Home Server Infrastructure Overview

Overview

My Home Lab is a personal, on-prem infrastructure running on three nodes: Athena, Hades, and Daedalus. I built it to host service deployments, AI / Local LLM experiments, NAS workflows, and FPGA / PCIe hardware tests.

It started with every role on a single Hades box, but as the compute I needed grew, I rebuilt it into the current layout that physically separates compute / storage / hardware testing. Each node uses its own IP range, and inter-node access is connected only through WireGuard VPN.

Node Architecture

Each node’s hosted workloads, decisions, and operational incidents are covered on the node pages above.

Why Separate Roles

My earlier web projects were tested almost entirely on localhost, so I never got to experience the networking, auth, DB, and deployment problems that show up once a real external user connects. A commercial cloud could cover some of that, but the monthly cost was a burden — and since I work across a Windows desktop and a MacBook, I needed a central file store anyway. On top of that, hardware experiments like FPGA and PCIe are effectively impossible in a cloud environment.

Initially I put NAS, services, VPN, and the experiment environment all on a single Hades box, but the MicroServer’s limited memory expansion meant it hit a wall quickly. So I split compute out to Athena, refocused Hades on Storage/Core, and added Daedalus as a separate node for hardware experiments — the current structure.

Network & Security

IP range per node

• Hades: 192.168.100.X
• Athena: 192.168.200.X

VPN topology

• One VM on each of Hades / Athena runs WireGuard as the VPN endpoint
• Daedalus runs a WireGuard client on Ubuntu to reach both nodes’ internal networks
• AllowedIPs routes only management traffic through the VPN, keeping ordinary internet traffic separate

Public ports (minimized)

• Hades: NAS service + WireGuard ports only
• Athena: WireGuard port only
• Daedalus: no direct exposure (VPN-only access)

Security policy

• SSH is never exposed directly to the public internet — administration happens only over the internal network after connecting via VPN
• Root account login is disabled
• Fail2ban is applied to public NAS services (5 password failures within 24 h → 24 h ban)
• The real incident behind these policies is covered in Hades · Operations & Incidents.

Operational Snapshot

The disks consist of a 4 TB Main Storage used for primary NAS data and a 6 TB Backup Storage for the rsync backup.

Node-level metrics — uptime, number of hosted VMs/containers, latest backup result — are in the “At a Glance” section of each node page.

Technology Choices

Future Plans

The current infrastructure mixes manual setup with partial automation. I keep only the high-priority improvements here and leave the rest in each node page’s “Limitations & Next Steps”.

• Monitoring/alerting — visualize node/service state and backup results with Prometheus + Grafana
• Recovery-test automation — periodically verify that a backup is a restorable backup
• IaC for server setup — fix the node-rebuild procedure as code with Ansible
• Stronger network separation — separate NAS / management / experiment traffic more clearly with VLAN / firewall policy

Per-node improvement items (GPU resource scheduling, ZFS review, FPGA environment upgrades, etc.) are covered on the individual node pages.

Korean version: 홈 서버 인프라 개요