> ## Content Index
> Fetch the complete content index at: https://blog.jgoode.dev/llms.txt
> Use this file to discover other available public pages before exploring further.

# Welcome to the Lab: A Tour of Everything I Run
- URL: https://blog.jgoode.dev/welcome-to-the-lab/
- Published: 2026-10-20T20:34:22.000Z
- Updated: 2026-10-20T20:34:22.000Z
- Description: Ten cloud instances, a Proxmox box, a Raspberry Pi and a bag of travel routers, all on one tailnet. Here's the map.
- Author: J. Goode
- Tags: The Lab, Logged, Homelab, Tailscale, #Import 2026-09-27 23:31

I've been in IT for over twenty-two years. Telecom, then sysadmin work, then cloud-native engineering, and these days I spend my day job deep in Kubernetes escalations. You'd think the last thing I'd want to do after work is run *more* infrastructure.

And yet.

Somewhere along the way the homelab stopped being a side hobby and became the place where I actually learn. Every certification I've picked up made more sense once I'd broken the thing it was describing on my own hardware. So this series is me finally writing it all down: what runs where, why it's built the way it is, the dumb mistakes, and the configs that ended up working.

This first post is the map. Everything after it is a deep dive into one piece.

![Diagram of the homelab: a Proxmox host, a Raspberry Pi and home network gear, ten Oracle Cloud instances across four regions, all joined by one tailnet](https://blog.jgoode.dev/content/images/2026/09/diagram-homelab-map-1.png)

The whole thing on one page. Home on the left, Oracle Cloud on the right, one tailnet underneath everything.

## The philosophy (such as it is)

Before the inventory, the handful of rules that shape every decision in here. They weren't planned. They're scar tissue.

- **Tailscale is the floor.** Every node joins one tailnet. Nothing depends on a home IP, a port forward or which Wi-Fi I happen to be on. If it's not on the tailnet, it doesn't exist.
- **Bind mounts over named volumes.** I want to be able to `ls` my data, back it up with plain tools and move it to another host by copying a folder.
- **Git is the source of truth.** Kubernetes workloads are GitOps via ArgoCD. Dashboards and trackers are rendered from YAML by CI. If it isn't in a repo, I assume I'll lose it.
- **Small scripts, not monoliths.** Five scripts that each do one thing beat one clever script I'm scared to touch.
- **Short hostnames.** Every node gets a short, pronounceable name. MagicDNS turns it into a real hostname, so `ssh <name>` works from anywhere on the tailnet.

🔒

You'll notice I describe machines by what they do — "the Docker host," "the Pi," "the Ashburn A1" — rather than by name. That's on purpose. Hostnames, ports and IDs are exactly the kind of breadcrumbs I'd rather not publish.

## Home

### The Proxmox host

One Proxmox host with 8 cores and 62 GB of RAM carries most of the at-home weight:

- **The Docker host** — an LXC running 90+ containers. Photos, documents, notes, location history, budgets, recipes. It gets its own post.
- **Forgejo + its database** — the git forge everything else hangs off of.
- **An Actions runner** — Forgejo Actions, using Podman for job containers.
- **Home Assistant** — running as a VM.
- **A few AI agents** from my OpenClaw fleet, each in its own container.

### The Pi that never sleeps

A Raspberry Pi 4 with 8 GB running DietPi. It's the always-on edge node: Vaultwarden, the Ghost instance serving this blog, a backup Forgejo, Navidrome, Syncthing (my Obsidian vault lives here) and MinIO. It also serves a handful of internal dashboards via `tailscale serve`. If the Proxmox box is down for maintenance, the Pi keeps the lights on.

### The network edge

Home internet comes through a GL.iNet **Puli AX** on a cellular plan. A **Firewalla** sits alongside it as its own box. The rest of the GL.iNet family — a Mudi 7, a Slate 7 and a couple of Brumes — are my travel kit, and every one of them has Tailscale SSH enabled so I can fix them from anywhere.

## The cloud

Ten Oracle Cloud instances across four regions, spread over four free-tier accounts to maximize what I can allocate. Two shapes: **A1** (Ampere ARM, the beefy ones) and **micro** (AMD E2.1.Micro, tiny and always on).

| Region    | A1 (ARM)                           | Micros (AMD)                                |
| --------- | ---------------------------------- | ------------------------------------------- |
| Ashburn   | K3s control plane + public ingress | DERP relay + primary tsidp · Technitium DNS |
| Phoenix   | K3s worker                         | NetRelay VPN panel · Technitium DNS         |
| Chicago   | K3s worker                         | — (no micro capacity, ever)                 |
| Frankfurt | K3s worker                         | Technitium DNS · general purpose            |

The four A1s form a single K3s cluster that spans three countries' worth of latency. The micros do the small, always-on jobs: a three-node DNS cluster, a DERP relay, an identity provider, a VPN control plane.

⚠️

Lesson learned the hard way: Chicago doesn't hand out AMD micro capacity at all. It's not a shortage you can wait out — newer OCI regions just don't allocate that shape. I spent a while running an ARM "hunter" script before figuring that out.

## What ties it together

![Homepage dashboard screenshot placeholder](https://blog.jgoode.dev/content/images/2026/10/Screenshot-2026-10-20-163040.png)

📸 My Homepage start page — the front door to all of it. (Small screenshot of a few services)

- **Portainer** for Docker workloads across nodes.
- **ArgoCD** for everything in Kubernetes.
- **Beszel** agents on nearly every box — including the GL.iNet routers — for at-a-glance health.
- **tsidp** for single sign-on, running on an OCI micro with backups on the Docker host and the Pi.
- **Pangolin** for the few things I expose publicly, and `tailscale serve` for everything that should stay private.
- **tsrecorder** recording every Tailscale SSH session into MinIO.
- **OpenClaw**, a fleet of twelve specialist AI agents plus HermesDispatch as the brain, that keep an eye on all of the above. It gets two posts of its own.

![Beszel systems list screenshot placeholder](https://blog.jgoode.dev/content/images/2026/10/Screenshot-2026-09-30-230657.png)

📸 Beszel's systems view. Green across the board is my favorite color.

## The roadmap

Here's where the series is headed. Everything linked is live; the rest is coming.

1. [Tailscale is the floor I build on](https://blog.jgoode.dev/tailscale-is-the-floor-i-build-on/) — the tailnet, MagicDNS gotchas, DNS, identity, SSH recording.
2. [One LXC, 90+ containers](https://blog.jgoode.dev/one-lxc-90-containers/) — how the Docker host is laid out and why it hasn't fallen over.
3. [A four-region ARM K3s cluster on Oracle's free tier](https://blog.jgoode.dev/a-four-region-arm-k3s-cluster-on-oracles-free-tier/) — Cilium over Tailscale, Longhorn, ArgoCD.
4. [Never lose a repo again](https://blog.jgoode.dev/never-lose-a-repo-forgejo-mirror-manager/) — Forgejo, a Podman runner and a mirror manager.
5. [Twelve specialists and a brain](https://blog.jgoode.dev/openclaw-twelve-agents-and-a-dispatcher/) — the OpenClaw AI agent fleet: who does what, where it runs, which model it thinks with.
6. [Agents propose, humans decide](https://blog.jgoode.dev/agents-propose-humans-decide-ordar/) — the ORDAR protocol, confirmation gates and the guardrails around the fleet.
7. [Five overlays, one panel](https://blog.jgoode.dev/netrelay-five-overlays-one-panel/) — NetRelay, my VPN control plane.
8. [Travel routers that phone home](https://blog.jgoode.dev/travel-routers-that-phone-home/) — the GL.iNet fleet, Tailscale in 45 MB, and drift checks.
9. [Watching the watchers](https://blog.jgoode.dev/watching-the-watchers-homelab-siem/) — Wazuh, Suricata and the security layer.
10. **Coming:** a low-collision IP addressing plan · Garage S3 across nodes · secrets with SOPS + age · Tailscale exit-node automation with Tasker · building MCAdmin for the family Minecraft server · the self-hosted Life360 replacement · the Ghost theme you're looking at.

If there's one you want sooner, tell me. Otherwise — see you in Part 1.