lab.trucnguyen.devPROD
DUAL-PLANE INFRASTRUCTURE & INGRESS MODEL

Network Architecture & Server Tier Map

A layered overview from the edge ingress gateway (Cloudflare Tunnel) through the relay cloud VPS to the physical home server cluster (Proxmox VE on the M70q) and the Tailscale overlay mesh.

Ingress & Zero-Trust Data Flow

1. CLIENT REQUEST

The user requests the public domain:

https://lab.trucnguyen.dev
2. CLOUDFLARE EDGE

TLS termination, WAF filtering, and transport over an encrypted tunnel:

Cloudflare Tunnel (No Open Port)
3. HOME HYPERVISOR

Received by the home server (Lenovo M70q Tiny):

Proxmox VE 8.2 (LXC 102 Apps)
4. SERVICE CONTAINER

Handled by an isolated internal container:

Next.js / Umami / OpenProject
Edge / Ingress

Cloudflare Edge Network

The protective front door for the entire homelab: it absorbs volumetric attacks and routes traffic to backend servers without opening any modem ports.

LAN / Public IPAnycast Edge Global
Tailscale Mesh IPN/A (Public Gateway)
HardwareGlobal Anycast CDN / WAF
Services & Responsibilities:
  • Cloudflare Tunnel (Zero Trust Ingress)
  • Universal SSL / TLS Termination
  • DDoS Mitigation & Rate Limiting
  • DNS Management (trucnguyen.dev)
Edge / Ingress

MaxStack Aegis Prime (Singapore Edge)

A Singapore-based edge server acting as a secondary reverse proxy and an Internet-facing data relay.

LAN / Public IP198.51.100.24
Tailscale Mesh IP100.64.0.xx (Zero-Trust Protected)
HardwareCloud VPS
Services & Responsibilities:
  • Nginx Reverse Proxy (SSL Edge)
  • vps-webdav (:5245 Mesh Private Share)
  • Portainer Edge Agent (v2.45.1)
  • Fail2ban SSH Hardening (Port 2222)
LAN Hypervisor

Hyperion Sovereign (Lenovo M70q Tiny)

The core of the homelab. The Proxmox VE hypervisor isolates services into dedicated LXC containers with near bare-metal performance.

LAN / Public IP10.240.0.10
Tailscale Mesh IP100.64.0.xx (Zero-Trust Protected)
HardwareLenovo ThinkCentre M70q
Services & Responsibilities:
  • Proxmox VE 8.2 (Virtualization Kernel 6.8)
  • CT 102 Apps Hub (OpenProject :8090, Umami :3000, LiveSync :5984)
  • CT 101 Media Storage (MinIO S3 :9000, imgproxy)
  • CT 100 Docker Core (Portainer CE :9443, Tailscale Gateway)
  • Data Lake Engine (PostgreSQL :5435)
Workstation

Orion Workstation (Engineering Rig)

A high-performance workstation for software development, large-scale data processing, Data Ops analysis, and homelab administration.

LAN / Public IP10.240.0.5
Tailscale Mesh IP100.64.0.xx (Zero-Trust Protected)
HardwareAMD Ryzen 7 5700X
Services & Responsibilities:
  • Zorin OS 17.2 Pro (Primary Dev Engine)
  • Data Lake Dev & ETL pipelines (DuckDB / Polars)
  • Docker Local Dev & Microservices Sandbox
  • RustDesk Remote Desktop Daemon
Cloud Standby

MaxStack Vanguard Shield (VN Cloud Standby)

An enterprise cloud server in a Vietnamese data center, used for disaster-recovery backups and workloads that need high domestic bandwidth.

LAN / Public IP203.0.113.88
Tailscale Mesh IP100.64.0.xx (Zero-Trust Protected)
HardwareMaxStack Cloud VPS
Services & Responsibilities:
  • Debian 12 Bookworm Clean Host
  • Portainer Edge Agent (:9001)
  • MySQL 8.0 & Offsite Database Replication
  • Tailscale WireGuard Mesh Peer