Skip to content

Build it yourself

These docs exist so you can build the same system. This section is the on-ramp: what you need, how to plug in your own values, and the ordered path through the build. The detailed steps live in the runbooks — this page is the map over them.

Do this first

Open Personalize and enter your ${domain} and network layout. Every command on the site then shows your values, and the copy button copies them. You can change them any time; nothing leaves your browser.

Prerequisites

  • A hypervisor host — a machine running Proxmox VE (or equivalent) with enough CPU/RAM for a firewall VM plus a handful of small server guests, and an SSD for the guests.
  • Two networks into the firewall — a WAN uplink and a VLAN-capable LAN trunk (the zones are tagged VLANs on one LAN NIC).
  • A domain you control (${domain}) and the ability to set its nameserver delegation.
  • At least one small VPS for the public edge (more vendors = more resilience), if you want to serve public sites the privacy-preserving way. You can build the whole internal lab first and add the edge later.
  • A VPN provider for egress (any WireGuard-capable provider).
  • Comfort with the Linux command line and basic networking. You do not need to be an expert — the runbooks are ordered and each one validates before the next.

How the build works

  • Provisioning is a clone-and-cloud-init shell script driving the hypervisor CLI — no third-party IaC providers. One template, cloned per guest.
  • Configuration is Ansible with built-in modules only, pinned to a fixed version.
  • A few appliances (the firewall, the identity server, the smart-home OS) are installed by hand, per their runbook; everything else is destroy-and-rebuild from code.

This is why it's reproducible for you: the steps you follow are the same code that operates the running system.

The ordered build path

Do them in order; validate each before moving on. Each links to its runbook.

  1. Foundation & provisioning — hypervisor bridges, the VM template, clone the fleet, create the firewall VM. → Runbook 01
  2. Firewall base & network — install OPNsense; interfaces/VLANs; DHCP/DNS. → 02 · 03 · 04
  3. VPN egress & firewall rules — the egress tunnels + kill-switch, per-zone allow-lists, road-warrior + admin access, cross-VLAN discovery. → 05 · 06 · 07 · 08
  4. Origin & identity & storage — the origin TLS terminator; FreeIPA; ZFS/NFS; client enrollment. → 09 · 10 · 11 · 12
  5. SSO, validation & config — Authelia forward-auth; end-to-end validation; the control node and the Ansible maintenance layer. → 13 · 14 · 15 · 16
  6. Edge & the rest — the public edge VPSes; observability; find-my-device; the SSH-CA; media + smart-home. → 17 · 18 · 20 · 21

The later runbooks (22+) cover refinements: image-mode workstations, host firewalls, encrypted storage with network-bound unlock, an automated host-CA, failure alerting, the agent operating model, container migration, the internal registry, and static-site delivery.

Make it your own

As you follow the runbooks, substitute your values for the placeholders. The big ones:

  • ${domain} — your public domain (and ${domain_alt} if you serve a second one).
  • Network layout — the zone subnets (${ip.mgmt}, ${ip.servers}, ${ip.dmz}, …) inside ${ip.space}. Keep the shape (separate zones per trust level); the numbers are yours.
  • Edge public IPs (${edge.ns1_public}, ${edge.ns2_public}) — whatever your VPS vendors assign.

Self-hosting these docs too? Edit docs-draft/values.json at the repo root and rebuild — your values become the defaults everyone reading your copy sees.