net-1 is a small rack-mount computer dedicated to network services. It runs Proxmox VE, and each service has its own VM. It is not part of the ranch Proxmox cluster or the Kubernetes cluster. Those two depend on it instead: the rachelski.internal DNS zone and the only path in from the internet both live here.
Treat it as the most critical box in the house. A mistake on this host can take down DNS, the router and every public service at once.
| Hostname | net-1.rachelski.internal |
| IP address | 192.168.200.205 (management bridge) |
| Web console | https://192.168.200.205:8006 |
| Configuration | the net-1 repo in Gitea (mark/net-1) |
| Part | Detail |
|---|---|
| Make | Unbranded. Probably sold by Topton (it arrived in plain packaging, so this isn't certain). |
| CPU | Intel Atom C3808, 12 cores at 2.0 GHz. It has no AVX, which limits some software (see Known limits). |
| Memory | 16 GB |
| Disk | One 256 GB NVMe drive, set up as a single-disk ZFS pool (rpool, "ZFS RAID 0" in the installer). ZFS is used for its snapshots; there is no disk redundancy. |
| Network | Five 2.5 GbE ports and four 10 GbE ports. Which physical port does what is on Condo Network Design. |
| OS | Proxmox VE 8.4 |
All four VMs start automatically when the host boots, and all run the QEMU guest agent (on OPNsense the plugin still has to be installed inside the VM).
| VM ID | Name | IP address | CPU / memory | What it does | Repo folder |
|---|---|---|---|---|---|
| 100 | opnsense |
192.168.200.101 on the homelab side |
4 / 6 GB | OPNsense firewall and router. It is meant to become the front door of the homelab and, at the villa, of the whole network. It isn't in that position yet: moving it into place needs network hardware that hasn't been bought. | none yet |
| 101 | omada-host |
192.168.200.206 |
2 / 3 GB | TP-Link Omada controller, which configures the Omada switches and access points. Management UI at https://192.168.200.206:8043. |
omada/ |
| 102 | dns-host (dns-1) |
192.168.200.153 |
1 / 1 GB | The primary Technitium DNS server, including the rachelski.internal zone. Web console at http://192.168.200.153:5380. The second DNS server, dns-2 (192.168.200.53), runs on ranch-2. |
technitium/ |
| 103 | caddy-host |
192.168.200.207 |
1 / 1 GB | Caddy reverse proxy: the only service that receives traffic from the internet (ports 80 and 443). It also runs ddns-updater, which keeps the public rachelski.net records pointed at the household's address. |
caddy/ |
The VMs other than OPNsense are Debian with Docker. Each service runs from a Docker Compose project under /srv/docker-volumes/ on its VM, and its folder in the net-1 repo holds the compose file, configuration and deploy steps. More about each service:
Proxmox connects the VMs to the physical ports through four bridges:
| Bridge | Physical port | Label | Used by |
|---|---|---|---|
vmbr0 |
enp8s0 (2.5 GbE) |
mgmt | The host itself (192.168.200.205) and all four VMs. This is the household 192.168.200.x network. |
vmbr1 |
eno1 (10 GbE) |
VLAN | OPNsense only: the VLAN trunk to the TP-Link homelab switch |
vmbr2 |
enp4s0 (2.5 GbE) |
WAN | OPNsense only |
vmbr3 |
enp5s0 (2.5 GbE) |
LAB | OPNsense only |
The VLAN numbers and their purposes are on Condo Network Design.
https://192.168.200.205:8006 or ssh root@192.168.200.205, using the shared network-equipment password. See Setting up a new administrator for where that password is kept.ssh mark@<VM IP address>.claude@pve!investigate, can read everything on the host but change nothing. Claude Code and other tools use it to inspect the host without root. Setting it up on a workstation, and a list of useful endpoints, are in proxmox/README.md in the net-1 repo.The net-1 repo in Gitea tracks the host and its VMs. Each top-level folder is one target (proxmox/, caddy/, omada/, technitium/) and has its own README with the deploy steps. The root README.md is the original install log: the Proxmox install settings, the Debian cloud-init VM template, setting up the QEMU guest agent, and building each VM. Rebuild from there.
adguard/ is left over from the DNS server used before Technitium and is no longer used.
Proxmox backs up all four VMs every night at 21:00 (snapshot mode) to Proxmox Backup Server, which runs on ranch-2 and keeps its backups in the NAS's ranch-backup shared folder (see Backups). The NAS's net-backup folder held net-1's backups before Proxmox Backup Server took over; nothing has been written to it since 2025-08-12. The QEMU guest agent pauses the VM's file systems while the snapshot is taken, so the backups are consistent. This matters for the Omada controller's database.
Before a risky change to the Omada controller, also export its own backup (Settings → Maintenance → Backup in its UI). It restores faster than rolling back the whole VM.
root with the shared password, and no per-person Proxmox users.dns-1 and dns-2 are not yet set up to sync their zones with each other.