The Fellowship · WolfStack Homelab

6-node Proxmox 9.2 + Ceph + native ZFS · Tolkien-named as of 2026-07-19 · live inventory
D Docker (host-native) L LXC V VM H host service stopped / revert-path

Edge & ingress

How a request gets in: everything internal terminates at one reverse proxy (WolfProxy on aragorn); the only public door is NetBird's traefik. DNS is authoritative on Technitium with the gateway ad-filtering in front.

Networks

VLAN 1 clients 10.1.1.0/24 mgmt nodes 10.1.3.0/24 VLAN 4 services 10.1.4.0/24 VLAN 6 storage/NFS 10.1.6.0/24 VLAN 7 corosync ring0 10.1.7.0/24 WolfNet mesh 10.10.10.0/24 NetBird WireGuard 100.x P2P

Fabric: 20 G bond (vmbr1, jumbo 9000) carries VLAN 4 + storage; mgmt vmbr0 2.5 G (10 G on aragorn); Thunderbolt mesh for Ceph.

DNS chain split-horizon

client → EFG ad-filter → Technitium 10.1.4.53 (pippin, primary) / .54 (merry, secondary) → 1.1.1.1 / 1.0.0.1

  • *.ldl.foo internal → WolfProxy .4.3; media/arr names → NetBird .4.101
  • *.vms.ldl / *.docker — direct/legacy names
  • Certs: Porkbun DNS-01 — PVE native ACME per node + acme.sh wildcard on aragorn

UniFi hardware 12 devices, all online

  • EFG gateway · USW Pro Aggregation · USW EnterpriseXG 24
  • USW Enterprise 24 PoE · 2× USW Enterprise 8 PoE · USW Flex 2.5G 8
  • 3× U7 Pro APs (office / living / bedroom) · 2× USP PDU Pro

Compute — the six nodes

Apps run host-native Docker (visible cluster-wide in WolfStack); infrastructure with its own blast radius runs in LXCs. Stopped guests are kept deliberately as revert paths.

aragorn

10.1.3.3 · 003
WolfStack master · WolfProxy ingress · bulk storage host · LLM
Arc B60 (LLM)123 G RAM 20 disks · strider 382 T raidz2ARC 48 G
Host services
HWolfProxy all internal HTTPS names10.1.4.3:443
HNFS server strider media + minis-tirith10.1.6.3
Htooling acme.sh · iac-capture · deploy key · infisical-push
HOpenLinkHub HX1500i PSU + DDR5 temps · cooling-aragorn.ldl.foo:27003
Docker
Dlemonade LLM server, B60 Vulkanhost:13305
Dpalantir media-library truth-checker:8484
Dnextcloud file sync & share (+db/redis/cron):8085
Dscrutiny SMART health · 24 devices:8083
Dhawser dockhand agent.4.3:2376
Guests
Vtruenas 100 retired — rollback onlystopped

frodo

10.1.3.5 · 005
Jellyfin home · media companions · Ceph
MS-01 · 96 GArc A310 → jellyfinmediastack-db RBD
Docker
Djellyfin media server · public10.1.4.111:8096
Ddockhand cluster Docker UI10.1.4.102
Dwizarr media invites10.1.4.115
Dtracearr + pg + redis10.1.4.117
Djfa-go self-service pw reset · public10.1.4.123
Guests
LCT 102 · 104 · 113 stopped migration revertsstopped
Llogs 109 Grafana+Loki · journald all 7 nodes10.1.4.133

sam

10.1.3.6 · 006
arr automation · requests · stats · Ceph
MS-01 · 96 GArc A310arr-db RBD
Docker — arr-stack (shared IP 10.1.4.116)
Dsonarr TV:8989
Dradarr movies:7878
Dlidarr music:8686
Dprowlarr indexers · rate caps:9696
Dbazarr subtitles:6767
Dsabnzbd usenet · local-NVMe incomplete:8080
Dprofilarr quality profiles:6868
Docker — standalone
Dseerr media requests · public10.1.4.121:5055
Djellystat watch stats · Infisical pilot10.1.4.124:3000
Dhawser.4.6:2376
Guests
LCT 116 arr-stack stopped revertstopped

merry

10.1.3.7 · 007
Emby · git + secrets infrastructure · Ceph
MS-01 · 96 GArc A310 → embymerry-db RBD
Docker
Demby media server · public10.1.4.110:8096
Dgitea IaC home · git.ldl.foo10.1.4.128
Dinfisical primary secrets store + pg + redis10.1.4.129
Dtechnitium DNS secondary10.1.4.54:53
Dhawser.4.7:2376
Guests
Lmeshcentral 119 remote desktop10.1.4.119
Lpangolin-newt 111 pangolin site connector (staged)10.1.4.134
Luptime-kuma 106 25 monitors · Discord + mail10.1.4.125:3001
Vclaude 114 Claude workstation VM10.1.4.114

pippin

10.1.3.8 · 008
Plex · DNS primary · dashboards · Ceph
MS-01 · 96 GArc A310 → plexpippin-db RBD
Docker
Dplex media server10.1.4.112:32400
Dtechnitium DNS primary · authoritative10.1.4.53:53
Dgotify push alerts · gotify.ldl.foo:8093
Dgotify-shim discord-webhook → gotify relay:8094
Dhomepage dashboard · home.ldl.foo10.1.4.127
Dbambuddy 3D-print companion10.1.4.122
Dbeszel metrics hub · agents on all 6host:8090
Dunifi-mcp UniFi cloud API · LAN-onlyhost:3131
Dhawser.4.8:2376
Guests
Lhomelabhero 105 self-hosted Claude ops UI10.1.4.126:3001
Vwin11-kydoc 110stopped

gimli

10.1.3.9 · 009
live TV · CI runner · remote-access + MCP LXCs · Ceph
MS-01 · 96 GArc A310iptv-db RBD
Docker (host IP 10.1.4.9)
Dtunarr virtual channels → jellyfin:8000
Ddispatcharr IPTV manager · public:9191
Dchannels-dvr DVR:8089
Dact-runner Gitea Actions CI
Dprint-cost-tracker 3D/UV print project costs:3000
Darr-dashboard unified arrs + media servers UI:8087
Dseerr-emby media requests (emby users) · LAN:5055
Dhawser.4.9:2376
Guests
Lnetbird 101 remote access + public ingress10.1.4.101
Lhomelab-mcp 103 control-plane MCP · LAN-only10.1.4.56:9100
Lclaude-code 107 Claude Code CLI · homelab agent10.1.4.132
VwinServer2025 108stopped

legolas

10.1.3.10 · 10-legolas
GPU box: gaming VMs + streaming · 9950X3D/X870E swap 2026-08-13
Arc Pro B60RX 9070 XTgreenleaf 2T NVMe mirroriCUE LINK H150i
Host services
HOpenLinkHub LINK hub: 9 fans + H150i pump/coolant + HX1000i · cooling.ldl.foo:27003
Hhost-temps nic/nvme/cpu/psu JSON exporter10.1.4.10:8086
Guests
Vgaming-9070xt 120 Apollo/Moonlight · 9070xt.vms.ldl10.1.4.130
Vgaming-b60 121 Apollo/Moonlight · b60.vms.ldl (B60 → host after swap)10.1.4.131
Vicue 122 iCUE · borrow-only USB windowsstopped

Storage & data protection

Three tiers: bulk media on one big ZFS pool served over NFS, databases on triple-replicated Ceph block, shared configs on CephFS. Everything stateful is backed up nightly to a standalone PBS box.

strider bulk media — native ZFS on aragorn

Pool
raidz2 · 20 disks · 382 T (~109 T freed 2026-07-19)
Served
NFS 10.1.6.3, root_squash, uid 1000
Layout
arrs/ single dataset (post-merge → imports are renames) · minis-tirith
Care
sanoid snapshots · monthly scrub · smartd on all 20 disks

Ceph 5× MS-01 NVMe, 3× replicated

edoras RBD
per-node DB images (mediastack-db · arr-db · merry-db · pippin-db · iptv-db) + guest rootfs
shire CephFS
app configs / metadata (/mnt/pve/shire)
Rule
databases on RBD, never CephFS
Local
rpool/sab-incomplete NVMe scratch per node

Backups & power boromir PBS · 10.1.4.32

03:00
vzdump — every VM/LXC → PBS
04:05–55
rbd-pbs-backup — DB RBD snapshots + /opt/docker, all 6 nodes
05:25
iac-capture — live compose drift → Gitea → GitHub mirror
Power
2× USP PDU Pro · rpi NUT UPS daemon

Control planes & automation

WolfStack cluster fabric

  • Master + UI on aragorn (:8553 per node) · WolfNet mesh 10.10.10.x
  • WolfRun: 9 adopted services, failover verified (VIP data-path still a dev item)
  • FIM watches authorized_keys — cluster keys live in /etc/pve/priv

IaC pipeline push-to-deploy, live

  • Gitea git.ldl.foo → Actions on gimli → ssh deploy to owning node
  • Secrets: Infisical per-stack identities + stack-up · 1Password break-glass
  • Nightly drift capture + secret-scan gate · GitHub mirror

Agents & monitoring

  • homelab-mcp (PVE/DNS/NetBird/WolfStack APIs) · unifi-mcp (cloud, read-only)
  • HomelabHero web-Claude with SSH broker · dockhand + hawser on every node
  • Uptime Kuma 25 monitors → Discord/mail · arr health canaries · import-lag watchdog