A home lab usually grows from one box into a small fleet — and the trick is giving each node a clear job rather than piling everything onto one machine. Here is a clean, generic layout you can adapt.
Common node roles
| Role | Runs |
|---|---|
| Web / edge node | Reverse proxy + public sites, fronted by a tunnel |
| LLM inference host | A local model server (e.g. Ollama) |
| GPU box | Heavy training / media / diffusion jobs |
| Edge device | A small board (e.g. SBC) for IoT or sensors |
| Storage / DB node | Databases and backups |
| Windows host | The one Windows box for apps that need it |
The patterns that hold it together
- A mesh VPN (e.g. Tailscale) so every node is reachable by name with no public SSH (SSH Hardening).
- A single edge tunnel so only public surfaces are exposed; origins stay on
localhost(Hosting Many Sites Behind One Cloudflare Tunnel). - One DB user per app, secrets kept out of web roots (Secrets Management).
- Documentation — a wiki like this one so future-you knows what runs where.
Principle: small nodes with single responsibilities are easier to secure, back up, and replace than one do-everything server.
Related: Tailscale Network Topology · Building a Custom Wiki Engine · Hosting Many Sites Behind One Cloudflare Tunnel