homelab, infrastructure, in public

The second Cloudflare cutover. A freshly registered domain, apex and www on Pages, service subdomains on a VPS behind Caddy, and email locked shut on a domain that sends none.

chrisalorenzo.com was a GitHub Pages project site with DNS parked at the registrar. This is the migration to Cloudflare Pages, DNS and all, plus the parts that bit me.

Deploying Caddy for status.stayz3ro.dev should have taken an hour. It took a night, because every DNS record I added went to a zone nothing on the internet was reading anymore.

A fresh Netcup VPS: non-root access, key-only SSH with a safe reload workflow, UFW, Fail2Ban, then moving SSH off the public internet once a domain pointed at it.

Moving routing and DHCP off a Deco mesh onto a TP-Link ER605 and a managed switch, with the Deco dropped to AP mode, while HA DNS and the Proxmox services stayed up.

The homelab services started on a gaming PC. This phase moved them onto a Proxmox host: an Omada Controller LXC, a Docker monitoring VM, a self-hosted RustDesk server, and validated backups.

Adding Tailscale to the homelab for private administration, plus a subnet router so the whole LAN is reachable, with no public SSH anywhere.

Adding Prometheus, Grafana, Blackbox and Node Exporter, and Alertmanager to the HA DNS setup, and testing the alerts by breaking things on purpose.

Two Raspberry Pi nodes running Pi-hole and Unbound, a Keepalived virtual IP, and monitoring that watches the client path. The build and the failover tests.

The first real change to the homelab: a single Pi-hole node in the DNS path for filtering and query visibility, and why DNS is a good place to start.

The baseline before any of the homelab work: understanding the ISP gateway, the router, and the DNS path, then the Xfinity to AT&T Fiber migration and the bridge-mode versus IP-passthrough difference.