graph TB
subgraph Internet
ISP[Ziggο ISP]
end
subgraph Network["Netwerk — UniFi UDR"]
UDR[UniFi Dream Router]
AP1[AP Gang]
AP2[AP Keuken]
AP3[AP Zolder]
AGW[AdGuard VIP :53<br/>192.168.10.5]
end
subgraph MGMT["VLAN 10 — Management"]
PVE1[pve-01<br/>Intel NUC]
PVE2[pve-02<br/>GMKtec #1]
PVE3[pve-03<br/>GMKtec #2]
AG1[adguard-01<br/>master]
AG2[adguard-02<br/>backup]
end
subgraph SRV["VLAN 20 — Servers"]
HA[Home Assistant]
FRI[Frigate]
PLEX[Plex]
JF[Jellyfin]
NC[Nextcloud]
PORT[Portainer]
FF[Firefly]
TN[TrueNAS NFS]
SYN[Synology PBS]
end
subgraph IOT["VLAN 30 — IoT"]
CAM1[Camera Garage]
CAM2[Camera Voordeur]
THERM[Thermostaten]
VAC[Roborock]
SONOS[Sonos x3]
end
subgraph TRUSTED["VLAN 40 — Trusted"]
LAPTOP[Laptops]
PHONE[Telefoons]
end
ISP --> UDR
UDR --> AGW
AGW --> AG1
AGW --> AG2
PVE1 --> HA
PVE1 --> FRI
PVE2 --> PLEX
PVE2 --> JF
PVE2 --> NC
PVE3 --> PORT
PVE3 --> FF
FRI --> CAM1
FRI --> CAM2
HA --> THERM
HA --> VAC
PLEX --> TN
JF --> TN
TN -->|wekelijks| SYN
| Laag |
Tool |
Doel |
| VM provisioning |
OpenTofu + Proxmox provider |
Nieuwe VMs als code aanmaken |
| Configuratie |
Ansible |
Software installatie en configuratie |
| Containers |
Docker Compose |
Service deployment per VM |
| Secrets |
SOPS + age |
Versleuteld in Git |
| Monitoring |
Prometheus + Grafana + Loki |
Metrics, alerts, logs |
| Backup |
Proxmox Backup Server |
Dagelijkse VM snapshots |
| Remote access |
Tailscale |
Zero-trust VPN, geen open poorten |
Alleen voor services waarbij uitval direct merkbaar is:
| Service |
Aanpak |
Doel |
| AdGuard DNS |
2x VM + Keepalived VRRP |
< 5s failover |
| Home Assistant |
Snel restore via PBS |
< 5 min RTO |
| Overige |
Single VM + dagelijkse backup |
Best effort |
Zie docs/decisions/ voor Architecture Decision Records (ADRs).