Infrastructure / networking / local AI

Home Lab

I run more hardware at home than I strictly need. This is the current setup and what I'm doing with it.

Compute & services

• My k3s cluster runs on four old Dell Optiplexes running RHEL 9.

  It hosts Jellyfin, Paperless-ngx, Pocket ID, and a pile of other services. I use argocd to deploy everything.

• Unifi Dream Machine Pro, managed switches, and access points.
• A Synology NAS with about 26TB of usable storage, available over Tailscale.
• An AMD Ryzen AI Max 395+ mini PC with 128GB of unified memory. It runs Ubuntu and handles most of my AI experiments.
• A gaming PC with an RTX 4070 Ti 12GB, running Bazzite for gaming and AI experiments.
• Raspberry Pi 5 running Home Assistant OS with a Zigbee adapter.
• I also run a handful of VPSs across RackNerd, Netcup, and Hetzner.
• My public DNS is hosted on DNSimple. I'm moving away from Cloudflare because I don't like how much of the web sits behind one company.

AI / ML

I use the $20 Ollama Cloud plan and the $100 ChatGPT Pro-Lite plan for cloud models. Which one I use depends on what I'm testing and where the model runs best.

For local inference, I run Qwen3.8 Flash on the Ryzen AI Max node. Its 128GB of unified memory can load large models that won't fit on a normal GPU. The RTX 4070 Ti handles smaller dense models.

Networking

I have a 3 Gbps symmetric fiber connection going into a 10 GbE SFP+ port on the Dream Machine Pro. The main access point also connects over 10 GbE SFP+.

IoT and smart home devices live on their own VLAN and WiFi network. They can't reach the main LAN. The only exception is a firewall rule that lets Home Assistant poll devices; everything else can only reach the internet.

The Synology NAS and Home Assistant both run Tailscale as subnet routers. I can reach internal services and control the house remotely without opening extra ports on the firewall. It works well enough that I mostly forget it's there, which is exactly what I want.

Ports 80 and 443 forward into the k3s cluster. Traefik handles ingress, and cert-manager gets the Let's Encrypt certificates.