HOMELAB DUAL-PLANE INGRESS & OBSERVABILITY ARCHITECTURE Proxmox VE (16GB RAM) · Single Authority RouterOS DHCP · Sanitized OpSec Blueprint WAN Ingress [LAN] Probe PUBLIC EDGE Untrusted Ingress External Users *.edge.internal Public Clients HTTPS / Port 443 Cloudflare Edge WAF + GeoFilter • Strict SSL/TLS • DDoS Protection • IP Whitelist cloudflare_ips Origin Ingress Port 443 Tailscale VPN Overlay Mesh Admin Direct Auth Zero-WAN Exposure PERIMETER & IDENTITY GATEWAY Ingress / Auth Boundary EDGE-PROXY Traefik Ingress Port 80/443 (Edge Only) • Cloudflare Ingress Proxy • Dynamic Provider (Docker/File) • ForwardAuth Middleware Status: LAN=UP · Edge Verified IAM-AUTH Authelia Gateway ForwardAuth / OIDC Broker • 2FA / WebAuthn / TOTP • OIDC Client Broker LDAP / LLDAP Identity SSoT DHCP-SSOT MikroTik RouterOS Core Gateway (Single Authority) • Authoritative DHCP Server • Static MAC-to-IP Binding SSoT • Ephemeral Flash Invariant (<2MB) Dual Backup: .rsc + .backup Port Forwarding: 80/443 strictly PROXMOX COMPUTE FABRIC Hypervisor Cluster (16GB RAM budget) Secret Vault · Vaultwarden IAM Secrets Manager End-to-End Encrypted Storage App Platform · Coolify Application Orchestrator Continuous Deployment Runner DNS Resolver · AdGuard Home Client / IoT Subnet DNS Anti-Circular Substrate Law Autonomous SRE · Butler Agent Least-Privilege REST Prober Fleet Health & Incident Triage Host Invariants (ZFS) • net0: ip=dhcp (Enforced) • Zero Root SSH Injection • RAM Headroom > 15% Safe • Podman NET_RAW Preserved Sub-2s Batch Telemetry (pct list) DUAL-PLANE OBSERVABILITY Probes & Telemetry Aggregation DUAL-PLANE Uptime Kuma Synthetic Prober Engine [LAN] Compute Health Raw Container Health (Zero Latency) [WAN] Edge Reachability Public Endpoint (TLS + Routing) Correlation: LAN=UP & WAN=DOWN LOG-SINK VictoriaLogs SSoT LogSQL Query Engine • Centralized Container Log Ingestion • Fast Incident Triage (Tier-1 First) • Anti-Terminal Hunting Invariant Sub-Second Filter: _time:1h AND error Telemetry Integration Sanitized JSON Sync to GitHub Pages /data/telemetry.json (Offline Cached)