PCs. Each node runs one Talos VM, so Kubernetes has HA across physical hosts with no single point of failure.

Nodes:

Storage:

Current VMs:

Intel Iris Xe GPU on px-0 is passed through to the kubernetes-controlplane-1 VM for Jellyfin hardware transcoding (Intel QuickSync).

Synology DS223+

Dual purpose: NFS/SMB shares for the ARR stack (still experimenting with both protocols), and personal cloud via Synology Drive.

After 3 years of self-hosting Nextcloud, I switched. Better performance, native mobile apps that actually work, and zero maintenance. Sometimes the best self-hosted solution is the one you never have to think about.

Dell R720

The power-hungry workhorse. Its role has changed a few times:

The most interesting project was flashing the PERC controller to IT mode — bypasses hardware RAID so the OS sees drives directly. Fohdeesha’s crossflash guide covers H710/H310 and more.

At ~200W idle, running 24/7 costs ~€20/month in electricity. Right now it’s off most of the time — I boot it occasionally to benchmark power usage and figure out if there’s any workload that justifies keeping it on. Still undecided.

Power Management

The CyberPower UPS covers all mini PCs and network gear. When power fails, it triggers a cascading shutdown — Kubernetes nodes drain properly before Proxmox hosts go down.

Kubernetes

Fair warning: this is where I went full “because I can” mode. If you just want to run services, Docker is the right answer. But if you want to learn enterprise-grade container orchestration in your homelab, keep reading.

The starting point: onedr0p/cluster-template

Talos OS was the first immutable, declarative OS I’d run. After a few days of troubleshooting, I was sold.

My infrastructure repo: 👉 github.com/meroxdotdev/infrastructure

Key customizations:

GitOps structure:

1
kubernetes/apps/
2
├── cert-manager/     # TLS automation
3
├── default/          # Production workloads
4
├── flux-system/      # Flux operator + instance
5
├── kube-system/      # Cilium, CoreDNS, NFS CSI, metrics-server
6
├── network/          # k8s-gateway, Cloudflare tunnel + DNS
7
├── observability/    # Prometheus, Grafana, Loki
8
└── storage/          # Longhorn configuration

Deployed apps:

The live dashboard is public — current service status at inside.merox.dev.

LoadBalancer IPs are handled by Cilium’s L2 announcement — a pool of addresses (10.57.57.100–120) announced directly on the LAN via ARP, no external load balancer needed. Services like qBittorrent, k8s-gateway, and the Cloudflare tunnel endpoint each get a dedicated IP from this pool.

With this setup I can fully rebuild the cluster in 8–9 minutes — declarative config for everything, GitOps workflow with Flux, Renovate bot keeping dependencies updated.

For cluster deployment details, the onedr0p/cluster-template README is surprisingly well written and worth following directly.

Services

Managed through a single Portainer instance at cloud.merox.dev:

cloud-usa (Oracle Free Tier Ampere A1) — the only cloud node. Always-on, handles external access, backup target via rsync, and runs the OpenClaw infrastructure agent:

homelab-ro (local Docker) — lightweight services on the local Docker host:

Backup

• Longhorn PVCs → Garage S3 on Oracle Cloud (S3-compatible backup)
• Synology NAS → rsync to Oracle Cloud instance (off-site copy)

1
Kubernetes PVCs
2
      │
3
      ▼
4
Garage S3 (Oracle Cloud VPS, 200GB disk)   ◄── Synology NAS rsync

Garage runs on the Oracle VPS’s single 200GB boot disk — currently ~28GB used by Garage data, ~98GB free total. Not a lot of headroom, but more than enough for compressed PVC snapshots at this scale.

MinIO was the original S3 backend until it discontinued its Docker images and moved to a source-only model with known CVEs on older builds. Garage replaced it — lightweight, S3-compatible, runs fine on the Oracle free tier. Full migration walkthrough: Migrating Longhorn Backup from MinIO to Garage.

The R720’s backup role has been retired entirely — Garage on Oracle handles Longhorn backups, Synology handles local redundancy (2× 2TB RAID1) and rsyncs off-site to the same VPS. Simpler than spinning up a 200W server for weekly sync jobs. For full details on the backup chain and recovery procedures, see Safeguarding My Critical Data.