Haphazard Homelab — Interactive Service & Architecture Dashboard

Oracle Cloud VPS

OCI ARM

Oracle Linux 9.8 • Hostname: haphazard-vps-oracle

Edge Hub

Public IP 82.70.253.152

Private VCN 10.0.0.160

Tailnet IP 100.64.0.1

Terminates all incoming public TLS traffic via Caddy (Let's Encrypt). Holds the control plane endpoint frps :7000 to receive outbound connections from home, bridging public HTTP subdomains to local & tunnelled containers.

Edge & Local Services

Caddy Proxy frps Tunnel Wallabag Karakeep Miniflux Homepage Uptime Kuma Headscale BentoPDF

iMac at Home

macOS Sonoma

User: yjpecht • Zero Inbound Ports Open

Storage & Compute

Home LAN IP 10.0.0.63

Tailnet IP 100.64.0.2

Storage Setup APFS + ExFAT/NTFS

Houses heavy workloads & media libraries. Initiates a single persistent outbound tunnel (frpc LaunchDaemon) to VPS. Home ISP block is transparently bypassed. Backup orchestrator (Backrest).

Heavy & Media Services

Plex Media Server Tautulli Seerr Audiobookshelf Bookorbit Maintainerr Backrest (Restic)

Traffic Routing Architecture & Outbound FRP Tunnel Logic

How external HTTPS requests cross CGNAT/Inbound blocks to reach home containers

Public Web Flow Tailnet Admin Layer

1. Entry Point

Public Internet

*.haphazard.one

Spaceship DNS A-Record
→ 82.70.253.152

2. OCI Edge VPS

Caddy Proxy & FRP Server

Terminates TLS (Let's Encrypt)

80/443: Caddy Reverse Proxy

7000: frps (Control plane)

3. Persistent Tunnel

Single Outbound TCP

Initiated by iMac LaunchDaemon

No port forwarding at home!
frpc dials OUT to frps

4. iMac Home Containers

Local Docker Apps

APFS DBs + External Media

• Plex (TCP 32400 Direct)

• Seerr (5055)

• ABS (13378) • Books (8083)

1

Outbound-Only Tunnel

frpc dials out to VPS. Home IP can drift without breakage and no open router ports are required. Single point of failure if frpc dies.

2

Caddy Owns All TLS

Caddy handles Let's Encrypt for both local VPS and tunnelled iMac services. Zero containers deal with cert renewals or HTTPS listeners.

3

Plex Direct Exception

Bypasses Caddy entirely. Operates as raw TCP tunnel on port 32400 with dual-IP setting so home clients get gigabit LAN speed directly.

4

Parallel Admin Network

Headscale Tailnet handles all admin traffic (Dozzle, Beszel, SSH). Nothing sensitive gets a public hostname, replacing complex auth layers.

Host:

Service & Role	Host	Port / Access Mode	Public URL / Endpoint	Status	Operational Notes
Plex	iMac	32400 (TCP)	http://82.70.253.152:32400/web	Active	Dual-IP setup. Bypasses Caddy entirely via raw TCP tunnel direct to VPS IP.
Tautulli	iMac	— (Tailnet only)	Tailnet only	Pending Closeout	Migrated Win11 → iMac Docker. Close-out (Kuma, Homepage bookmark) pending.
Seerr	iMac	5055	https://seerr.haphazard.one	Active	Manual fulfillment (Sonarr/Radarr dropped D26). Kuma accepts 200–399 (307 redirect).
Audiobookshelf	iMac	13378	https://audiobooks.haphazard.one	Active	Tuned specifically for Android & Android Auto client connections.
Bookorbit	iMac	3000 → 8083	https://books.haphazard.one	Active	Calibre-Web. Asymmetric port mapping (8083 public target). Image refreshed recently.
Maintainerr	iMac	6246	LAN / Tailnet only	Internal	Plex library housekeeping. Report-only mode per D27 (no auto-delete).
Caddy	OCI VPS	80 / 443	*.haphazard.one	Active	Automated Let's Encrypt TLS. Single entry point for all proxied subdomains.
frps	OCI VPS	7000	Control plane endpoint	Active	Tunnel server. Exposes iMac proxy stanzas on VPS localhost for Caddy. Token auth.
Wallabag	OCI VPS	8080	https://wallabag.haphazard.one	Active	Postgres DB. Exception to /opt/ path (/home/opc/wallabag/). Trial decision Nov 2026.
Karakeep	OCI VPS	3010	https://karakeep.haphazard.one	Active	Meilisearch sidecar on internal network only. Deployed Phase 3.
Miniflux	OCI VPS	—	https://rss.haphazard.one	Active	Minimal RSS reader. Google Reader API enabled for mobile client integrations.
Homepage	OCI VPS	3020	https://home.haphazard.one	In Progress	Protected by Caddy basic_auth (holds API keys). Retires legacy homelab_dashboard.html.
Uptime Kuma	OCI VPS	—	https://uptime.haphazard.one	Active	Monitors host-ports vs public-hostnames to distinguish tunnel failure from Caddy failure.
Headscale	OCI VPS	—	https://headscale.haphazard.one	Active	Self-hosted Tailscale mesh control plane (v0.29.3). 6 nodes enrolled.
BentoPDF	OCI VPS	—	https://pdf.haphazard.one	Active	Client-side static PDF editor. Lowest risk service in the entire stack.
Standby Instance 01	OCI Micro 1	Subnet 10.0.1.136	100.64.0.5 (Tailnet)	Standby	Reserved IP 158.178.250.105. Enrolled in Tailnet, deferred from monitoring until active.
Standby Instance 02	OCI Micro 2	Ephemeral Public IP	100.64.0.6 (Tailnet)	Standby	Ephemeral IP (unstable — never hardcode). Reached via Headscale Tailnet durable IP.

Homelab Security Architecture & Hardening Rules

Defense-in-depth model, Docker firewalld bypass mitigations, and accepted risk findings

No Unified Auth Layer (D19 By Design)

No Authelia / TinyAuth (D19) Architectural Rule

Unified SSO would break native app clients (Audiobookshelf, Seerr). Instead, no admin tool gets a public hostname; access is strictly over Headscale Tailnet.

Docker Firewalld Bypass (M2) Critical Process

Docker writes iptables rules ahead of firewalld. VPS compose ports MUST be prefixed 127.0.0.1: or they become silently public. Verified via sudo ss -tlnp | grep docker.

SSH Hardening Enforced

Open to 0.0.0.0/0 on all VPS nodes but password auth is disabled at daemon level. Key-only auth; scanner traffic treated as noise.

Accepted Risks & Open Architecture Findings

Tracked in session notes

Ref ID	Finding Description	Severity & Risk Status	Impact Analysis	Mitigation / Recommendation
C1 / C2	Unrotated FRP Tunnel Token	Accepted Risk	Token pasted in chat log; unrotated since creation. Threat: rogue tunnel registration.	Rotation repeatedly declined as low value in home threat model.
H1	Plex Unencrypted Raw TCP Streaming	Performance Tradeoff	Bypasses TLS termination. Traffic on port 32400 is cleartext TCP over VPS tunnel.	Accepted for transcode/playback performance and 10TB free egress cap.
L1	Hardcoded VPS Public IP Across Configs	Doc Drift Risk	If VPS IP changes again, Caddy/DNS/Docs break simultaneously (as seen in Aug 2026 drift).	Perform periodic sweep across ARCHITECTURE.md and homelab scripts.
L3	Subnet Overlap (10.0.0.0/24)	Low Impact	Home LAN and OCI VCN both use 10.0.0.0/24. Blocks future direct site-to-site subnet routes.	Harmless today due to Headscale overlay (100.64.0.0/10). Renumber side if needed later.

Three-Layer Observability Strategy

Non-Overlapping Roles

Layer 1: Uptime Kuma (OCI VPS)

Split into host-port checks (detects tunnel down) vs public-hostname checks (detects Caddy/TLS failure). Lives on VPS so it can differentiate failure modes.

Layer 2: Beszel Metrics Hub (Tailnet Bound)

Host metrics (Disk, CPU, RAM, system-down alerts). Hub on VPS Tailnet (100.64.0.1:3050). 5 active alerts configured.

Layer 3: Dozzle Logs & Dockcheck

Independent Dozzle container instance per host (no shared failure mode, never public). Dockcheck sends stale-image updates.

Encrypted Offsite Backup Architecture

iMac Orchestrated

Resti + Rclone + Backrest Nightly 03:15

All snapshots are client-encrypted with restic and pushed via rclone to Google Drive.

Zero Cloud Creds on VPS: Cloud credentials exist solely on the iMac to prevent exposure if public edge VPS is compromised.

Dead-Man's-Switch: Healthchecks.io ping on completion. Pings alert if backups silently stop running.

Headscale Tailnet Topology Map

VPS: 100.64.0.1

iMac: 100.64.0.2

Asus Laptop: 100.64.0.3

Pixel 10 Pro: 100.64.0.4

Micro 01: 100.64.0.5

Micro 02: 100.64.0.6

Homelab Close-Out & Pending Action Items

Track tasks needed to align codebase documentation and monitoring state

0 / 5 Completed

Tautulli Close-Out Add to Uptime Kuma, Homepage bookmark, homelab-dump.sh, and update ARCHITECTURE.md & DECISIONS.md.

iMac Beszel Agent Redeploy Container & image currently missing on iMac; investigate and redeploy with correct tailnet HUB_URL.

Resolve FRP Tunnel Naming Collision Fix beszel-agent frp tunnel proxy proxy-name collision on OCI.

Homepage Polish & Legacy Retirement Add Dozzle & Maintainerr bookmarks to Homepage dashboard and officially retire homelab_dashboard.html.

Documentation IP & Deployment Sweep Update stale VPS IP (82.70.214.130 → 82.70.253.152) across ARCHITECTURE.md and shift Karakeep/Miniflux/Homepage from "planned" to "deployed".