This is my home lab, AlphaSec United. At its center is Galaxy, a five-node Proxmox VE cluster behind a zone-segmented UniFi network. It runs an Active Directory forest synced to Microsoft 365, a Wazuh and Splunk security stack, Prometheus and Grafana monitoring, and self-hosted services such as Immich, Jellyfin, Forgejo, Coolify and TeamSpeak.

These docs are written from my public repo, Duresa7/Homelab, which holds the guides, change records, inventories and incident reports behind every page here.

What it is for

The lab does two jobs at once.

• It runs things people rely on. My photo and video library lives in Immich. Jellyfin serves the media library, with requests and downloads automated around it. Two TeamSpeak 3 servers host voice chat for my users. Forgejo is my own git server and private image registry, Ollama serves a small local model behind Open WebUI, and App Portal gives the locked-down ObiPC a self-service software catalog.
• It is where I practice the infrastructure I want to be good at. Most of what runs here is identity, security monitoring, automation and the network segmentation around all of it: a two-controller Windows Server 2025 forest with tiered administration and Windows LAPS, Wazuh agents on fifteen hosts feeding Splunk Enterprise Security, Ansible and Semaphore patching the Linux fleet, and a UniFi gateway enforcing twelve firewall zones.

The lab changes faster than I can remember it. My own documentation site once published a VM I had already deleted and left out one I had added. So every figure in the repo, and on these pages, carries the date I last read it from the live system, and retired systems move to an archive instead of lingering in the current records.

At a glance

Area	Current state	Checked
Cluster	Five Proxmox VE 9.2.11 nodes (grey, purple, blue, red, green), five of five votes, no shared storage, no HA resources	2026-09-24
Guests	18 (12 VMs, 6 LXCs) plus 3 templates; 16 running	2026-09-24
Network	UniFi Network 10.6.106 on the Ahsoka gateway, three switches, one access point; 23 networks, 16 routed LANs in 12 zones	2026-09-24
Identity	Forest ad.alphasecunited.com on HQ-DC01 and HQ-DC02 (Windows Server 2025); HQ-MGT01 runs Windows Admin Center 2.7 and the Entra Cloud Sync agent for Microsoft 365	2026-09-25
Security	Wazuh 4.14.8 with 15 active remote agents (2026-10-02); Splunk Enterprise 10.4.0 with Enterprise Security 8.5.1 and SC4S taking UniFi CEF (2026-09-24)	2026-10-02
Monitoring	Prometheus 3.14.0 with 50 targets in 6 jobs, all up; Grafana 13.2.2 with 23 alert rules posting to one Discord channel	2026-09-27
Access	24 internal HTTPS names on Nginx Proxy Manager 2.15.1 with a DNS-01 wildcard certificate; NetBird 0.79.0 for remote access; the public services have a separate path	2026-09-27
Automation	Ansible 14.2.0 and Semaphore 2.18.27 (3 projects, 23 templates); Dockhand 1.0.48 with Hawser agents on six hosts	2026-09-24
Workstations	Jedi PC, my admin workstation, on Secure VLAN 50; ObiPC, a domain-joined Windows 11 PC on Secure Client VLAN 60, reachable over SSH again on 2026-09-27	2026-09-27

The full guest list, with what each guest runs, is on the inventory page.

Note: The repo publishes more detail than these pages do. I leave out internal addresses, service ports, account names and the public ingress path here; the linked repo records are the full reference.

How it got here

When	What happened
2025	The lab started as two desktop towers on a flat network, with every service reached by IP address. grey-server was running Proxmox VE by August 2025.
2026-05-27 to 2026-05-30	I prepared Grey’s single-node cluster, Galaxy, and joined purple-server and blue-server to it. Immich moved to a new 2 TB drive on 2026-05-28.
2026-07-07	red-server joined as the fourth node.
2026-07-09	I started the documentation repo these pages are written from.
2026-07-10 to 2026-07-12	A second Corosync link on its own VLAN, the NetBird and Nginx Proxy Manager access stack, and Wazuh and Splunk moved into Security-A.
2026-07-17 to 2026-07-26	The media stack on media-01, two UPS units, a new boot drive for Purple, and monitoring moved to its own container and VLAN on Blue.
2026-07-27 to 2026-07-28	UniFi zones consolidated and the management VLAN locked down. I retired the first Active Directory domain and Termix.
2026-07-31	green-server was installed over UEFI PXE and joined as the fifth node.
2026-08-03	Wazuh agents went out across the fleet, including all five nodes.
2026-08-06 to 2026-08-20	Retirements: Syncthing, ai-bravo-02, the first TeamSpeak server, debian-dev (replaced by ubuntu-dev), Kasm Workspaces and supabase-01.
2026-08-29 to 2026-09-03	Wazuh alerts flow into Splunk, UniFi’s intrusion prevention moved to Notify and Block, and Grafana and Splunk alerts started reaching Discord.
2026-09-04 to 2026-09-05	Proxmox VE 9.2.11 on all five nodes, and the GTX 1080 Ti went to work for Ollama and then Immich.
2026-09-09 to 2026-09-10	I built the ad.alphasecunited.com forest and connected it to Microsoft 365 through Entra Cloud Sync.
2026-09-11 to 2026-09-12	app-01, edge-01 and alpha-prod-01 moved to Purple and ansible-01 to Blue. game-01 and its game servers were retired.
2026-09-15 to 2026-09-16	Dockhand replaced Dockge, and then Portainer and its Edge Agents.
2026-09-20 to 2026-09-23	Green failed a memory test, so win11-dev moved off it to Grey. Green has held no guests since.
2026-09-25 to 2026-09-28	Weebarr, Homelab Dashboard and What’s Up Docker retired; Homarr arrived; BookOrbit replaced BookLore.
2026-10-02 to 2026-10-05	Package updates on all twelve running Linux guests, Wazuh 4.14.8, and Sure deployed.

Every one of those changes has a dated record. The change history lists them all, one line each.

How the repo and these docs are organized

The repo is organized by who owns a thing, not by topic:

Repo folder	What it holds
Guides	Step-by-step builds written for readers, each verified against the live system
Architecture	Designs that span several systems
Infrastructure	The UniFi network, the Galaxy cluster and the physical hardware
Platforms	One folder per deployed service, with its config, change records, runbooks and troubleshooting
Engineering	Shared tooling that is not run as a service
Operations	Inventories and cross-system maintenance
Security	Incident reports and security assessments
Backups	Redacted config copies taken before edits
Archive	Retired systems and superseded records, under their original paths
Assets	Eighteen generated diagrams and the generator that builds them

These docs regroup that material into seven sections:

Docs section	Pages	Written mainly from
Overview	This page	README.md, the folder READMEs
Architecture	Proxmox cluster, network, hardware, access paths, provisioning	Architecture/, Infrastructure/, Platforms/Galaxy PXE
Platforms	Automation, containers, the Linux baseline, photos and media, TeamSpeak, other services	Platforms/, Guides/
Identity and endpoints	Active Directory, endpoints, Microsoft cloud	Platforms/Active Directory, Action1, App Portal, Microsoft Intune, Windows Admin Center, Azure Arc
Security and monitoring	Wazuh, Splunk, monitoring and alerting, incident response	Platforms/Wazuh, Platforms/Splunk, Platforms/Prometheus, Security/
Operations	Inventory, maintenance, change history, roadmap	Operations/, TODO.md, COMPLETED.md, Backups/, every Change Records folder
Retired systems	Every retirement, Kasm Workspaces, game servers, Portainer, Syncthing, Homelab Dashboard, the TNIO AI bot, retired guests	Archive/

Each page names the repo files it was written from at the top, and the date those sources were last checked.

Where each repo guide lands: the hosts grouped by job, with the guide that covers each group.

Start here

If you read five pages, read these in order. It follows the start-here order in the repo’s README.

1. Proxmox cluster: the five nodes, both Corosync links, and why there is no shared storage.
2. Network: the VLANs, the twelve zones and the policy order that holds them apart.
3. Linux host baseline: what every Linux guest gets before it carries a workload.
4. Active Directory: two domain controllers, tiered OUs and Windows LAPS.
5. Wazuh and Splunk: endpoint alerts, malware detection, and the dashboard they end up on.

Then the reference pages: the inventory for what runs where, maintenance for how it is kept current, and the roadmap for what is still open.