benharrison.cc ~/projects/private-cloud

ben@cloud:~$ pce --describe

PRIVATE
CLOUD

A self-hosted private cloud network. Routing, firewalling, DNS filtering, and TLS termination run as virtual machines on a Proxmox host; a Windows Hyper-V box carries the VMs and the media library; a mini PC keeps the printer online. Tailscale makes all of it reachable from anywhere without opening a port.

edge
OPNsense
dns
AdGuard Home
proxy
Nginx Proxy Manager
overlay
Tailscale
hypervisors
Proxmox VE · Hyper-V
topology live
Network topology: internet to OPNsense on Proxmox, then to services and the Hyper-V and mini PC hosts, with Tailscale overlay for remote devices PROXMOX VE node-01 HYPER-V node-02 MINI PC node-03 INTERNET wan OPNsense firewall · router UniFi network controller AdGuard Home dns · filtering Nginx Proxy Mgr reverse proxy · tls Tailscale mesh vpn Virtual machines dev · test · workloads Jellyfin media server Print server shared printer Remote devices phones · laptops · anywhere wan lan tailscale overlay
services 7 running
service host role state
opnsense node-01 proxmox Firewall, router, and gateway for the whole house running
unifi node-01 proxmox Controller for the Ubiquiti network hardware running
adguard-home node-01 proxmox Network-wide DNS with ad and tracker blocking running
nginx-proxy-manager node-01 proxmox Reverse proxy and TLS certificates for internal services running
tailscale node-01 proxmox Mesh VPN node exposing the LAN to my devices anywhere running
jellyfin node-02 hyper-v Self-hosted media library streamed to every screen in the house running
print-server node-03 mini pc Shares the printer with every device on the network running
node-01 hypervisor

Proxmox VE

The network itself. Everything a packet touches on its way in or out of the house lives here as an isolated VM or container, which means the firewall, DNS, and proxy can each be rebuilt or rolled back independently.

runs
  • OPNsense
  • Ubiquiti UniFi
  • AdGuard Home
  • Nginx Proxy Manager
  • Tailscale
node-02 hypervisor

Windows Hyper-V

General-purpose virtualization. Multiple VMs for development, testing, and everyday workloads, plus the Jellyfin media server behind the reverse proxy.

runs
  • Virtual machines
  • Jellyfin
node-03 appliance

Mini PC

A small, always-on box with a single responsibility: keep the printer on the network so every device can reach it.

runs
  • Print server
trace one request, edge to service
  1. opnsense Terminates the WAN, applies firewall rules, and routes the request onto the LAN.
  2. adguard Resolves the hostname for the client and drops ad and tracker domains at the DNS layer.
  3. nginx-pm Matches the hostname, terminates TLS, and forwards to the right backend.
  4. service Jellyfin, a VM, the UniFi console — whatever the hostname points at.
  5. tailscale Off-site access follows the same path. The zero-trust mesh overlays the private network, so authorized devices resolve the same internal hostnames from any location with no inbound port exposure and no public attack surface.
manifest.yml stack 
hypervisors:  [Proxmox VE, Windows Hyper-V]
edge:         OPNsense
network:      Ubiquiti UniFi
dns:          AdGuard Home
proxy:        Nginx Proxy Manager
overlay:      Tailscale
media:        Jellyfin
print:        Mini PC print server