1. Estate overview 2. Network and segments 3. Servers and guests 4. Container groups 5. Application platform 6. DNS and access roles 7. Media and storage 8. Backup and recovery 9. Monitoring and management 10. Local AI and voice Estate overview
Estate overview A map of responsibilities, not a promise of redundancy. Static architecture snapshot, 24 October 2026. Arrows are labelled; dashed fabric links are logical membership, not physical cables.
HOME LAB / 01
Estate overview A map of responsibilities, not a promise of redundancy.
24 OCT 2026
requests / access logical LAN services logical LAN configured VPN / local route NFS hosts exports → USB People & clients Private browsers · service domains Home / Hermes WireGuard Internet HTTPS · direct services UniFi logical fabric Gateway · 6 managed devices 6 VLANs · 5 Wi-Fi broadcasts 168 configured firewall policies Hostinger VPS Hermes controller / gateway Remote local inference on tablet Not a full VPS-host inventory Storage NAS [private] · DSM release Storage + NPM + Portainer hubs 29 Docker objects: 20 running / 9 retained HAOS [private]: owner-reported NAS-hosted Not an independent failure domain Hypervisor Dell Precision 3571 · i9-12900H 31.03 GiB OS-visible · ZFS mirror Guest Plex · Guest Apps VM Guest Web VM · Guest AdGuard Management [private] · Storage [private] One creative tablet Ethernet [private] Wi-Fi [private]: same device Ollama + ComfyUI respond on [private] PC [private] optional / not responding No automatic PC / cloud switch Recovery layers 02:00 native logical exports 03:00 USB Hyper Backup selection Native guest archives · limits apply Guest application homes Media VM [private] · Apps VM [private] · Web VM [private] Ubuntu guests on Hypervisor 11 running Docker objects across VMs Evidence, not telemetry Fresh metadata: 24 October 2026 Acceptance receipts are separate. No infrastructure changes by atlas. Request / data / control flow Logical membership / dated reference Retained / optional / not accepted now STATIC SNAPSHOT · Evidence 24 October 2026 · No live status or new acceptance implied Architecture relationships retained; identifying operational details are omitted. This is a dated overview, not live monitoring.
Network and segments
Network & logical fabric Configured segments, managed devices and access surfaces. Static architecture snapshot, 24 October 2026. Arrows are labelled; dashed fabric links are logical membership, not physical cables.
HOME LAB / 02
Network & logical fabric Configured segments, managed devices and access surfaces.
24 OCT 2026
WAN context VPN termination gateway / policy logical membership only configured segments WAN context Primary and secondary Internet uplinks Roles / active state not returned No site-to-site tunnels inventoried Gateway UCG Fiber · [private] Firmware release · captured ONLINE Routes VLANs / hosts WireGuard WireGuard × 2 Home network Home · [private] Hermes · [private] Enabled config ≠ handshake Managed logical fabric — physical switch uplinks are not inventoried Dashed branches below show managed membership only. They do not assert cabling, link speed or switch-to-switch topology. 67 connected clients at capture: 16 wired / 51 wireless. Firewall: 168 enabled policies (85 ALLOW / 83 BLOCK). Access point U7 Pro XG [private] FW release · ONLINE Access point U7 Pro XG [private] FW release · ONLINE Switch USW Flex 2.5G 5 [private] FW release · ONLINE Switch USW Flex 2.5G 5 [private] FW release · ONLINE Switch US 8 [private] FW release · ONLINE Private VLAN · Management [private] · GW [private] DHCP server · Internet / mDNS configured Private VLAN · Trusted [private] · GW [private] DHCP server · Internet / mDNS configured Private VLAN · IoT [private] · GW [private] DHCP server · Internet / mDNS configured Private VLAN · Guest [private] · GW [private] DHCP server · Internet / mDNS configured Private VLAN · Shadow [private] · GW [private] DHCP server · Internet / mDNS configured Private VLAN · Storage [private] · GW [private] No DHCP · no Internet · no mDNS Wireless networks · names withheld Wireless networks · names withheld Request / data / control flow Logical membership / dated reference Retained / optional / not accepted now STATIC SNAPSHOT · Evidence 24 October 2026 · No live status or new acceptance implied Architecture relationships retained; identifying operational details are omitted. This is a dated overview, not live monitoring.
Servers and guests
Compute & virtualization Bridge ownership, actual guest allocations and shared storage views. Static architecture snapshot, 24 October 2026. Arrows are labelled; dashed fabric links are logical membership, not physical cables.
HOME LAB / 03
Compute & virtualization Bridge ownership, actual guest allocations and shared storage views.
24 OCT 2026
built-in USB app / tagged storage backs guests CT bridge VM app bridge Hypervisor · Dell Precision 3571 12th Gen Intel(R) Core(TM) i9-12900H 1 socket · 14 cores / 20 logical CPUs 33,319,686,144 bytes RAM · 31.03 GiB OS-visible Two-NVMe local ZFS mirror · kernel release Intel GPU device exclusively → Guest Plex Storage views — do not add capacities local-zfs · 894.36 GiB total / 803.23 GiB available local directory · 803.36 GiB logical view local and local-zfs share physical capacity. nas-proxmox · NFS · 500 GiB quota cap, not reserved rpool mirror-0 ONLINE · no known errors at capture Built-in NIC ownership Mgmt NIC → Mgmt bridge · [private] Management + Guest on this bridge Guest net0: Mgmt bridge · firewall=1 No new NAS storage VLAN address USB NIC ownership App NIC → App bridge · no host IP on bridge Guest / Guest / Guest net0: App bridge · tag=1 · firewall=1 Storage bridge → [private] · tagged Storage Private VLAN Host storage source [private] → UCG [private] → NAS [private] Guest · DNS resolver [private] · unprivileged Ubuntu 1 core · 1 GiB RAM · 8 GiB rootfs 256 MiB swap · native AdGuard Mgmt bridge · startup order 10 No Docker object included here Guest · Media VM [private] · Ubuntu 8 vCPU · 8 GiB RAM 32 GiB OS + 256 GiB state 64 GiB scratch · backup=0 Intel passthrough + virtiofs RO Guest · Apps VM [private] · Ubuntu 4 vCPU · 6 GiB RAM 32 GiB OS + 64 GiB app state [storage] · six Docker objects App bridge · startup order 25 Guest · Web VM [private] · Ubuntu 2 vCPU · 2 GiB RAM 32 GiB OS + 32 GiB app state WordPress + MySQL + agent App bridge · startup order 30 Accelerator & placement boundary NVIDIA T600 is unchanged, not a freely shared accelerator. HAOS [private] is owner-reported NAS-hosted; it is not one of these Proxmox guests. Request / data / control flow Logical membership / dated reference Retained / optional / not accepted now STATIC SNAPSHOT · Evidence 24 October 2026 · No live status or new acceptance implied Architecture relationships retained; identifying operational details are omitted. This is a dated overview, not live monitoring.
Container groups
Docker workload atlas Every visible runtime object, once — including retained cutover copies. Static architecture snapshot, 24 October 2026. Arrows are labelled; dashed fabric links are logical membership, not physical cables.
HOME LAB / 04
Docker workload atlas Every visible runtime object, once — including retained cutover copies.
24 OCT 2026
Storage NAS · [private] · Portainer endpoint 2 20 running + 9 retained stopped copies · roles grouped below Proxmox VM Docker homes Endpoints 4 / 3 / 5 · 11 running objects NPM → active VM apps Six consumers share Gluetun namespace Rollback checkpoints — never run both identities DNS and ingress 4 objects · captured running AdGuard running · no healthcheck Adguard-Sync running · no healthcheck NGINX running · no healthcheck portainer-ce running · no healthcheck Observability 5 objects · captured running Beszel running · healthy Beszel-Agent running · healthy Diun running · healthy Dozzle running · healthy Uptime-Kuma running · healthy VPN media namespace 7 objects · captured running Gluetun running · healthy Prowlarr running · healthy qBittorrent-VUE running · healthy Radarr running · no healthcheck Sabnzbd running · no healthcheck Sonarr running · no healthcheck Seerr running · healthy Private DB, remote and game 4 objects · captured running Seerr-DB running · healthy RustDesk-ID running · no healthcheck RustDesk-Relay running · no healthcheck Minecraft-Bedrock-Server-old running · healthy Retained stopped copies 9 objects · retained / stopped Homarr stopped · stored unhealthy IT-Tools stopped · stored unhealthy Joplin exited · no healthcheck Joplin-DB stopped · stored unhealthy mealie stopped · stored unhealthy Plex stopped · stored unhealthy WordPress exited · no healthcheck WordPress-DB exited · no healthcheck retained manager copy exited · no healthcheck Apps VM · [private] 6 objects · captured running Homarr running · healthy IT-Tools running · healthy Joplin running · no healthcheck Joplin-DB running · healthy mealie running · healthy Portainer-Agent running · no healthcheck Media VM · [private] 2 objects · captured running Plex running · healthy Portainer-Agent running · no healthcheck Web VM · [private] 3 objects · captured running Portainer-Agent running · no healthcheck WordPress running · no healthcheck WordPress-DB running · no healthcheck Count boundary HAOS add-ons, native AdGuard / Beszel, Hermes and other off-host engines are outside these 40 Docker objects. Request / data / control flow Logical membership / dated reference Retained / optional / not accepted now STATIC SNAPSHOT · Evidence 24 October 2026 · No live status or new acceptance implied Architecture relationships retained; identifying operational details are omitted. This is a dated overview, not live monitoring.
Application platform
Application platform Active application homes, data dependencies and the NAS service core. Static architecture snapshot, 24 October 2026. Arrows are labelled; dashed fabric links are logical membership, not physical cables.
HOME LAB / 05
Application platform Active application homes, data dependencies and the NAS service core.
24 OCT 2026
Apps VM · Guest · [private] · local [storage] app state Web VM · Guest · [private] service routing SQL SQL · internal network upstream :hidden upstream :hidden private service ports upstream :hidden NAS service core Storage NAS · [private] NPM + DNS + Portainer Beszel / Kuma / Dozzle / Diun Seerr via VPN; PostgreSQL private Native Compose owns VM apps NPM application ingress Private private service → private service Public private service → private service HTTP upstream routes to active VMs 35 enabled / 50 configured hosts Configuration ≠ public acceptance Retained NAS copies 9 stopped rollback objects No post-cutover sync back restart=no · not active outages Stack records ≠ live VM stacks Fence before any rollback Joplin private port on host Native Compose / systemd Joplin application → PostgreSQL Joplin-DB PostgreSQL · app network [storage] No published host DB port Homarr private service → private service SQLite in persistent [storage] Local Docker widget: Apps VM only NAS / Proxmox / hubs integrations Mealie + IT-Tools Mealie: private service → private service SQLite · [storage] IT-Tools: private service → private service Authenticated static tools WordPress private service → private service app network Native Compose / systemd WordPress-DB MySQL · app network [storage] No published host DB port WordPress files stay local Database boundary Companion databases are internal-only Docker ports; published app ports do not expose their database ports. Request / data / control flow Logical membership / dated reference Retained / optional / not accepted now STATIC SNAPSHOT · Evidence 24 October 2026 · No live status or new acceptance implied Architecture relationships retained; identifying operational details are omitted. This is a dated overview, not live monitoring.
DNS and access roles
DNS, HTTPS & direct access Name lookup is separate from the request path. Static architecture snapshot, 24 October 2026. Arrows are labelled; dashed fabric links are logical membership, not physical cables.
HOME LAB / 06
DNS, HTTPS & direct access Name lookup is separate from the request path.
24 OCT 2026
01 / Name lookup — not an HTTPS transit hop 02 / Private HTTPS request — its own connection 03 / Public HTTPS — configured route, not a new security acceptance DNS :hidden query DNS answer HTTPS :hidden HTTP / HTTPS private service NAT private port Client resolver query Management / Trusted / IoT Primary and secondary resolver roles No complete failover acceptance AdGuard resolver set NAS [private] · Guest [private] · HA [private] 36 identical rewrite records each Service names usually answer NAS [private] Answer to client Private address or host record Client then opens HTTPS Not a proxy request itself Guest / Shadow: gateway/default DNS; custom resolver order not verified. Private browser Uses resolved NAS address TLS request to [private] NAS → NPM private listener Host[private] → private service Custom private NPM HTTPS listener Active upstream App host / app port Not the DNS resolver hop Public client Cloudflare DNS / proxy context Origin / WAF / MFA not retested Gateway private service → NAS[private] NAT rule: tcp_udp No public origin address included NAS → NPM public listener private service → private service Then configured app upstream Enabled config ≠ origin restriction proof Direct Plex · not the NPM route Internet service traffic → [private] Plex also has independent enabled NPM routes. No new playback or public reachability test. Direct RustDesk · DNS-only native protocols service traffic · service traffic · service traffic → NAS [private] RustDesk-ID / RustDesk-Relay are not NPM HTTP upstreams. Management routes withheld from public view Request / data / control flow Logical membership / dated reference Retained / optional / not accepted now STATIC SNAPSHOT · Evidence 24 October 2026 · No live status or new acceptance implied Architecture relationships retained; identifying operational details are omitted. This is a dated overview, not live monitoring.
Media and storage
Plex & routed storage Read-only media, local state and a single dedicated Intel accelerator. Static architecture snapshot, 24 October 2026. Arrows are labelled; dashed fabric links are logical membership, not physical cables.
HOME LAB / 07
Plex & routed storage Read-only media, local state and a single dedicated Intel accelerator.
24 OCT 2026
01 / Actual routed NFS network path — NAS remains on its original network 02 / Media delivery chain — read-only at every shown boundary service traffic routed NFS NFS4.1 RO virtiofs RO writes state / disposable transcode Hypervisor host source [private] · Storage bridge USB App NIC / App bridge Source-pinned Storage Private VLAN Host NFS4.1 client UCG routed gateway [private] → Trusted network Storage VLAN has no Internet Flow toward NAS service traffic No invented NAS [private] address Storage NAS export [private] · eth5 reports 10Gb/s [storage] · read-only NFS Media / backup exports separate NAS media remains a dependency NAS media source [storage] Read-only NFS4.1 export No bulk media in guest archive Proxmox host mount [storage] virtiofs dirid=plex-media-ro cache=never · direct-io=0 Guest / Plex container Guest [storage] → container [storage] Bind RW=false Same identity + five library paths Local durable state Guest: 32 GiB OS + 256 GiB state [storage] → [storage] [storage] → [storage] 64 GiB scratch at [storage] Scratch excluded from native backup Exclusive Intel acceleration GPU device → Guest Intel GPU is exclusively passed to Plex NVIDIA T600 remains unchanged Guarded [host] owns startup Docker restart_policy=no is intentional Accepted / still unverified 24 Oct: real hardware HLS + VM reboot No new playback from atlas task Open: HDR / subtitles / long playback Open: 4 transcodes / 8 streams Open: host / cable / hard-NFS failures Request / data / control flow Logical membership / dated reference Retained / optional / not accepted now STATIC SNAPSHOT · Evidence 24 October 2026 · No live status or new acceptance implied Architecture relationships retained; identifying operational details are omitted. This is a dated overview, not live monitoring.
Backup and recovery
Backup & recovery Logical exports, native archives and the boundary of recovery evidence. Static architecture snapshot, 24 October 2026. Arrows are labelled; dashed fabric links are logical membership, not physical cables.
HOME LAB / 08
Backup & recovery Logical exports, native archives and the boundary of recovery evidence.
24 OCT 2026
Native guest archives — manual evidence, not a new recurring schedule exports selection restore Live application state Apps VM / Web VM native SQL + files NAS Seerr SQL / roles + 11 local SQLite Restricted NAS → guest SSH exports No live physical SQL data file copying No bulk Media or Downloads 02:00 · DSM task11 Native logical exports / snapshots Atomic latest / last-good · keep7 24 artifacts = 5 SQL + 13 SQLite + 6 file / config bundles Status re-read; no new export run 03:00 · Hyper Backup Europe/Dublin schedule Docker folder / export selection Attached USB destination [backup archive] Not offsite-isolation evidence Dated receipt — current status is not a rerun Dated backup checkpoint receipt · private details omitted The new generation inside USB, offsite isolation and full application restore are not proved. Existing USB success is not proof of the exact newly exported payload. Guest + VMs101/102/103 Native NAS-hosted archives exist Plex archive: 52.62 GiB Apps VM: 2,838,893,951 bytes Web VM: 2,380,122,873 bytes Guest excludes scratch / NAS media Isolated disk / config restore VM archives restored to isolated targets Targets were unbooted and removed Not booted app recovery acceptance No recurring guest backup added 500 GiB quota is not a reservation Protected host prerequisites NFS source / routing / network virtiofs mapping and Plex guard Separate protected bundle Restore order must cover dependencies Mirror / sync ≠ independent backup Retained rollback is a cutover checkpoint Nine stopped NAS copies; no post-cutover edits sync back. Fence one identity before rollback. Never start both. NAS loss still affects media and backup dependence. Recovery evidence stops here No full app restore / booted VM acceptance claimed. No new export / USB run / schedule change by this atlas. Current source status does not renew earlier acceptance dates. Request / data / control flow Logical membership / dated reference Retained / optional / not accepted now STATIC SNAPSHOT · Evidence 24 October 2026 · No live status or new acceptance implied Architecture relationships retained; identifying operational details are omitted. This is a dated overview, not live monitoring.
Monitoring and management
Observability & control Telemetry, container control, logs and application-facing checks. Static architecture snapshot, 24 October 2026. Arrows are labelled; dashed fabric links are logical membership, not physical cables.
HOME LAB / 09
Observability & control Telemetry, container control, logs and application-facing checks.
24 OCT 2026
NAS observability / control plane · Storage NAS · [private] Direct-socket NAS Beszel-Agent Socket :ro ≠ read-only Docker API authorization native telemetry outbound Edge control Kuma push authenticated metrics dashboard integration existing relay / reports Beszel hub :hidden · host telemetry Captured running Not a new delivery test Portainer :hidden · endpoint control Captured running Not a new delivery test Uptime-Kuma :hidden · service probes Captured running Not a new delivery test Dozzle :hidden · logs / viewing Captured running Not a new delivery test Diun Image update observation Captured running Not a new delivery test Native agent coverage Native Beszel: [private] / Hypervisor / Media VM Also Apps VM / Web VM HA protected add-on: guest-host stats NAS container Beszel-Agent: socket Native add-on inventory: WebSocket read HAOS placement owner-reported NAS VM control & push probes Edge agents initiate outbound control Authenticated Portainer channel Local Docker → native Kuma push probe No new unauthenticated TCP Docker API VM Compose / systemd owns apps NAS retained stacks ≠ VM runtime Current metric scope 85 monitor names returned All returned series status = 1 / UP Includes group series Not disabled-definition total Not an alert delivery test No new monitors or schedules Homarr · Apps VM · :hidden Integrates NAS / Proxmox / Portainer / Beszel / Kuma Native local Docker widget sees Apps VM only. Other hosts are surfaced through Portainer / Beszel. Dashboard integration ≠ independent monitoring plane. Alerts & action boundary Diun observes image updates; existing Hermes relay reports. No automatic upgrades or new delivery acceptance. Dozzle application actions / shell remain disabled by config. No socket proxy; :ro bind is not API-level authorization. Request / data / control flow Logical membership / dated reference Retained / optional / not accepted now STATIC SNAPSHOT · Evidence 24 October 2026 · No live status or new acceptance implied Architecture relationships retained; identifying operational details are omitted. This is a dated overview, not live monitoring.
Local AI and voice
Local AI & creative One tablet, explicit routing, current voice and clearly separated plans. Static architecture snapshot, 24 October 2026. Arrows are labelled; dashed fabric links are logical membership, not physical cables.
HOME LAB / 10
Local AI & creative One tablet, explicit routing, current voice and clearly separated plans.
24 OCT 2026
Creative execution — bounded engine choices, output returned only to the initiating profile explicit [private] explicit creative route optional only alternate interface of the same tablet Hostinger VPS · Hermes Controller / gateway, not local inference Assistant / Assistant + bounded [storage] Medium thinking · 65,536 context Route acceptance: 23 October 2026 No profile history / memory pooling One tablet · Ethernet [private] Ollama release · ComfyUI release · Windows runtime Selected local model · exact build withheld AMD Radeon(TM) 8060S Graphics reported via cuda-labelled runtime Ollama / ComfyUI system_stats respond in the 24 October metadata probe Reported accelerator metrics are not physical capacity proof Image paths Z-Image-Turbo · text-to-image Qwen2511 Lightning · reference edit Installed / dated tested paths Not new render acceptance Same tablet ComfyUI renderer Short silent video Experimental installed routes Short / silent only 10-second video remains disabled Audio / PC-video remain disabled No automatic PC / cloud switch Optional PC · [private] Endpoint :hidden only if selected Text-to-image only; gaming priority Inference / renderer probe failed Does not prove powered off No gaming detector installed Same-device Wi-Fi · [private] [private] is the tablet Wi-Fi address Not a second / redundant inference node Ollama / renderer probe: URLError Does not prove device powered off Fresh Ethernet metadata ≠ new route test No cloud fallback introduced Current voice · Kokoro Local CPU Kokoro · Nicole af_nicole Local speech profile · details withheld Current voice, not VoiceStudio Incoming transcription is separate Locked-screen mobile wake remains open No replacement TTS service deployed Plans only · not deployed VoiceStudio design auditions discussed Potential Ubuntu / Docker hosting Performance / AMD support untested Not installed or enabled Paperless-ngx also remains planned No new TTS or Paperless deployment Request / data / control flow Logical membership / dated reference Retained / optional / not accepted now STATIC SNAPSHOT · Evidence 24 October 2026 · No live status or new acceptance implied Architecture relationships retained; identifying operational details are omitted. This is a dated overview, not live monitoring.