Home lab and home automation

Not a NAS and a Raspberry Pi. A two-node Hyper-V cluster on Windows Server 2025, a redundant Active Directory forest built from scratch, a non-routed 10GbE storage network with an iSCSI SAN behind it, a real 3-2-1 backup program, an internet-blocked camera network, a separate Microsoft 365 E5 tenant for non-production work, and a Home Assistant install running the whole house.

The honest framing: it is a lab, not production. That is the point. It is where patterns get built and broken before they get used professionally, and it is the one environment where I own every layer and can talk about the details freely. Every architectural pattern I use at work exists here in miniature, built from nothing rather than inherited.

Virtualization and compute

Two Dell Precision 7820 towers, both running Windows Server 2025 Datacenter as Hyper-V hosts: 44 and 40 logical processors across dual Xeons, 64 GB of DDR4 ECC each, NVMe for the OS and VM storage, with VM disks attached over iSCSI from the NAS.

Each host is dual-homed by design. One interface carries management and VM traffic on the main LAN; a second sits on the non-routed storage network for iSCSI, backup streams, and VM migration. Roles are split across separate VMs rather than piled onto one box, which is the whole exercise: it forces the same separation-of-roles discipline that real environments need, and it means a failure has a blast radius worth reasoning about.

Identity from first principles

• Two domain controllers running AD DS and DNS, one holding the PDC emulator FSMO role and the other providing redundancy, so identity and name resolution survive losing either host.
• Dozens of domain-joined computers and security groups, with Group Policy managing baseline configuration and update behavior.
• Dedicated service accounts with scoped rights for the database, backup, and NVR roles, rather than a shared administrator credential.
• Cisco Duo as the MFA layer in front of RDP, built here as well as in both professional environments.

A separate Microsoft 365 E5 tenant

A grandfathered E5 Developer tenant on its own domain, run as a genuine non-production environment: somewhere to break Conditional Access policies before they touch anyone real. Licensed and actually exercised here are Entra ID P2 (Conditional Access, Identity Protection), Intune with both Windows and macOS devices enrolled, the Defender suite (Endpoint P2, Identity, Office 365 P2, Cloud Apps), Azure Information Protection P2, and the Exchange, SharePoint, Teams, and Power BI workloads.

Worth stating the limit honestly: the Developer program does not include Azure compute or storage, so the Azure IaaS side of my experience is professional rather than lab.

Network architecture

Gigabit fiber into a Firewalla Gold SE handling routing, IDS/IPS, WireGuard, and network-wide DNS filtering. Behind it, a three-switch Aruba topology joined by SFP fiber: a 24-port core in the server closet, fiber up to a PoE distribution switch in the media closet, and fiber again to a smaller PoE switch, with two Cat6 runs to every room, all self-pulled and self-terminated, plus two PoE access points.

The main LAN is deliberately a single flat network with purpose-based address ranges for core infrastructure, storage, virtual servers, the NVR, automation, workstations, and wireless clients. That is an addressing convention rather than enforced segmentation, and VLANs on the main LAN are still on the list rather than done. Two networks are genuinely separate:

• A non-routed 10GbE storage backend carrying iSCSI, backup streams, and VM migration between the NAS, both hosts, and the backup and automation VMs. Non-routed means storage traffic cannot be reached from the client LAN at all, and it keeps bulk transfer off the network people actually use.
• An internet-blocked camera network. The cameras have no route out. The recording host is deliberately dual-homed, with interfaces on both the camera network and the LAN, and it does not forward internet access to them. That isolation is the compensating control for cheap ONVIF firmware, and it is the same reasoning I apply professionally to any untrusted device class.

Storage

A Synology DS1819+ as the storage core: a 65 TB RAID 6 Btrfs volume across eight SATA disks with a read/write SSD cache, and four network interfaces spanning the main LAN, an aggregation link, the camera network, and the 10GbE storage backend. It serves iSCSI to the Hyper-V hosts, SMB for general data and media, and the backup repository.

Backup and disaster recovery

An actual 3-2-1 program rather than a scheduled file copy: three copies (production, local on the NAS, offsite in Backblaze B2), two media types, one offsite.

Veeam Backup and Replication runs on a dedicated VM over the 10GbE storage network, with deduplication on the repository host, compression, daily incrementals against weekly fulls, application-aware processing, and VSS snapshots. Domain controllers are backed up including System State, so the AD database, SYSVOL, and DNS are actually recoverable rather than nominally covered. Synology Active Backup handles the layer Veeam does not: agent-based server backups plus Microsoft 365 and Google Workspace data.

Documented recovery procedures cover bare-metal restore, instant VM recovery, authoritative AD restore, and four disaster scenarios with RTO and RPO targets against each. Backup and recoverability is the part most home labs skip entirely, which is exactly why it is worth building.

Remote access

A split-role Remote Desktop Services deployment, the same shape as the multi-site RDS platform I run professionally: RD Gateway and Web Access on a separate hardened VM so RDP is encapsulated in HTTPS rather than reachable directly, with Session Host, Connection Broker, and Licensing on a dedicated session host. NPS and RADIUS handle authentication policy, Duo provides MFA, and WireGuard on the firewall covers full-tunnel access.

The bare-metal video host

Deliberately not a VM. It is a physical workstation because it does several GPU-bound jobs at once and bridges two networks, and neither of those belongs on a shared hypervisor. A custom build with an i7-8700K, 32 GB, and an RTX 3060 Ti, storage tiered by purpose: NVMe boot, an SSD for general data, and a dedicated 2.72 TB RAID volume carved out solely for camera recordings, so video retention can never starve the OS or anything else on the box.

The GPU is shared in a deliberate priority order: Milestone XProtect, a commercial video management system, records eight ONVIF cameras and gets first call, with hardware-accelerated transcoding workloads behind it. The host also runs the monitoring probes, so the box doing the most I/O is the one reporting on the network. The interesting engineering question is the resource contention: several GPU consumers, a RAID volume under constant write from eight camera streams, and a monitoring workload on one host, with an explicit priority order and storage isolation between them.

Monitoring and patching

PRTG probes, InfluxDB time-series collection via agents on the Windows servers, and Grafana dashboards: the same three-layer stack I built professionally. Synology Active Insight watches NAS health, and Home Assistant acts as the central alerting surface, so infrastructure alerts arrive on the same channels as everything else in the house. Patching runs through Action1 and WSUS on Windows and unattended-upgrades on the Linux hosts.

Home Assistant at scale

Home Assistant OS on a dedicated Dell Optiplex Micro, running hundreds of devices and thousands of entities driven by a deep library of automations and scripts: adaptive motion lighting, alarm and intrusion logic, climate and blind control, presence-based arrival and departure routines, irrigation, and multi-channel notification.

It spans four radio protocols (Zigbee, Z-Wave, MQTT, and Bluetooth) and dozens of integrations, with Grafana, InfluxDB, Z-Wave JS UI, Zigbee2MQTT, and Music Assistant running as add-ons. The device population skews heavily to switches and media players, with the lights and camera feeds on top. It is the same problem shape as enterprise automation, integration breadth, reliability, and clean state management, in a lower-stakes environment I fully control.

An arm64 container host

A Mac mini (M1) running Docker Desktop, doing two jobs. It is the production host for Subreddit Sounds, which is what makes the "in production" claim on that project literally true: it runs there continuously on a schedule. It is also the general container development box.

Worth calling out because it adds an arm64 host to a lab that is otherwise x86 Windows and Linux, which is why that project's release pipeline builds multi-architecture images via QEMU and Buildx rather than amd64 only. It also means macOS shows up here as a server rather than only as a client endpoint.

A migration, with a decommission

A Linux container host ran five WordPress sites behind a Traefik reverse proxy with Portainer and MySQL. In March 2026 all five were rebuilt in Astro, moved to Cloudflare Pages, and the container host was shut down, along with a static site that had been running on IIS. Worth keeping on the record as a completed platform migration that ended in a decommission rather than another running box, which is the harder half. Matt's Volleyball was one of them.

A Linux VM still runs ITFlow as the lab's own documentation and ticketing system, on Apache and MariaDB with scheduled certbot renewal and log rotation: the small-scale analogue of the ITSM work I do professionally.

Documented as code

The whole environment lives in a private documentation repo with PowerShell report generators that produce consistent per-machine inventory, plus scripted exports of the Home Assistant device, entity, integration, and add-on registries to JSON. Regenerable rather than hand-maintained, and versioned like everything else. Same approach as the documentation library I built at work.

Maker shop

The bits-and-atoms half: a two-car garage plus an 8x16 shed, a Bambu Lab P1S, an Ortur laser, Milwaukee cordless platforms, and stationary woodworking equipment, with design in Fusion 360 and SketchUp. Builds have run from enclosures and mounts up to an outdoor sauna, a walnut smart mirror with embedded electronics, epoxy lamps, and a multi-level composite deck. More of that on the maker page.

What this demonstrates

• Windows Server and virtualization depth A two-node Hyper-V cluster with iSCSI-attached shared storage and a dedicated migration network is a datacenter pattern, not a home one.
• Identity from first principles A redundant AD forest with Group Policy and scoped service accounts, plus a separate Entra ID P2 tenant, all built rather than inherited.
• Backup and recoverability A documented 3-2-1 program with application-aware processing, System State coverage for the domain controllers, and written recovery procedures with RTO and RPO targets.
• Network design Purpose-based addressing, a non-routed 10GbE storage fabric, and an internet-blocked camera segment reachable only through deliberately dual-homed hosts.
• A safe place to prove Microsoft 365 and Intune depth The separate E5 tenant means Conditional Access, Intune, and Defender can be discussed concretely without touching an employer's tenant.
• Automation at genuine scale Thousands of entities and dozens of automations across four protocols, which is a state-management problem long before it is a smart-home one.
• Documentation discipline Scripted, regenerable, and versioned, because a lab nobody documented is just clutter with a login.