Infrastructure · Networking · Security

Jack Verville.

I design, build, and break real systems. What started as a homelab is now a production-patterned hybrid cloud/on-prem environment — real infrastructure running real workloads, provisioned as code and operated the way a real infrastructure team would run it.

statusactively building runninghybrid OCI / on-prem homelab stackTerraform · Kubernetes · GitOps

I like understanding systems by actually operating them, not just reading about them. My homelab is a hybrid environment: a public-facing zero-trust edge on Oracle Cloud, a Kubernetes cluster and Docker host on-prem, all provisioned from a single Terraform/Terragrunt monorepo and continuously reconciled with GitOps — the same patterns real infrastructure teams run, at a scale I fully own end to end.

That includes writing my own runbooks, working through real incidents, and documenting root causes afterward instead of just patching around them -- the discipline of running infrastructure someone actually depends on, not just standing it up once and walking away.


Featured projectlive

The Homelab

A hybrid cloud / on-prem environment, provisioned entirely as code.

A single source of truth — every host, subnet, and service is declared once and generates everything downstream from it: Terraform resources, GitOps manifests, DNS records, reverse-proxy config. Nothing hand-duplicated.

Architecture
EDGE Oracle Cloud — public zero-trust edge

A public-facing controller/router built on OpenZiti — internal services are reachable with no open inbound ports on the home network.

CORE 3× on-prem Proxmox hosts

Every VM is provisioned from a single declarative host definition — no manual clicking, no drift between what's declared and what's running. Currently 20 hosts total.

RUN 3-node Talos cluster + 3× Docker host

A combined control-plane/worker Talos cluster (45 pods running) reconciled continuously by Flux GitOps, alongside Docker hosts for services that don't need an orchestrator — 8 apps on Kubernetes, 3 on Docker, 6 on their own dedicated VM.

SEC 5× security & observability tools

Wazuh SIEM, Greenbone vulnerability scanning, and an isolated attack range for hands-on offensive/defensive practice — plus LibreNMS and Nautobot for network monitoring and source-of-truth.

Network segmentation 14 VLANs off one trunk, segmented by function and trust level rather than one flat network — a compromised IoT device or the isolated attack-range lab has no path to production or management traffic by design.
CORE SWITCH — 802.1Q TRUNK
Workload tiers
DMZVLAN 10
ProductionVLAN 20
DevelopmentVLAN 30
Infra & storage
ManagementVLAN 40
Storage frontVLAN 50
Storage backVLAN 60
Isolated segments
IoTVLAN 70
Security toolsVLAN 80
Security labVLAN 90
Access tiers
GuestsVLAN 100
UsersVLAN 110
AdminsVLAN 120
VPN usersVLAN 130
How it works

Reaching an app remotely, with no open inbound ports:

Client
Ziti Desktop / Mobile Edge
Overlay
OpenZiti controller + router
Proxy
Traefik — single ingress point
SSO gate
Authentik — OIDC / SAML
App
Kubernetes or Docker

Nothing on the home network ever accepts an inbound connection. A Ziti client dials out to the public controller, which brokers an outbound-only tunnel back through the home router to Traefik — the same reverse proxy every request goes through, local or remote — which enforces an Authentik SSO gate before most apps are ever reached.

Shipping a change, GitOps-style:

Commit
git push to main
Reconcile
Flux polls the repo
Apply
Cluster converges to match
Publish
Wiki + this page's live stats regenerate

Every change to this repo — including the numbers on this page — flows through the same pipeline: commit, reconcile, apply. No manual kubectl apply, no clicking through a UI to make it real.

Enrolling a new user, without ever hand-provisioning an account:

Intake
Public form, no login required
Review
n8n checks existing identities
Approve
Slack DM — one human decision
Commit
n8n commits the new user to git
Provision
CI applies — Terraform creates the account
Enroll
Emailed a QR code to enroll their identity

The intake form is the only thing a not-yet-provisioned person can reach — they have no Ziti identity yet, so it runs over a narrowly-scoped public tunnel instead of the zero-trust overlay above. Approval isn't a rubber stamp on a database write: it's a single human decision that produces a git commit, and Terraform is still the only thing that ever actually creates the account — the same GitOps pipeline as everything else here, just triggered by a Slack click instead of by hand. A symmetric offboarding flow tears the account back down the same way.

Stack
IaC
Terraform + Terragrunt — single source of truth for hosts, network, and services
GitOps
Flux CD — continuously reconciles the Kubernetes cluster from git
Zero trust
OpenZiti overlay — no open inbound ports on the home network
Identity
Authentik SSO fronting internal and Kubernetes-hosted apps
Security
Wazuh + Greenbone, plus an isolated attack range for practice
Observability
LibreNMS monitoring, Nautobot source-of-truth with Golden Config
Automation
n8n running real household/ops workflow pipelines
Backup & DR
Proxmox Backup Server + restic, with a written and tested DR runbook
Live from the reporefreshes ~30min

Not a snapshot — pulled from the same generator that keeps the internal wiki honest, counts and generic service names only.

Hosts managed
20 Terraform-provisioned
Kubernetes
3 nodes · 45 pods running
Services deployed
17 across the stack
Infrastructure as code
13,066 lines across 26 Terraform blueprints
Commits
2,004 to this repo
Deployed right now
actualbudgetauthentikdocsfreecadgns3greenbonegrocyhome_assistanthomepagelibrenmsn8nnautobottechnitiumtraefikunifiwazuhzabbix

Last synced: 2026-08-31T00:49:17Z

Real hardware, not just VMs
  • RADIUS/AAA live on a physical Cisco CBS350 switch
  • Nautobot + Golden Config compliance checked against real hardware
  • LibreNMS SNMP/LLDP monitoring against real gear
GNS3 labs Pulled directly from what's actually running on the lab server — not a writeup after the fact.
BGP

BGP Lab 1

in progress

A 9-router partial mesh behind a simulated ISP edge, built for BGP practice.

ISP edge — Cisco IOSv 15.9(3)M6
Router — Cisco IOSv 15.9(3)M6

Click a device to view its configuration.

Drag nodes to rearrange — click one to view its config.


Reference

Skills & Stack

IaC & Automation
TerraformTerragruntAnsiblen8n
Kubernetes & GitOps
TalosFlux CDKustomizeDocker
Networking
Cisco IOS / IOS-XEOSPFEIGRPBGPVLANs & FHRPIPsec / DMVPNPalo Alto PAN-OS
Security
OpenZiti (zero trust)Authentik (SSO/OIDC)WazuhGreenboneRADIUS / AAA
Observability
LibreNMSNautobotZabbix

Get in touch

Let's talk