Work in progress — this site is still being written.
03 / The collection

The lab.

An always-on lab for machine-learning experiments, self-hosted services, and infrastructure testing — and the lessons learned the interesting way.

A map, minus the useful details.

This communicates the shape of the work without publishing real addressing, hostnames, management paths, exposed ports, or a convenient reconnaissance document.

Abstract homelab topology An internet node connects to an edge node, then to a segmented core with user, lab, service, storage, and management zones. INTERNET THE OUTSIDE EDGE ROUTING · POLICY CORE SEGMENTATION PEOPLE CLIENT DEVICES LAB BREAKABLE SERVICES PUBLIC-ISH STORAGE IMPORTANT BITS MGMT NOT PUBLIC BACKUPS HOPEFULLY

The actual shape of it.

Zones and services, the way home-labbers share these. Still no addresses, hostnames or port lists — those live in a private inventory that renders as a live dashboard inside the network.

Home lab map: internet to an edge router and 10 GbE core; four VLANs — trusted (GPU cluster, AI NAS, Home Assistant, lab dashboard, clients, management), servers and media (Plex, *arr stack, six-NAS fleet, Vaultwarden, two Mac minis), DMZ (reverse proxy, public apps, Proxmox hypervisor, Cloudflare DDNS) and IoT (cameras, smart home, power, guest Wi-Fi); DNS filtering for every VLAN.

What the lab says indirectly.

The point is not the number of machines. It is the ongoing practice of designing boundaries, operating services, noticing failure modes, and leaving the system easier to understand than you found it.

Compute

Two RTX 4090s and an NVIDIA DGX Spark (GB10) scheduled by SLURM — mixed x86 and arm64 partitions, cgroup-isolated GPUs, accounting — with JupyterHub profiles for interactive work and shared datasets, models and environments over NFS.

Platform

Proxmox on rack-mounted Dell hardware running about twenty guests: DNS filtering, a reverse-proxy front door, Home Assistant integrations, media automation, this site. Six Synology NAS units for the storage tiers.

Network

MikroTik routing and switching, VLANs by trust level, a DMZ for public services behind a single reverse proxy, DNS-level ad blocking — all described in a plain-text inventory that a self-built site renders live, with ping sweeps, lease discovery and alerts.

Operations

Nightly backups, per-host health agents, GPU power caps, a maintenance calendar with due dates, and periodic outside reviews of the design. Small, but treated like production — because the experiments depend on it.

Public doors.

Only list services meant to be public. Management interfaces, internal dashboards, real host inventories, and private endpoints do not need a place on this page.

Document the lesson, not the secret.

Sanitized diagrams, postmortems without identifiers, patterns you reused, and hard-earned troubleshooting notes make excellent portfolio material.