# Let's get technical - Defined some [[Home Lab-Intro#Home lab goals|loose goals]] for my home lab - Defined the [[Home Lab-Intro#Privacy vs. Security|CIA Triad]] and discussed how it relates to my home lab project - Talked about [[Home Lab-Intro#Reduce Reliance on online services|reducing reliance]] on online services - Discussed running my own [[Home Lab-Intro#Run local AI|local AI]] - Made sure to leave room to [[Home Lab-Intro#Leave room to experiment|experiment]] ## Take inventory: ### Server For the server itself, I have a desktop computer I built one year ago, meaning we have some pretty modern hardware installed: - [MSI Z690-A WiFi DDR4](https://www.msi.com/Motherboard/PRO-Z690-A) motherboard - Compatible with up to 128 GB of RAM - 2.5 GB LAN - 4x M.2 SSD slots, 3 of which are PCI 4. - Intel [i7-12700KF](https://www.intel.com/content/www/us/en/products/sku/134595/intel-core-i712700kf-processor-25m-cache-up-to-5-00-ghz/specifications.html) - [Nvidia RTX 3060 12GB](https://www.nvidia.com/en-us/geforce/graphics-cards/30-series/rtx-3060-3060ti/) GPU (graphical processing unit) - [64 GB DDR4 RAM](https://www.corsair.com/us/en/p/memory/cmk64gx4m2e3200c16/vengeancea-lpx-64gb-2-x-32gb-ddr4-dram-3200mhz-c16-memory-kit-black-cmk64gx4m2e3200c16) running at 3200MHz - [Corsair 750 Watt Semi-Modular Power Supply](https://www.corsair.com/us/en/p/psu/cp-9020222-na/cx-m-series-cx750m-750-watt-80-plus-bronze-semi-modular-atx-psu-cp-9020222-na) ### UPS As a battery backup, I have a [CyberPower Pure Sinewave 880 Watt UPS](https://www.cyberpowersystems.com/product/ups/pfc-sinewave/cp1350pfclcd/). The main reason I chose this is because I found drivers that allow the power supply to communicate with [Debian](https://www.debian.org/) based server OS's. This allows the UPS to tell the server to shutdown gracefully in the event of a power failure. ### Router/Firewall For my router/firewall I chose the [Ubiquity Unify Express](https://ui.com/cloud-gateways/wifi-integrated/express). Its an all in one router, SDWAN, Wireless AP (Access Point) with VLAN's and easy to use firewall rules. Additionally it supports WiFi 6, which means it has [WPA3](https://www.wi-fi.org/discover-wi-fi/security), a much more secure WiFi encryption protocol. ## Services: ### Server OS For my server OS, I'll be choosing [Proxmox](https://www.proxmox.com/en/) due to its wide compatibility, active development community, features, and ease of use. Everything else on my server will be virtualized within Proxmox. #### NAS For my NAS, I'll be virtualizing [TrueNAS](https://www.truenas.com/truenas-scale/). Its a robust open-source NAS with the ZFS filesystem. ZFS performs checksums to ensure [[Home Lab-Intro#Privacy vs. Security|file integrity]], helping us adhere to the `I` in the CIA Triad. Like any good NAS, it supports RAID, specifically [RAIDz](https://openzfs.github.io/openzfs-docs/Basic%20Concepts/RAIDZ.html), a ZFS version of traditional RAID. In my setup, data will be stored across two 4 terabyte hard drives. In the event of one failing, the other will have a copy of everything, keeping my data safe. My NAS will mainly be used as a data backup solution for my laptop and smartphone. My NAS will be home to all backups and data storage for Photos, Movies and TV shows, and my friend's NAS backup. All of my files and photos and media will be stored on a volume which only I have access to, and I will create a volume for my friend that only he has access to. #### Immich For hosting my photos and videos from my phone, I will be running [Immich](https://immich.app/). This software isn't a data storage service, its a frontend to display what is stored in TrueNAS. Through here I will be able to upload photos and videos from my phone and display them in a Apple/Google Photos-esq environment, right from a browser. This service will be running as an LXC container on Proxmox, since it is just "serving up" data from the NAS, and doesn't require much processing power. #### Jellyfin For hosting home media such as TV shows, Movies and maybe even music, I will be running [Jellyfin](https://jellyfin.org/). Just like Immich, it runs as a service and pulls data from the NAS. And just like Immich, I will be running it as an LXC container on Proxmox. #### Recursive DNS Server For my digital privacy, I will be virtualizing a recursive DNS Server in place in the form of [Pi-hole](https://pi-hole.net/). Pi-hole allows me to upload a variety of DNS block lists to stop Ads, Trackers and Malware. This is not a firewall, or a bulletproof solution but it will significantly increase my privacy and reduce the chance of stumbling across a malicious site. Additionally, using [unbound](https://docs.pi-hole.net/guides/dns/unbound/), any DNS requests that aren't cached already by Pi-hole will be forwarded to the root DNS of the internet, rather than Google or Cloudflare. This increases my privacy by keeping those services from logging my internet activity. Finally, my DNS server features [DNSSEC](https://www.icann.org/resources/pages/dnssec-what-is-it-why-important-2019-03-05-en), which uses cryptographic signatures to verify that URL's are associated to the correct IP address. This reduces the chance of my network being targeted by [DNS Poisoning](https://www.fortinet.com/resources/cyberglossary/dns-poisoning) attacks, which are devastating because the victim has no way of knowing they are visiting a malicious site. #### Password Cracking My favorite password cracking program is [Hashcat](https://hashcat.net/hashcat/). It is a powerful GPU based password cracking tool that I have used many times in CTF's and my own WiFi Pen-testing. Having the ability to send a hash to my server and let it run on its own would be a fantastic tool for my research. Both my **Local AI** and my **Password Cracker** would need access to my GPU, and only one can use it at a time. This is going to be a big question that comes down to my use cases as I build out and test the server. ## Connectivity: ### Tailscale Mesh VPN Tailscale is a Mesh VPN network, also known as an `overlay network`, it uses a `coordination server` for each device or `node` on a `tailnet` to find each other. The `coordination server` only exchanges public keys from each `node`, this allows `nodes` to find each other. Once two or more `nodes` exchange their keys, they initial a `WireGuard` tunnel connection between them, rather than sending all traffic through the VPN server. This makes `overlay networks` faster and cheaper to run without sacrificing security or ease of use. #### Tailscale and Mullvad Exit Nodes Tailscale and [Mullvad](https://mullvad.net/en/) partnered to provide `Mullvad Exit Nodes` around the world to Tailscale Mesh VPN users. This is possible because both services use the [WireGuard](https://www.wireguard.com/) protocol, Tailscale simply sees `Mullvad Exit Nodes` as regular `Exit Nodes` which Tailscale already supports. This provides me both remote connectivity to my home network, and private browsing from any `Mullvad` server I want to use. It also turns my homelab from a physical network into a fully virtual network. #### Features Tailscale allows me to access all of the following remotely: - Perform backups to my [[Home Lab-Technical Details#NAS|NAS]] - Stay behind my home [[Home Lab-Technical Details#Router/Firewall|Network]] when I want to - Use my [[Home Lab-Technical Details#Recursive DNS Server|DNS]] server, or a `Mullvad` DNS server through an `Exit Node` - Access TV shows, movies, music and photos - Manage Proxmox and even spin up new Virtual Machines ## Network Diagram: ![[Network Diagram.png]]