All physical machines sit behind OPNsense on a home LAN. Internet traffic leaving the homelab goes exclusively through a WireGuard VPN on the main server — nothing else has a direct outbound internet path.
Tailscale connects the remote nodes — a monitoring Pi and two cloud workers — back to the homelab without any firewall rules or VPN tunnels to configure. Every machine joins the same tailnet, reachable from anywhere as one flat private network.
A lightweight Kubernetes cluster spanning the homelab and cloud. The main server acts as control plane; two free-tier ARM workers provide enough capacity to run this site, several web apps, and supporting services.