Architecture

A high-level view of how the home lab is put together.

graph TD
    Internet([Internet]) --> Router[Router / Firewall]
    Router --> Host["ThinkCentre M920q
Proxmox VE (master node)"]

    subgraph Proxmox["Proxmox VE"]
        Docker["docker-host (VM)
Docker + Portainer"]
    end

    Host --> Proxmox

    subgraph Containers["Portainer-managed containers"]
        Svc1[Services]
    end

    Docker --> Containers

    Router --> NAS["WD My Cloud EX2 Ultra
(NAS — family backups)"]

    Router --> K3s["4 x Raspberry Pi 4B (8GB)
k3s HA cluster
(see diagram below)"]

• Host: a Lenovo ThinkCentre M920q running Proxmox VE as the master node (see Hardware).
• Virtualization: Proxmox hosts a docker-host VM (Ubuntu Server) that runs Docker.
• Containers: workloads run as Docker containers, managed through Portainer (see Software & Services).
• NAS: a WD My Cloud EX2 Ultra handles family backups (see Storage & Backups).
• k3s cluster: 4 × Raspberry Pi 4B (8 GB) run a highly-available k3s cluster — see below for what's running inside it.

Inside the k3s cluster

graph TD
    Router2[Router / Firewall] --> MetalLB
    Router2 -. LAN DNS .-> Pihole

    subgraph K3s["4 x Raspberry Pi 4B (8GB) -- k3s HA cluster"]
        direction TB
        MetalLB["MetalLB
bare-metal LoadBalancer"]
        Ingress["ingress-nginx"]
        CertManager["cert-manager
trusted TLS via DNS-01"]
        Longhorn["Longhorn
replicated block storage"]
        Pihole["Pi-hole
network-wide DNS + ad-blocking"]

        MetalLB --> Ingress
        CertManager --> Ingress
        Ingress --> Pihole
        Pihole --> Longhorn
    end

All 4 nodes run as control-plane + etcd members, tolerating the loss of one. MetalLB hands out LoadBalancer IPs on the LAN, ingress-nginx routes HTTP(S) traffic, and cert-manager issues real, trusted TLS certificates via a DNS-01 challenge — so internal-only services get valid HTTPS without any inbound exposure to the internet. Longhorn provides replicated block storage across the 4 nodes so a single node failure doesn't lose data. Pi-hole runs as the first real workload, serving DNS and ad-blocking for every device on the network (see Software & Services and Storage & Backups).

The diagrams above are rendered with Mermaid loaded from a CDN.