Infrastructure Notes

Marcus G. Steck

Building a pragmatic home and edge platform: secure remote access, private DNS, reverse proxying, observability, and automated backups.

What this system is

A split setup with a public VPS for internet-facing entrypoints and a private tailnet for internal services. Workloads run mainly as Docker stacks (NAS + VPS). A firewall HA pair provides routing, policy enforcement, and TLS termination.

Core building blocks

  • VPS: public ingress, Headscale control-plane, selected utilities.
  • NAS: Docker workloads (apps), Traefik, Prometheus exporters.
  • Firewalls (HA): OPNsense pair, HAProxy, ACME wildcard TLS, policy routing.
  • Tailnet: device identity + encrypted connectivity; internal apps use private DNS.

Security posture (high level)

  • Internal apps live on private subdomains and are reachable only via tailnet or LAN policy.
  • Service exposure is minimized: reverse proxy + TLS termination; no broad port exposure.
  • Access is constrained via ACLs/tags and firewall rules.

Technical overview

I keep a living document describing how the VPS, Docker stacks, DNS split-horizon, reverse proxies, wildcard certificate automation, and firewall routing rules work together.

Latest operations update: failover restored, centralized syslog fixed (OPNsense + NAS), and manual PBS backup verified successful.

Technical Atlas (menu, diagrams, charts) Operational updates (latest) System overview (web) Deploy on VPS Traefik (web)