FSJ-LAB
FSJ-LAB is my home lab: a fully air-gapped, two-node Proxmox VE cluster running ten role-based Linux VMs across segmented VLANs, behind a FortiGate firewall and a Cisco Catalyst switching core.
I built it for three reasons:
- Hands-on CCNA practice on real hardware, not just simulators.
- Learning to run infrastructure the way enterprises do: monitoring, centralized logging, config backup, least-privilege access, and change discipline.
- Running AI locally, on my own GPU, with my own data, and nothing leaving the building.
The defining constraint: no internet
Nothing in the lab can reach the internet. Not the VMs, not the hypervisors, not the NAS or network gear.
That one rule shapes everything. Every package, Docker image, and binary is staged on a separate internet-connected workstation and moved in deliberately. It’s slower, but it forces me to understand exactly what each system depends on, and it’s how a lot of regulated and high-security environments actually operate.
At a glance
| Layer | What runs there |
|---|---|
| Compute | Two-node Proxmox VE 9 cluster (Dell OptiPlex 7060 Micro and Precision T5820) with a QDevice for a third quorum vote |
| Network | Catalyst 3560 (L3 core) and 2960S (access), FortiGate firewall, UniFi wireless |
| Core services | DNS (BIND), DHCP, NTP, an internal APT mirror |
| Observability | LibreNMS (metrics/alerting), Graylog 7 (logs), Oxidized (config backup) |
| Backup | Bacula (files), RANCID + Git (network configs), weekly vzdump VM snapshots to a Synology NAS |
| Automation & data | n8n workflows, Supabase with pgvector |
| AI | Ollama + Open WebUI on a passed-through RTX 3070, with a RAG “lab assistant” |
Network layout
Every service lives on its own VLAN, with routing at the core switch and untrusted networks terminated on the firewall.
| VLAN | Purpose |
|---|---|
| 10 | Management / core (locked down) |
| 20 | Infrastructure services |
| 30 | Compute and applications |
| 40 | Storage |
| 60 | Guest (terminates on the firewall) |
| 70 | IoT (terminates on the firewall) |
| 80 | Monitoring |
| 90 | CCNA practice lab |
| 100 | Firewall transit (OSPF) |
Topology
The diagram shows every device and VM by hostname, with VM IDs and VLANs. Switch to With planned builds to see what’s coming next.
ISP router
Home internet connection
Air gap: lab VLANs have no route to the internet
FS-FW
FortiGate 500D
Firewall, edge of the lab
- VLAN 60 Guest
- VLAN 70 IoT
FS-Core-1
Cisco Catalyst 3560
Layer 3 core: inter-VLAN routing, spanning-tree root
FS-SW1
Cisco Catalyst 2960S
Access switch, backup spanning-tree root
Connected to FS-SW1
Wireless
Managed by unifi-ctrl-1
- AP-FS-1UniFi access point
- AP-FS-2UniFi access point
Trunks from FS-SW1
fslab-cluster
Proxmox VE, two nodes plus a QDevice on FS-SYN for the third quorum vote
fslab
Dell OptiPlex 7060 Micro, Core i7-8700T
VLAN 20 Infrastructure
- 200infra-core-1DNS, DHCP, NTP
- 201infra-repo-1Backup and update repo
- 202infra-backup-1Bacula, RANCID
- 203infra-repo-0APT mirror
- 600unifi-ctrl-1UniFi Network Application
VLAN 30 Compute
- 300compute-n8n-1n8n workflows
- 301compute-supabase-1Supabase, pgvector
VLAN 80 Monitoring
- 800monitoring-core-1LibreNMS, Oxidized
- 801monitoring-core-2Graylog, OpenSearch, MongoDB
fslab-2
Dell Precision T5820, Xeon W-2135, RTX 3070
VLAN 30 Compute
- 302compute-apps-1Ollama, Open WebUI on the passed-through GPU
- newLab assistant agentRuns on compute-apps-1, fed by n8n
Planned VM
- newk3s-lab-1CPU-only Kubernetes practice
Planned VM, node to be decided
- newDashboard VMGrafana or similar, the lab's single pane of glass
Connected to FS-SW1
FS-SYN
Synology DS925+
- VLAN 40 Storage
- BackupsWeekly VM snapshots
- ISOsInstall media and snippets
- QDeviceThird cluster vote, in a container
- Shared VM storageNFS share for HA
- VLAN 20 Infrastructure
- VLAN 30 Compute
- VLAN 40 Storage
- VLAN 80 Monitoring
- VLAN 60 Guest
- VLAN 70 IoT
- Planned
Planned builds
- Proxmox high availability. The cluster and QDevice are done. Still to do: shared VM storage on FS-SYN, time sync across both nodes, VM prep, and a real failover test.
- k3s-lab-1. A CPU-only VM on fslab-2 for hands-on Kubernetes practice.
- Lab assistant agent. Turn the RAG assistant on compute-apps-1 into an agent: n8n keeps its knowledge current from Proxmox, LibreNMS, and network configs (with secrets scrubbed), and any action that changes the lab needs my approval first.
- Single pane of glass. n8n collects status from across the lab, Supabase stores the history, and a self-hosted dashboard such as Grafana shows it all on one screen.
Projects in this lab
Each build has its own write-up covering the goal, how it works, and what broke along the way.
- Two-Node Proxmox Cluster with a QDevice: clustering, quorum, and the road to high availability
- Segmented Network Core: VLANs, spanning tree, OSPF to the firewall, and switch hardening
- GPU Passthrough and a Local AI Stack: an RTX 3070 running private LLMs and a RAG lab assistant
- Observability: Metrics, Logs, and Config Backup: LibreNMS, Graylog, and Oxidized
- Layered Backup Strategy: Bacula, RANCID + Git, and VM snapshots to the NAS
- Air-Gapped Package and Image Pipeline: how software gets into a network with no internet
- Repairing a Hypervisor with Corrupted Core Libraries: a root-cause investigation
- Lab Automation with n8n: wiring the lab’s APIs together with least-privilege access
What’s next
The four main builds on the roadmap are shown in the planned view of the diagram above:
- Proxmox high availability: shared VM storage on FS-SYN, time sync across both nodes, VM prep, and a real failover test
- k3s-lab-1: a CPU-only Kubernetes VM on fslab-2
- Lab assistant agent: an n8n-fed knowledge base and approval-gated actions for the AI assistant
- Single pane of glass: n8n and Supabase feeding a self-hosted dashboard such as Grafana
Smaller items in the queue:
- APT mirror: finish the rebuild so VMs stop needing manual transfers
- Graylog dashboards: network, VM, and device views
- CCNA practice: EtherChannel, AAA, and SNMPv3
- GPU upgrade: RTX 3070 (8 GB) to RTX 3090 (24 GB) for larger models