Hybrid-Cloud Homelab Architecture

Monolithic cloud architectures introduce prohibitive egress bandwidth charges and recurring subscription lock-in. To achieve both lightning-fast edge delivery and low-cost multi-terabyte storage, DenverNerd employs a hybrid edge-to-core infrastructure.

1. Edge Ingress Layer (Debian VPS + Caddy)

Note

Preload the kernel module wireguard via /etc/modules on Debian 12 to guarantee systemd-networkd attaches mesh interfaces before public ingress commences.

A budget VPS running hardened Debian Linux handles all public ingress. Caddy terminates TLS with automatic Let's Encrypt certificates and applies strict HTTP headers:

denvernerd.com {
    encode zstd gzip

    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
    }

    reverse_proxy 10.100.0.2:5000 {
        header_up Host {host}
        header_up X-Real-IP {remote_host}
    }
}

2. Encrypted Overlay (WireGuard Point-to-Point)

Tip

Set PersistentKeepalive = 25 on the homelab peer behind NAT to keep stateful connection tracking entries active indefinitely without exposing inbound firewall ports.

Important

Maintain an interface MTU of 1420 across all WireGuard peers to eliminate IP fragmentation overhead when proxying streaming TLS traffic through Caddy.

Communication between the public VPS and the local server cluster runs across a dedicated kernel-level WireGuard interface:

[Interface]
Address = 10.100.0.1/24
PrivateKey = <VPS_PRIVATE_KEY>
ListenPort = 51820

[Peer]
PublicKey = <HOMELAB_PUBLIC_KEY>
Endpoint = dynamic.denvernerd.com:51820
AllowedIPs = 10.100.0.2/32
PersistentKeepalive = 25

3. Storage Core (TrueNAS + ZFS Mirror Pools)

Warning

Never expose TrueNAS storage administration or MinIO S3 consoles to public interfaces. Restrict management dashboards strictly to encrypted WireGuard overlay IP ranges.

At the core resides an 8-bay TrueNAS host with dual 10GbE SFP+ uplinks:

  • Pool Architecture: 4x 16TB Enterprise SAS drives in mirrored vdevs (RAID10 equivalent)
  • Read Cache (L2ARC): 1TB PCIe 4.0 NVMe
  • Synchronous Write Log (SLOG): Optane P1600X for low-latency database syncs
  • S3 Endpoint: MinIO server providing S3-compatible APIs for digital asset fulfillment

Benchmarks & Latency

  1. Edge-to-Core Ping: ~11.4 ms over symmetric fiber
  2. WireGuard iperf3 Throughput: 940 Mbps sustained
  3. Database Read Latency: < 1.2 ms over internal network