Physical Infrastructure for a Budget Home Security Stack

This project has a relatively small budget. I can afford a bit more hardware on top of what I have, but there are limitations in (1) current hardware, (2) what can be purchased to add in to the mix, and (3) the network throughput between nodes. Everything is limited to 1GbE network throughput due to the current router and switches I have in use. Uprgading it would be a total overhaul of my rack. While it’s something I hope for in the future, it’s not in the cards right now.

Hardware Currently in Use

• 1 GbE x86 hardware running OPNsense as the layer 3 router/firewall
• 8 port 1 GbE POE managed switch
• 5 port 1 GbE unmanaged switch
• Wireless Access Point
• Frankenstein NAS from a maxed out old Dell Optiplex 780

Extra (Useful) Hardware I Have Lying Around

• Old gaming laptop
  • Predator Triton 500
  • 1 TB NVMe
  • 32 GB DDR4
  • 10th Gen Intel Core i7
  • NVIDIA GeForce RTX 2080 Super
  • An embarrassing amount of stickers
• Extra drives
  • 2 * 1 TB NVMe
  • Several 1 TB 2.5” HDDs

Recently Acquired Hardware

• Proxmox Nodes
  • 4 * Lenovo ThinkCentre M710q Mini PCs
    • 256 GB NVMe
    • 16 GB DDR4
    • 7th Gen Intel Core i5-7500T
• 8 port, 1 GbE managed switch
• 24 port patch panel (to replace 12-port patch panel)

Proposed Physical Infrastructure

The main idea here is to set myself up for future projects with the hardware I’ve already set up. Right away, my first thought is that the gaming laptop will be handy once I get to a stage where I want to automate some of the analytics. The GPU will serve nicely to speed up some calculations and I can always keep it in my back pocket to run a simple ML model to flag suspicious behavior. The mini PCs should work well to handle much of the other tasks like log storage, replication, net-flow collection, and hosting the dashboard.

The plan is to eventually set the proxmox cluster up as a quorum for fault tolerance with live migration using Proxmox’s Ceph, but I’m limited by my disk space and network throughput right now. With the currently proposed architecture, I still get some fault tolerance with replication and can always make the upgrades to add in Ceph at a later time. I’ve also considered running the entire cluster off shared storage to enable live migration, but that introduces a single point of failure, so I would need some sort of redundancy on the NAS as well. With the costs of silicon in 2026 (sigh), it may be some time before those upgrades are realistic.