Hybrid homelab

Context

My personal infrastructure: a learning ground, and the hosting for my projects. The starting requirement: it must be rebuildable from a Git repository, with no manual step.

Architecture principle

• Inbound traffic: through Cloudflare only (Tunnel and Access). No inbound port open to the Internet.
• Machine-to-machine traffic: through Tailscale only.
• Placement by criticality: public content on Cloudflare (Pages, Workers); exposed services as containers on VPSes; internal and heavy workloads (storage, backups, metrics) at home, on Proxmox.

What I did

• Set up two Proxmox nodes at home and several VPSes in Paris and in the cloud, all running Debian 13.
• Wrote Ansible roles for the whole fleet: common base, hardening, Tailscale, recursive DNS, Docker, Cloudflare Tunnel, Caddy, monitoring agents, backups.
• Hardened every host: key-only SSH, nftables firewall on drop, sysctl, AppArmor, unneeded services removed.
• Encrypted secrets in the repository with SOPS and age.
• Put the admin interfaces behind Cloudflare Access, with documented fallback access.
• Set up monitoring with Zabbix and Grafana.
• Wrote the migration and rebuild procedures.

What I took from it

• A role is only done when it is idempotent: the second run changes nothing.
• Docker bypasses the firewall for published ports: I bind them to 127.0.0.1 or the Tailscale address, and a test fails otherwise.
• A documented infrastructure gets rebuilt instead of repaired.