GNTECH Infrastructure Deployment Series

Building a Secure Hybrid Homelab from Scratch

This is the reading hub for a planned twelve-part deployment series covering Hetzner and home Proxmox, MikroTik routing, Microsoft identity, Cloudflare Zero Trust, container hosting, backups, and observability.

The sequence is a publication plan, not a claim that every component has been deployed or tested. All public-facing tutorials will use sanitized example addresses and credentials, identify prerequisites, and distinguish a reproducible example from a live-verified configuration.

Publication roadmap

Part Topic Status Read now
01 Architecture and design: trust boundaries, network plan, inventory Existing article Part 01 — Architecture and Design
02 Hetzner Proxmox foundation: installation, ZFS, management, recovery Published Part 02 — Hetzner Proxmox Foundation
03 Two MikroTik CHR routers: isolated transit bridges and routed IPs Published Part 03 — Dual MikroTik CHR
04 Proxmox firewall: forwarding, SNAT, IPv6, isolation Published Part 04 — Proxmox Firewall and Network Isolation
05 Home-to-Hetzner connectivity: WireGuard, scoped routes, recovery Published Part 05 — Home-to-Hetzner Connectivity
06 Active Directory and DNS: forest, domain controllers, client discovery Published Part 06 — Active Directory and DNS
07 Hybrid identity: Entra ID, synchronization, SSO, MFA Published Part 07 — Hybrid Identity and Entra ID
08 Cloudflare Zero Trust: tunnels and authenticated administration Published Part 08 — Cloudflare Zero Trust
09 Container platform: private HTTPS ingress and application persistence Published Part 09 — Docker Compose and Traefik
10 Backup and disaster recovery: off-site PBS restore drill Published Part 10 — Backup and Disaster Recovery
11 Monitoring: backup evidence freshness and missing-data alerts Published Part 11 — Monitoring and Observability
12 End-to-end security validation and operational handoff Article ready for review Part 12 — Security Validation and Operations

Status key: Planned means the dedicated series installment is not yet written. A linked existing article is supporting reading, not a completed series part. Part 03 reuses the established URL of the original standalone tutorial; series metadata and safeguards are proposed for review.

Supporting reading by workstream

Network and virtualization

Remote administration and security

Containers, backup, and observability

How the series will be published

Each future part should provide a scope and architecture diagram, prerequisites, version assumptions, copy/paste-ready commands with placeholders, a validation checklist, security notes, troubleshooting, rollback, and links to preceding and following parts. Never publish real public IP addresses, API tokens, domain secrets, internal credentials, or unique private identifiers.

Publication order should follow dependencies, but the index can be updated independently. Existing standalone articles remain at their current URLs to avoid breaking links; cross-link or add series metadata only after editorial review.

Next planned deliverable: Cross-series editorial and validation audit after Part 12 review.