Proxmox VE Homelab: Zero-Trust Private Cloud
A 3-node Proxmox VE HA cluster with Ceph storage, VLAN segmentation, and zero-trust external access via Cloudflare Tunnel with Tailscale mesh fallback.
Overview
This private cloud runs every self-hosted service behind zero public ingress. A 3-node Proxmox VE 8.1 cluster provides high availability over Ceph; the network is segmented into four VLANs by trust level; and the only path in from the internet is a Cloudflare Tunnel gated by Access policies, with Tailscale as an authenticated mesh fallback. The design eliminated 100% of public IP exposure while keeping global tunnel latency under 50ms.
Network Topology
flowchart TB
Internet((Internet)) --> CF[Cloudflare Edge
Access policies] CF -->|cloudflared tunnel| DMZ[VLAN 40 DMZ] TS[Tailscale Mesh] -.fallback.-> MGMT subgraph Cluster["Proxmox VE HA Cluster - Ceph"] MGMT[VLAN 10 Mgmt] PROD[VLAN 20 Prod] IOT[VLAN 30 IoT] DMZ end PROD --- LXC[Docker LXC services]
Access policies] CF -->|cloudflared tunnel| DMZ[VLAN 40 DMZ] TS[Tailscale Mesh] -.fallback.-> MGMT subgraph Cluster["Proxmox VE HA Cluster - Ceph"] MGMT[VLAN 10 Mgmt] PROD[VLAN 20 Prod] IOT[VLAN 30 IoT] DMZ end PROD --- LXC[Docker LXC services]
Zero-Trust Access Flow
flowchart LR
R[Request] --> I[Identity
Cloudflare Access] I --> D[Device Posture
WARP check] D --> P{Policy} P -->|allow| Res[Service] P -->|deny| Block[403]
Cloudflare Access] I --> D[Device Posture
WARP check] D --> P{Policy} P -->|allow| Res[Service] P -->|deny| Block[403]
Implementation
1
Form the HA cluster
pvecm create tyf-cluster && pvecm add 192.168.10.112
Expose a service via Cloudflare Tunnel (no open ports)
cloudflared tunnel route dns tyf-tunnel cloud.tyfsadik.org3
Automate ZFS snapshots with sanoid
sanoid --configdir=/etc/sanoid --cron # hourly/daily/30-day retentionrpool/data@autosnap_2026-06-17_00:00:00_daily ... 30 kept
took 12 snapshots, pruned 3Key Results
- Eliminated 100% of public IP exposure by routing all ingress through Cloudflare Tunnel.
- Achieved under 50ms tunnel latency for global access via Cloudflare's edge.
- Automated 24-hour ZFS snapshots with a 30-day retention policy via sanoid/syncoid.
- Maintained service continuity through Proxmox HA failover across 3 nodes.