This repo documents the architecture of my personal homelab, codenamed DarkSynth. This environment serves as a practical platform for developing and honing skills in system administration, network operations, and infrastructure security. It is designed with a focus on high availability, robust monitoring, and secure service delivery.
---
config:
theme: dark
nodeSpacing: 30
rankSpacing: 85
---
graph TD
subgraph WAN_GRAPH["<b>External Network & Users"]
direction LR;
Internet([<b>Internet]);
UserPhone[<b>GPSLogger Phone App];
subgraph CF_GRAPH["<b>Cloudflare Zero Trust"]
Internet <--> CF(<b>Cloudflare Network);
CF <-- Encrypted Tunnel --> Cloudflared;
end
end
subgraph LAN_GRAPH[<b>Local Network LAN]
Router[<b>ISP Gateway</b><br/>Modem + Router + Firewall] <--> Clients;
Clients([<b>LAN Clients</b><br/>PCs, Phones, etc.]);
Internet <--> Router;
subgraph SERVER_GRAPH["<b>HexOS Server <br/>(based on TrueNAS Scale)</b>"]
A[<b>Physical Hardware</b><br/>Custom-Built Server];
subgraph STORAGE_GRAPH["<b>Storage Architecture (ZFS)"]
Pool1[<b>Boot Pool</b><br/>2x 256GB SSD - RAID 1];
Pool2[<b>App/VM Pool</b><br/>256GB NVMe];
Pool3[<b>App/Transcode Pool</b><br/>512GB SSD];
Pool4[<b>Media Pool</b><br/>2x 8TB HDD - RAID 1];
Pool5[<b>Backup Pool</b><br/>1TB HDD];
Pool2 & Pool3 -->|Nightly Backups| Pool5;
end
CoreOS[<b>HexOS / TrueNAS Scale OS</b><br/>Docker Compose, KVM];
A --> CoreOS;
CoreOS --> Pool1 & Pool2 & Pool3 & Pool4 & Pool5;
subgraph APPS_GRAPH["<b>Network Services & Applications</b>"]
Cloudflared(<b>Cloudflared Tunnel);
Traefik(<b>Traefik Reverse Proxy);
subgraph APPS_LAN_DIRECT_GRAPH["<b>LAN Direct Access</b>"]
Prometheus(<b>Prometheus):::Direct;
Immich(<b>Immich):::Direct;
SMB(<b>SMB File Shares):::Direct;
PiHole(<b>Pi-hole DNS/DHCP):::Direct;
end
subgraph APPS_LAN_GRAPH["<b>LAN Accessible Services</b><br/>(via Traefik)"]
Zabbix_LAN(<b>Zabbix):::LAN;
PiHole_LAN(<b>Pi-hole Admin UI):::LAN;
Netdata_LAN(<b>Netdata):::LAN;
Grafana_LAN(<b>Grafana):::LAN;
end
subgraph APPS_WAN_GRAPH["<b>WAN Accessible Services</b><br/>(via Cloudflare + Traefik)"]
Dawarich_WAN(<b>Dawarich):::WAN;
UptimeKuma_WAN(<b>Uptime Kuma):::WAN;
Jelu_WAN(<b>Jelu):::WAN;
Wger_WAN(<b>Wger):::WAN;
end
end
CoreOS --> Cloudflared & Traefik & Immich & Prometheus & SMB;
end
end
Cloudflared <-- HTTPS --> Traefik;
Traefik --> Dawarich_WAN & UptimeKuma_WAN & Jelu_WAN & Wger_WAN;
UserPhone -- API Calls to timeline.hajyehia.com --> CF;
Clients -- DNS Queries for *.home.hajyehia.com --> PiHole;
Clients <-- HTTPS --> Traefik;
Traefik --> Zabbix_LAN & PiHole_LAN & Netdata_LAN & Grafana_LAN;
Clients <-- SMB/445 --> SMB;
Clients <-- HTTP --> Immich;
Router <--> PiHole;
PiHole -->|Manages DHCP & DNS| Clients;
Clients -- HTTP --> Prometheus;
Immich <-- Media Files --> Pool4;
%% Create Map Key
subgraph Legend["<b>Map Key .</b>"]
direction LR;
L1[<b>Server Internal Link];
L2[<b>Direct LAN Services];
L3[<b>LAN Services];
L4[<b>WAN Services];
end
Legend ~~~ LAN_GRAPH
%% Color the map key items
style L1 fill:#9e4d91,font-size:19px,color:black;
style L2 fill:#f1c40f,font-size:18px,color:black;
style L3 fill:#2ecc71,font-size:18px,color:black;
style L4 fill:#3498db,font-size:18px,color:black;
%% Color the nodes and links
classDef Direct stroke:#f1c40f,stroke-width:6px,font-size:22px;
classDef LAN stroke:#2ecc71,stroke-width:6px,font-size:22px;
classDef WAN stroke:#3498db,stroke-width:6px,font-size:22px;
linkStyle 6,7,8,9,10,11,13,14,15,16,18,19,20,21,25,26,27,28 stroke:#9e4d91,stroke-width:4px;
linkStyle 1,22,23,32,31,29,30,0,2,3,12,33 font-size:21.5px,stroke-width:3px,color:#b0e861
linkStyle 4,5,34 stroke:#9e4d91,stroke-width:3px,font-size:21.5px,stroke-width:4px,color:#b0e861
linkStyle 24 stroke:#2ecc71,stroke-width:3px,font-size:21.5px,stroke-width:4px,color:#b0e861
linkStyle 17 stroke:#3498db,stroke-width:3px,font-size:21.5px,stroke-width:4px,color:#b0e861
%% Apply class to all nodes for font sizes
class Internet,UserPhone,UserBrowser,CF,Cloudflared,APPS_LAN_DIRECT_GRAPH,APPS_LAN_GRAPH,APPS_WAN_GRAPH,Router,CoreOS,A,Traefik,Clients,Pool1,Pool2,Pool3,Pool4,Pool5 allNodesFontSize;
class WAN_GRAPH,STORAGE_GRAPH,CF_GRAPH,LAN_GRAPH,SERVER_GRAPH,APPS_GRAPH titleNodesFontSize;
%% Define the font size for all nodes
classDef allNodesFontSize font-size:22px,white-space:nowrap;
classDef titleNodesFontSize font-size:24px,white-space:nowrap;
style Legend font-size:18px,white-space:nowrap;
---
config:
theme: base
nodeSpacing: 30
rankSpacing: 85
---
graph TD
subgraph WAN_GRAPH["<b>External Network & Users"]
direction LR;
Internet([<b>Internet]);
UserPhone[<b>GPSLogger Phone App];
subgraph CF_GRAPH["<b>Cloudflare Zero Trust"]
Internet <--> CF(<b>Cloudflare Network);
CF <-- Encrypted Tunnel --> Cloudflared;
end
end
subgraph LAN_GRAPH[<b>Local Network LAN]
Router[<b>ISP Gateway</b><br/>Modem + Router + Firewall] <--> Clients;
Clients([<b>LAN Clients</b><br/>PCs, Phones, etc.]);
Internet <--> Router;
subgraph SERVER_GRAPH["<b>HexOS Server <br/>(based on TrueNAS Scale)</b>"]
A[<b>Physical Hardware</b><br/>Custom-Built Server];
subgraph STORAGE_GRAPH["<b>Storage Architecture (ZFS)"]
Pool1[<b>Boot Pool</b><br/>2x 256GB SSD - RAID 1];
Pool2[<b>App/VM Pool</b><br/>256GB NVMe];
Pool3[<b>App/Transcode Pool</b><br/>512GB SSD];
Pool4[<b>Media Pool</b><br/>2x 8TB HDD - RAID 1];
Pool5[<b>Backup Pool</b><br/>1TB HDD];
Pool2 & Pool3 -->|Nightly Backups| Pool5;
end
CoreOS[<b>HexOS / TrueNAS Scale OS</b><br/>Docker Compose, KVM];
A --> CoreOS;
CoreOS --> Pool1 & Pool2 & Pool3 & Pool4 & Pool5;
subgraph APPS_GRAPH["<b>Network Services & Applications</b>"]
Cloudflared(<b>Cloudflared Tunnel);
Traefik(<b>Traefik Reverse Proxy);
subgraph APPS_LAN_DIRECT_GRAPH["<b>LAN Direct Access</b>"]
Prometheus(<b>Prometheus):::Direct;
Immich(<b>Immich):::Direct;
SMB(<b>SMB File Shares):::Direct;
PiHole(<b>Pi-hole DNS/DHCP):::Direct;
end
subgraph APPS_LAN_GRAPH["<b>LAN Accessible Services</b><br/>(via Traefik)"]
Zabbix_LAN(<b>Zabbix):::LAN;
PiHole_LAN(<b>Pi-hole Admin UI):::LAN;
Netdata_LAN(<b>Netdata):::LAN;
Grafana_LAN(<b>Grafana):::LAN;
end
subgraph APPS_WAN_GRAPH["<b>WAN Accessible Services</b><br/>(via Cloudflare + Traefik)"]
Dawarich_WAN(<b>Dawarich):::WAN;
UptimeKuma_WAN(<b>Uptime Kuma):::WAN;
Jelu_WAN(<b>Jelu):::WAN;
Wger_WAN(<b>Wger):::WAN;
end
end
CoreOS --> Cloudflared & Traefik & Immich & Prometheus & SMB;
end
end
Cloudflared <-- HTTPS --> Traefik;
Traefik --> Dawarich_WAN & UptimeKuma_WAN & Jelu_WAN & Wger_WAN;
UserPhone -- API Calls to timeline.hajyehia.com --> CF;
Clients -- DNS Queries for *.home.hajyehia.com --> PiHole;
Clients <-- HTTPS --> Traefik;
Traefik --> Zabbix_LAN & PiHole_LAN & Netdata_LAN & Grafana_LAN;
Clients <-- SMB/445 --> SMB;
Clients <-- HTTP --> Immich;
Router <--> PiHole;
PiHole -->|Manages DHCP & DNS| Clients;
Clients -- HTTP --> Prometheus;
Immich <-- Media Files --> Pool4;
%% Create Map Key
subgraph Legend["<b>Map Key .</b>"]
direction LR;
L1[<b>Server Internal Link];
L2[<b>Direct LAN Services];
L3[<b>LAN Services];
L4[<b>WAN Services];
end
Legend ~~~ LAN_GRAPH
%% Color the map key items
style L1 fill:#9e4d91,font-size:19px,color:black;
style L2 fill:#f1c40f,font-size:18px,color:black;
style L3 fill:#2ecc71,font-size:18px,color:black;
style L4 fill:#3498db,font-size:18px,color:black;
%% Color the nodes and links
classDef Direct stroke:#f1c40f,stroke-width:6px,font-size:22px;
classDef LAN stroke:#2ecc71,stroke-width:6px,font-size:22px;
classDef WAN stroke:#3498db,stroke-width:6px,font-size:22px;
linkStyle 6,7,8,9,10,11,13,14,15,16,18,19,20,21,25,26,27,28 stroke:#9e4d91,stroke-width:4.5px;
linkStyle 1,22,23,32,31,29,30,0,2,3,12,33 font-size:21.5px,stroke-width:3px,stroke:#696969
linkStyle 4,5,34 stroke:#9e4d91,stroke-width:3px,font-size:21.5px,stroke-width:4px
linkStyle 24 stroke:#2ecc71,stroke-width:3px,font-size:21.5px,stroke-width:4px
linkStyle 17 stroke:#3498db,stroke-width:3px,font-size:21.5px,stroke-width:4px
%% Apply class to all nodes for font sizes
class Internet,UserPhone,UserBrowser,CF,Cloudflared,APPS_LAN_DIRECT_GRAPH,APPS_LAN_GRAPH,APPS_WAN_GRAPH,Router,CoreOS,A,Traefik,Clients,Pool1,Pool2,Pool3,Pool4,Pool5 allNodesFontSize;
class WAN_GRAPH,STORAGE_GRAPH,CF_GRAPH,LAN_GRAPH,SERVER_GRAPH,APPS_GRAPH titleNodesFontSize;
%% Define the font size for all nodes
classDef allNodesFontSize font-size:22px,white-space:nowrap;
classDef titleNodesFontSize font-size:24px,white-space:nowrap;
style Legend font-size:18px,white-space:nowrap;
The homelab runs on an old desktop repurposed as a server with HexOS (a customized layer on TrueNAS SCALE). This provides an enterprise-grade foundation with ZFS, ensuring data integrity and reliability.
The storage layout is tiered by performance and purpose:
- Boot Pool (SATA SSDs, RAID 1): Redundant OS storage for high availability.
- High-Performance Pool (NVMe SSD): Dedicated mainly for demanding and latency-sensitive apps and databases.
- Medium-Performance Pool (SATA SSD): Dedicated for lighter apps and KVM VMs.
- Bulk Storage Pool (HDDs, RAID 1): Used for large media files and large capacity data.
- Dedicated Backup Pool (HDD): Holds nightly ZFS snapshots of application data, providing on-site backup against corruption or accidental deletion.
The network is managed by the ISP gateway with Pi-hole as the central DNS and DHCP server. This setup provides:
- Network-wide filtering: Blocks ads, malware, and tracking domains at the DNS level for all devices on the network.
- Local DNS resolution: Manages internal domain names ( *.home.hajyehia.com and *.home ), allowing user-friendly service access instead of IP addresses.
A multi-layered approach is used for accessing services, prioritizing security and ease of use.
External access at *.hajyehia.com is achieved without opening any ports on the firewall, following a Zero Trust security model.
- Cloudflare Network: Acts as the public-facing entry point, providing DDoS protection, caching, and a Web Application Firewall (WAF).
- Cloudflare Tunnel (cloudflared): An outbound-only connection is established from the server to the Cloudflare network. This means the server is completely invisible to the public internet.
- Traefik Reverse Proxy: The encrypted tunnel traffic is securely passed to Traefik, which then routes the request to the appropriate application container. This setup ensures that all incoming traffic is authenticated and encrypted by Cloudflare before it ever reaches the server and then encrypted again in Traefik using SSL certificates from Let'sEncrypt.
Internal services at *.home.hajyehia.com are accessed through Traefik reverse proxy. This provides a centralized point of management for all LAN-based web services, handling routing and internal SSL certificates from Let'sEncrypt.
A few critical services have direct access for performance or protocol reasons:
- SMB for file sharing.
- Pi-hole for core DNS/DHCP functionality.
- Immich due to mobile app limitations.
- Prometheus, accessed only by Grafana.
Monitoring is layered for both proactive alerting and real-time troubleshooting:
- Zabbix: Used for long-term high-level infrastructure monitoring. It tracks historical performance data and sends alerts via Email and Discord based on predefined triggers, allowing for proactive issue resolution.
- Uptime Kuma: Provides hosted apps and services availability monitoring with Email and Discord alerts. It continuously checks the availability of all services and displays all WAN-exposed apps' status on a public dashboard.
- Netdata: Offers high-resolution, real-time performance monitoring. It is the go-to tool for immediate troubleshooting and diagnosing performance bottlenecks as they happen.
- Prometheus: Acts as the central metrics backend for time-series data consumed by Grafana. It scrapes and stores metrics from supported services (Uptime Kuma and Dawarich), enabling unified querying and correlation across monitoring domains.
- Grafana: Serves as the unified NOC dashboard and visualization layer. It aggregates data from Prometheus, Zabbix and Netdata to provide a single view of service availability, infrastructure health, and performance metrics.
🌐 Uptime Kuma
🔗Website - Internally hosted - Service uptime checks, public status dashboard & alerting.
🌐 Uptime Kuma
🔗Website - Internally hosted - Service uptime checks, public status dashboard & alerting.
📡 UptimeRobot
🔗Website - Externally hosted - Service uptime checks, public status dashboard & alerting.
📡 UptimeRobot
🔗Website - Externally hosted - Service uptime checks, public status dashboard & alerting.
🔥 Prometheus
An open-source monitoring and alerting toolkit that collects and stores metrics as time-series data.
🔥 Prometheus
An open-source monitoring and alerting toolkit that collects and stores metrics as time-series data.
📈 Grafana
An open-source platform for visualizing and analyzing metrics, logs, and traces through interactive dashboards.
📈 Grafana
An open-source platform for visualizing and analyzing metrics, logs, and traces through interactive dashboards.
Applications are deployed using a combination of Docker Compose and TrueNAS SCALE Apps UI. Reverse proxy routing is automated with Traefik labels, enabling reproducible and declarative service configurations. Persistent data is isolated into dedicated datasets for each app, and nightly ZFS snapshots provide automated rollback and recovery.
Security is enforced with a Zero Trust architecture: no inbound firewall ports are open, and all WAN access is routed through encrypted Cloudflare Tunnel with TLS termination in Traefik. All internal services are encrypted with Let’s Encrypt certificates. Pi-hole blocks malicious and tracking domains network-wide, while dataset ownership and service accounts follow a least-privilege model to minimize lateral movement risks.
- System Administration: Linux (Debian), TrueNAS Scale, ZFS Filesystem Management, Backup Strategies (Snapshots).
- Network Operations: DNS & DHCP Management (Pi-hole), Network Security, LAN & WAN services segmentation, least-privilege principles.
- Application Delivery: Reverse Proxy configuration (Traefik), Zero Trust Architecture (Cloudflare Tunnels), TLS Certificate Management.
- Containerization: Docker & Docker Compose for deploying and managing applications.
- Monitoring & Alerting: Zabbix for infrastructure health and alerting, Uptime Kuma & UptimeRobot for service availability and alerting, Netdata for real-time diagnostics, multi-channel alerting (Email + Discord), Prometheus standardizes metrics collection, and Grafana unifies all data into a single NOC dashboard for fast operational insight.
- DevOps Practices: Reproducible deployments, automated ZFS backups and dataset policies, clean separation of datasets.
✅ UptimeRobot external apps monitoring + public status page
✅ Add more RAM
✅ Deploy Wger - fitness tracker
✅ Route Netdata through Traefik
✅ Deploy Grafana - analytics and monitoring
✅ Deploy Prometheus - metrics database
✅ Use Grafana + Prometheus with Zabbix, Netdata & UptimeKuma to create a unified NOC dashboard
🔲 Deploy AdventureLog - travel tracker and planner
🔲 Deploy Photon reverse geocoding service
🔲 Use Photon in Dawarich
🔲 Deploy Jellyfin - media system
🔲 Deploy Nextcloud OR Opencloud - Google Drive alternative
🔲 Research and deploy a password manager
🔲 Research and deploy a start page for server's apps and services (e.g. Flame, Dashy, Homarr, Homepage)