Welcome to the Lab: A Tour of Everything I Run

I've been in IT for over twenty-two years. Telecom, then sysadmin work, then cloud-native engineering, and these days I spend my day job deep in Kubernetes escalations. You'd think the last thing I'd want to do after work is run more infrastructure.

And yet.

Somewhere along the way the homelab stopped being a side hobby and became the place where I actually learn. Every certification I've picked up made more sense once I'd broken the thing it was describing on my own hardware. So this series is me finally writing it all down: what runs where, why it's built the way it is, the dumb mistakes, and the configs that ended up working.

This first post is the map. Everything after it is a deep dive into one piece.

The philosophy (such as it is)

Before the inventory, the handful of rules that shape every decision in here. They weren't planned. They're scar tissue.

• Tailscale is the floor. Every node joins one tailnet. Nothing depends on a home IP, a port forward or which Wi-Fi I happen to be on. If it's not on the tailnet, it doesn't exist.
• Bind mounts over named volumes. I want to be able to ls my data, back it up with plain tools and move it to another host by copying a folder.
• Git is the source of truth. Kubernetes workloads are GitOps via ArgoCD. Dashboards and trackers are rendered from YAML by CI. If it isn't in a repo, I assume I'll lose it.
• Small scripts, not monoliths. Five scripts that each do one thing beat one clever script I'm scared to touch.
• Short hostnames. Every node gets a short, pronounceable name. MagicDNS turns it into a real hostname, so ssh <name> works from anywhere on the tailnet.

Home

The Proxmox host

One Proxmox host with 8 cores and 62 GB of RAM carries most of the at-home weight:

• The Docker host — an LXC running 90+ containers. Photos, documents, notes, location history, budgets, recipes. It gets its own post.
• Forgejo + its database — the git forge everything else hangs off of.
• An Actions runner — Forgejo Actions, using Podman for job containers.
• Home Assistant — running as a VM.
• A few AI agents from my OpenClaw fleet, each in its own container.

The Pi that never sleeps

A Raspberry Pi 4 with 8 GB running DietPi. It's the always-on edge node: Vaultwarden, the Ghost instance serving this blog, a backup Forgejo, Navidrome, Syncthing (my Obsidian vault lives here) and MinIO. It also serves a handful of internal dashboards via tailscale serve. If the Proxmox box is down for maintenance, the Pi keeps the lights on.

The network edge

Home internet comes through a GL.iNet Puli AX on a cellular plan. A Firewalla sits alongside it as its own box. The rest of the GL.iNet family — a Mudi 7, a Slate 7 and a couple of Brumes — are my travel kit, and every one of them has Tailscale SSH enabled so I can fix them from anywhere.

The cloud

Ten Oracle Cloud instances across four regions, spread over four free-tier accounts to maximize what I can allocate. Two shapes: A1 (Ampere ARM, the beefy ones) and micro (AMD E2.1.Micro, tiny and always on).

The four A1s form a single K3s cluster that spans three countries' worth of latency. The micros do the small, always-on jobs: a three-node DNS cluster, a DERP relay, an identity provider, a VPN control plane.

What ties it together

• Portainer for Docker workloads across nodes.
• ArgoCD for everything in Kubernetes.
• Beszel agents on nearly every box — including the GL.iNet routers — for at-a-glance health.
• tsidp for single sign-on, running on an OCI micro with backups on the Docker host and the Pi.
• Pangolin for the few things I expose publicly, and tailscale serve for everything that should stay private.
• tsrecorder recording every Tailscale SSH session into MinIO.
• OpenClaw, a fleet of twelve specialist AI agents plus HermesDispatch as the brain, that keep an eye on all of the above. It gets two posts of its own.

The roadmap

Here's where the series is headed. Everything linked is live; the rest is coming.

1. Tailscale is the floor I build on — the tailnet, MagicDNS gotchas, DNS, identity, SSH recording.
2. One LXC, 90+ containers — how the Docker host is laid out and why it hasn't fallen over.
3. A four-region ARM K3s cluster on Oracle's free tier — Cilium over Tailscale, Longhorn, ArgoCD.
4. Never lose a repo again — Forgejo, a Podman runner and a mirror manager.
5. Twelve specialists and a brain — the OpenClaw AI agent fleet: who does what, where it runs, which model it thinks with.
6. Agents propose, humans decide — the ORDAR protocol, confirmation gates and the guardrails around the fleet.
7. Five overlays, one panel — NetRelay, my VPN control plane.
8. Travel routers that phone home — the GL.iNet fleet, Tailscale in 45 MB, and drift checks.
9. Watching the watchers — Wazuh, Suricata and the security layer.
10. Coming: a low-collision IP addressing plan · Garage S3 across nodes · secrets with SOPS + age · Tailscale exit-node automation with Tasker · building MCAdmin for the family Minecraft server · the self-hosted Life360 replacement · the Ghost theme you're looking at.

If there's one you want sooner, tell me. Otherwise — see you in Part 1.