Homelab
The lab spans two sites with different purposes.
Equinix ME1 (Colocation)
The colo allocation at Equinix ME1 handles anything that needs to be externally accessible, high performance, reliable power and internet, and some level of redundancy. If it needs to stay up or face the internet, it lives here.
Melbourne (Home)
The home side is for bulk storage, media, and services that benefit from low latency to the local network. It also acts as an offsite backup target for the colo, and is where most development work happens before anything graduates to production.
Across both sites
The two sites are connected via an IPSec tunnel for site-to-site traffic, with Tailscale layered on top for management access and interconnectivity between nodes. Between the two, nothing needs to be exposed publicly just to be reachable from the other side.
Topology
flowchart LR
subgraph COLO["Equinix ME1 - Colocation"]
P1["Proxmox VE - public-facing"]
PBS1["Proxmox Backup Server"]
end
subgraph HOME["Melbourne - Home"]
P2["Proxmox VE - storage / media"]
PBS2["PBS - offsite target"]
end
P1 <-->|IPSec site-to-site| P2
P1 -.->|Tailscale overlay| P2
PBS1 -->|cross-site offload| PBS2
The colo handles anything that needs to be externally reachable, on reliable power and internet. Home is for bulk storage, media, and acting as an offsite backup target. Nothing has to be exposed publicly just to be reachable from the other side.
Compute & Virtualisation
- Proxmox VE - hypervisor on both sites, running VMs and LXC containers.
- Self-hosted GitHub Actions runners - CI/CD workloads close to the lab.
Storage & Backup
- Proxmox Backup Server - scheduled VM and LXC backups with cross-site offloading, so a failure at one site is recoverable from the other.
- LVM - the disk and volume layer underneath most of the above.
Identity & Secrets
- HashiCorp Vault - centralised secrets for CI/CD pipelines and self-hosted services, including secret injection into Docker containers.
- Authentik - SSO across self-hosted services, managed in Terraform.
Automation & IaC
- Terraform - DNS, Vault policies, GitHub Actions roles, and Authentik configuration, all version-controlled.
- GitHub Actions - validate / plan on PRs, apply on merge to
main. - Cloudflare - DNS, managed as code.
Networking
- IPSec - site-to-site tunnel between colo and home.
- Tailscale - management access and node-to-node connectivity layered on top.