L—E Dufour
All projects

01 / Self-hosted infrastructure

Aether

One server, eleven VLANs, a virtualized firewall and about a dozen services published behind a Cloudflare tunnel and single sign-on.

Year
2023 — · Ongoing
Role
Design, networking, operations
Team
Solo
Duration
Since summer 2023

Context

Aether started as a box to host test sites. It became my lab: the place where I run, in real production, the services I use every day, and where I learn networking, security and operations by actually getting things wrong.

aether — Proxmox VE, a single network cardInternetCloudflare tunnelno open portISP box802.1Q switchOne cable, trunkaether — Proxmox VE, a single network cardOPNsenseVM 10011 VLANs ~90 rules05USERSWorkstations and wifi10DMZcloudflared, Traefik20PUBNextcloud, Immich, Mealie35IOTHome Assistant, Thread40INFRAAuthelia, LLDAP, DNS, monitoring45STORAGETrueNAS, ZFS, NFS50DBPostgreSQL, MariaDB, Redis — sealed: no egress99MGMTProxmox, fallback access
  • VLAN 05 USERS: Workstations and wifi
  • VLAN 10 DMZ: cloudflared, Traefik
  • VLAN 20 PUB: Nextcloud, Immich, Mealie
  • VLAN 35 IOT: Home Assistant, Thread
  • VLAN 40 INFRA: Authelia, LLDAP, DNS, monitoring
  • VLAN 45 STORAGE: TrueNAS, ZFS, NFS
  • VLAN 50 DB: PostgreSQL, MariaDB, Redis — sealed: no egress
  • VLAN 99 MGMT: Proxmox, fallback access
Inbound traffic comes through the tunnel, never through an open port. Between VLANs everything is blocked except declared dependencies.

Approach

  1. Router on a stick: the server has a single network port. One 802.1Q trunk cable carries every VLAN, WAN included, and OPNsense, virtualized on the same box, sorts it out.
  2. An isolated DMZ: cloudflared and Traefik live alone in their VLAN. They can reach the services, never the other way around. No port is open on the ISP box.
  3. One LXC container per VLAN, one Docker Compose stack per container, all versioned in Git. Authelia and LLDAP add SSO and two-factor authentication in front of anything public.
  4. Storage is centralized in a TrueNAS VM with ZFS mirrors, so a disk failure, the one incident that will actually happen, costs nothing.
  5. Small home-made Python services run there too: a newsletter with safe unsubscribes and a grade checker that pings me as soon as a result is published.

Outcome

Nextcloud, Immich, Mealie, Home Assistant and my own apps run every day, each in its own zone. Everything is documented (architecture, build log, roadmap) so next year's me understands the decisions today's me made.

Tools

  • Proxmox VE
  • OPNsense
  • TrueNAS / ZFS
  • Docker
  • Traefik
  • Cloudflare Tunnel
  • Authelia
  • LLDAP
  • PostgreSQL
  • Python
Source code
Next projectLe Cerf Blanc