Building out my homelab

For years, the start and end of my homelab equipment list was a 2012 Mac mini sitting in the corner of my bedroom. I had given it a new SSD and new RAM at some point, and it ticked away for years running Home Assistant for my three generic smart bulbs. Things changed, however, when the new place I moved was fully wired for ethernet and had gigabit fiber. This was thrilling enough on its own, but to top it off all the cables led to a central closet where the ONT signal came in - I had simply no other choice but to start buying server hardware.

Unfortunately, I had this surge of motivation around the start of 2026, which might have been the worst time in history to start buying computer parts. The RAM crisis nixed my dreams of building a big fancy NAS pretty much immediately, so I had to pare down my expectations a lot - I needed to do this on a budget, buying mostly used hardware and reusing what I had.

In addition to my frugal mindset, I had a few other goals:

Hypervisor

Proxmox was the obvious choice for a hypervisor, which can run pretty much anywhere Debian can. For both of these machines, I figured used small form-factor office PCs would be perfect, and a good way to get decently spec’d machines in a very inflated market.

After some time searching, I managed to find a Dell Optiplex 5070 Micro with an i5-9500T and a whopping 32GB of RAM for only $230. You’d think that spending that much on a used computer with an eight year old CPU and DDR4 RAM was a bad deal, and you’d be entirely correct, but there were dozens of similar models with less RAM and older hardware selling for about the same price. Besides, at that point it was getting pretty hard to find 32GB of DDR4 for just about any price. The more I shopped, the less sense it all made. I chose not to look this gift horse in the mouth and made the purchase.

This machine turned out to be perfect - it’s powerful enough to run plenty of essential homelab services with room for tinkering left over. I have a few VMs going now, mostly Docker container hosts for a popular application stack (guess which one), some personal web services, and a Home Assistant OS instance. I can also run any VMs needed for my coursework, and spin up a couple for learning Kubernetes, which I’m trying (struggling) to do lately.

I repurposed my old Mac mini as a Proxmox Backup Server. Using an adapter I added a second 2TB SSD and installed PBS on the two drives as a ZFS mirror. This works perfectly fine, and gives me more confidence to store some more important data in my homelab. I do wish I had just installed a NAS distro such as TrueNAS and ran PBS in a VM, so that I could also back up other devices. I’ll probably do that eventually, but I think I’ll want to have at least 4TB of usable storage space if I’m going to use the server as a backup target. That promises to be prohibitively expensive for the foreseeable future, so it stays for now.

Networking

Once I had the hypervisor running, it was time to upgrade the network that supported it. I knew that I wanted to try OPNSense to get some experience with an actual firewall, and that I wanted to segment my network into a few VLANs, including the WiFi.

Hardware

For my router, I went with a Dell Wyse 5070 thin client. I found a good deal on one with a 4-port Intel NIC preinstalled for about $140 shipped. I swapped out the tiny included drive for a 128GB drive I had lying around and installed OPNSense.

To accomplish my VLAN goals, I would need the rest of my network hardware to be VLAN-aware, which meant I needed managed switches and more sophisticated APs. The switches were pretty straightforward - I had no aspiration (or budget) to go for 2.5G or 10G anything, so I found two Netgear managed switches for around $20 each. The APs were a tougher task, as I needed them to not only be VLAN aware, but also to support some way of segmenting the wireless network on a per-client basis. These sorts of features don’t exist on consumer hardware, they’re mostly found on professional grade devices with professional grade price tags.

The most reasonable option I could find was to put OpenWrt on a reasonably spec’d consumer router and use it as a bridged AP. I’ve used OpenWrt in the past, and I find it to be extremely stable and reliable - plus it has all the features I need for this use case. After trawling some forum threads for a while, I settled on two Cudy WR3000 units. I chose them because they’re inexpensive, support Wifi 6 (plenty fast for my wireless clients, anything that needs real speed is wired in anyway) and are known to work well with OpenWrt.

I also grabbed a few other 5 port switches, some managed and some unmanaged, for expanding ethernet access in various rooms.

Setup

The ethernet from my ONT and the various rooms all terminate in the same closet, so that was the natural place to put my router and main switch. The closet is not centrally located, though, so I put one AP in there and one in my room, which is on the other end of the house.

I created 5 VLANs:

10 - MGMT - router, network switch, hypervisor GUIs
20 - GUEST
30 - IOT - smart devices and consoles
40 - TRUSTED - computers and phones of the residents
50 - SERVERS - virtual machines

A few things are multi-homed, such as my Home Assistant VM, to reduce inter-VLAN traffic. I have a UDP broadcast relay running on OPNSense for specific services, mostly to allow mDNS and wake-on-LAN between a few clients on the IOT and TRUSTED VLANs.

I wound up putting my new hypervisor and backup server in my room with the AP, with a managed switch daisy-chained to the main switch in the closet. This isn’t ideal, since it technically limits throughput to the router, but I haven’t encountered any performance issues that would lead me to make any changes. These tiny PCs have the benefit of being quiet, which is great for keeping in the corner of a bedroom. I set up my very old (loud) gaming PC in the closet instead, and configured it as a Moonlight server, which has been running flawlessly so far.

For my wireless network, I wanted a solution that would allow clients to be divided into different VLANs while staying mostly out of the way. WPA Enterprise felt like overkill, and not everyone in my home is tech-savvy so I don’t want to add too much confusion. I also really didn’t want to manually maintain a list of MAC addresses of trusted devices.

The method I went with uses a rather under-documented but neat feature of OpenWRT that allows multiple PSKs. I configured three different PSKs - two new ones for the TRUSTED and IOT VLANs, while repurposing the old one for the GUEST VLAN so that any frequent house guests wouldn’t need to reconnect. This isn’t inherently more secure, but the old PSK was pretty weak so as to be memorable, and the new ones were generated with pwgen so they’re much stronger. Keeping a single SSID reduces clutter and confusion for people who just want to get on the WiFi.

More smart home stuff

My new place came with Mitsubishi mini-split HVAC units, which are controlled using boring remotes. I ameliorated this by flashing some ESP32 modules with a nifty piece of firmware called mitsubishi2MQTT, which bridges the widely supported MQTT protocol with the unit’s proprietary serial protocol. It’s definitely janky, and involved some poking around on the expensive AC unit (that I don’t own) with a multimeter, but I didn’t need to solder anything to the AC unit itself, and once it’s running it’s pretty much invisible. I can now control, automate and script all the ACs in my house to my heart’s content, and I can revert them back to stock in just a few minutes if I need to.

Migration

I’m glad I decided to block out a whole day for this - specifically one where I was the only one home. I locked myself out of the network multiple times, and configuring the multi-PSK wireless setup took way more work than I thought it would, due to the lack of documentation. Trial by fire is the best way to learn, I guess!

I’m happy with how everything is working now, though. Once I got things working for everyone, it’s been smooth going for the most part, and I now have a mini homelab that’s secure and ready for whatever projects I want to throw at it.