aicowboi
  • Groot homelab
  • One box
  • Many critters

The lab

Groot is my homelab: a "personal cloud" that lives in one quiet box at home. It hosts my apps, my media and my experiments, and it was built so the public internet can only ever touch a small, fenced-off corner of it.

Diagram: visitors reach public apps in the DMZ through Cloudflare and an outbound tunnel; a firewall fence keeps the DMZ out of the home network; the owner reaches everything privately over Tailscale.The internetThe ranch · ProxmoxDMZHome networkOPNsense fence · no trail from DMZ to homeThe ranchertunnelVisitorsCloudflareTLS · bot shieldReverse proxyPublic appssites · finance · requestsMedia &automationPrivatetoolsAdminconsolesYou, anywhereTailscaleprivate meshDiagram: visitors reach public apps in the DMZ through Cloudflare and an outbound tunnel; a firewall fence keeps the DMZ out of the home network; the owner reaches everything privately over Tailscale.The internetThe ranch · ProxmoxDMZHome networkOPNsense fence · no trail to homeThe ranchertunnelwhole ranchVisitorsCloudflareTLS · bot shieldReverse proxyPublic appssites · finance · requestsMedia &automationPrivatetoolsAdminconsolesYou, anywhereTailscaleprivate mesh
How traffic finds its way in. Visitors arrive through Cloudflare and an outbound-only tunnel into the DMZ; the owner arrives privately over Tailscale.
Trail map

Six stops on the ranch

  1. Proxmox VE

    The ranch

    One small, efficient server runs Proxmox, which splits it into dozens of virtual machines and lightweight containers. Each service gets its own pen, so a misbehaving one can be snapshotted, rolled back or rebuilt without touching the rest.

  2. OPNsense

    The fence line

    Anything that faces the public lives in a separate DMZ network behind an OPNsense firewall. The DMZ can reach the internet, but it cannot wander into the home network. Public apps and private life never share a corral.

  3. Cloudflare Tunnel

    The front gate

    Public sites come in through a Cloudflare Tunnel that the lab dials out to. Nothing listens on the home router and the home address stays hidden; Cloudflare handles TLS and keeps the riff-raff out before a request ever reaches the ranch.

  4. Tailscale

    The back trail

    Admin panels are never public. To check on the herd from the road, I use Tailscale: a private, encrypted mesh that makes the lab feel like it is in the next room, wherever I am.

  5. Media & request automation

    The picture show

    Friends and family can ask for a film or a series from a simple request page. Automation takes it from there: it finds, files and tidies, and the media server has it ready on movie night. Books and audiobooks get the same treatment.

  6. Coolify

    The workshop

    New sites ship the lazy way: push to a Git repo and Coolify builds the container and rolls it out. This very page got here like that. A private status page keeps an eye on everything, and a privacy-friendly counter (no cookies) tells me if anyone stopped by.

House style

Ranch rules

  • Nothing public at home

    Public things live only in the DMZ, and only reach the world through the tunnel.

  • Admin stays private

    Dashboards and consoles are reachable over the private network only.

  • Everything reversible

    Snapshot first, change second, and write down how to undo it.

  • Low maintenance

    Automatic updates, config in files, and as few moving parts as possible.

Still building

Like any ranch, it is never finished. There is always a fence to mend or a new critter to house.

See the projectsLab status