Self-Hosted Infrastructure
HOMELAB
A distributed Linux homelab supporting networking, monitoring, security, AI, storage, VPN connectivity, and application hosting.
- Status
- OPERATIONAL
- Host
- UBUNTU / RASPBERRY PI
- Deployment
- SELF-HOSTED
Overview
System Overview
A distributed Linux homelab supporting networking, monitoring, security, AI, storage, VPN connectivity, and application hosting — the physical and virtual foundation the other projects run on.
Problem
The Problem
- ›Running several distinct systems (security, AI, monitoring, networking) needs a reliable, coherent physical and virtual foundation instead of ad-hoc single-purpose boxes.
- ›Security tooling, AI workloads, and general services have different resource and isolation needs.
- ›Remote nodes need to participate in the same network fabric without weakening its security posture.
Requirements
What It Had to Do
- ›Separate security-sensitive workloads (Wazuh, Suricata) from general application hosting while keeping them observable together.
- ›Give AI inference its own dedicated node with GPU access rather than competing with other services.
- ›Provide a WireGuard-based core for connecting distributed nodes, including a remote Raspberry Pi.
- ›Standardize on Docker and KVM for workload isolation and portability across nodes.
Architecture
How It's Structured
SECURITY-CORE (Ubuntu Server)
- › Wazuh
- › Suricata
- › Prometheus
- › Grafana
- › Portainer
- › Uptime Kuma
- › Pi-hole
- › Docker
- › KVM
- › Security application
- › Automation workloads
GRAYDRAGON-AI
- › Local LLM inference
- › llama.cpp
- › CUDA
- › Qwen models
- › OpenAI-compatible API
PI4-CORE
- › WireGuard server
- › Prometheus
- › Grafana
- › Pi-hole
- › Blackbox exporter
- › Speedtest exporter
- › Portainer
PI3B-RIVER
- › Remote WireGuard client
- › Monitoring exporters
- › Remote infrastructure telemetry
Build
Engineering the Build
SECURITY-CORE, an Ubuntu Server host, runs Wazuh and Suricata for security monitoring, Prometheus/Grafana/Uptime Kuma for observability, Pi-hole for DNS filtering, and Portainer for container management, alongside Docker and KVM for general workloads and automation.
GRAYDRAGON-AI is a dedicated node for local LLM inference, running llama.cpp with CUDA acceleration to serve Qwen models behind an OpenAI-compatible API.
PI4-CORE, a Raspberry Pi, runs the WireGuard server along with Prometheus, Grafana, Pi-hole, and blackbox/speedtest exporters — acting as a lightweight, always-on core for networking and monitoring.
PI3B-RIVER is a remote Raspberry Pi acting as a WireGuard client elsewhere on the network, running monitoring exporters so its telemetry feeds back into the same observability stack.
Challenges
What Made It Hard
- ›Balancing resource allocation between security tooling, AI inference, and general services across a small number of physical nodes.
- ›Keeping a Raspberry Pi-based core reliable enough to depend on for WireGuard and monitoring.
- ›Maintaining consistent observability (Prometheus/Grafana) across nodes with very different hardware profiles.
Current System
Results — Where It Stands Today
- ›All four nodes — SECURITY-CORE, GRAYDRAGON-AI, PI4-CORE, and PI3B-RIVER — are operational and integrated into the same monitoring and networking fabric.
- ›Security tooling, AI inference, monitoring, DNS filtering, and container management are each running on the node best suited to them.
- ›WireGuard connects core and remote nodes, giving PI3B-RIVER visibility from elsewhere on the network without public exposure.
What's Next
What's Next
- ›Continue expanding storage and backup strategy across nodes.
- ›Add capacity as AI and security workloads grow.
- ›Formalize documentation of the topology as more services are added.