Darshan Sanjel
  1. Portfolio
  2. Projects
  3. Proxmox home lab
Case study

A repurposed laptop running my whole lab.

Proxmox VE 9 hosting VMs, containers, network-wide DNS filtering and a GPU-accelerated local LLM, reachable from anywhere without opening a single port.

Status
Ongoing
Hypervisor
Proxmox VE 9
Workloads
VMs · LXC · Docker
Access
Tailscale · TOTP

01The problem

I needed somewhere to run security tools, network services and local AI models, all at once, without buying a server. And I needed to reach it from outside the house without exposing anything to the internet.

02Setup

  • Proxmox VE 9 on a repurposed laptop with 64 GB of RAM, running Linux VMs and LXC containers, plus Docker.
  • TOTP two-factor login on the Proxmox web interface.
  • Pi-hole in its own LXC for network-wide DNS filtering, using Cloudflare as the upstream resolver. Before installing it I took an LVM-thin snapshot as a rollback point.
  • A GPU-accelerated LLM with a web UI on an RTX 3060.
  • Tailscale mesh VPN for remote access, so no ports are forwarded on the home router.

03Architecture

Proxmox home lab architecture Home devices send DNS queries to a Pi-hole container, which forwards allowed queries to Cloudflare. A Proxmox VE 9 host runs VMs, LXC containers, Docker and a GPU-accelerated LLM. Remote devices reach the lab over a Tailscale mesh VPN instead of open ports. Pi-hole (LXC) DNS filtering Linux VMs e.g. Wazuh SIEM Docker containers Local LLM + web UI RTX 3060 GPU LVM-thin storage snapshots before risky changes Proxmox VE 9 host · 64 GB RAM · TOTP login Cloudflare DNS upstream resolver Home devices phones · laptops · TVs Remote device via Tailscale DNS allowed queries tailnet
Everything runs on one host. DNS from the house goes through Pi-hole; remote access only arrives over the Tailscale tailnet.

04What broke and how I fixed it

Fault 1: the lab kept dropping off the network

Symptom
Intermittent outages: the host and its services became unreachable.
Cause
A static-IP misconfiguration on the host.
Fix
Corrected the host's static addressing.

Fault 2: a slow, flaky link

Symptom
Poor throughput and intermittent carrier drops.
Cause
The USB Ethernet adapter was negotiating at 100 Mb/s instead of gigabit and losing carrier.
Fix
Traced the problem to the adapter's link negotiation.

What I took from it: when a whole host "goes down," check the boring layers first: addressing, then the physical link, before blaming the software running on top.

05What I'd do next

  • Replace the USB Ethernet adapter with a more reliable NIC and segment lab traffic onto its own VLAN.
  • Automate backups of VMs and containers to a second disk, and test a restore.
  • Point Proxmox and Pi-hole logs at the Wazuh SIEM.