lab.shadeh.dev ← shadeh.dev
● systems nominal --:--:-- AST

// infrastructure ops — Port of Spain, T&T

Production infra.
Self-managed.

Self-taught infrastructure engineer running a multi-node homelab stack across bare metal and cloud. Built from first principles — every service documented, every backup tested, every failure learned from.

9+ Services live
65GB Media under mgmt
3-2-1 Backup strategy
~06/21 Cluster ETA
🛠️
Infrastructure Engineer
5+ years · self-taught
Docker, Proxmox, Traefik, Cloudflare, Linux hardening, backup pipelines — built from first principles.
🔒
Google Cybersecurity Certificate
Google · Coursera
Threat detection, SIEM, incident response — applied daily across the homelab stack.
🎓
Google Project Management Certificate
Google · Coursera
Agile and Scrum methodologies applied to real infrastructure migrations and client projects.
🌍
MSP Practice — shadeh.dev
Caribbean SMB focus · active
Custom websites, domains, business email, and infrastructure for Caribbean small businesses.

Node Inventory

live
homelab
Primary compute — 2015 HP laptop
CPU AMD A6-5200 (4c)
RAM 4GB DDR3L
OS Debian 13 Trixie
Role Docker host, Traefik, Immich, HA
Network Tailscale + CF Tunnel
live
cloudlab
Cloud VPS — GCP e2-micro
CPU 2 vCPU shared
RAM 1GB
OS Debian 12
Role Vaultwarden, Actual Budget
Network GCP VPC + CF Tunnel + Tailscale
~06/21
optiplex
Box 1 — Dell OptiPlex 5070 SFF
CPU i5-9500 (6c/6t)
RAM 16GB DDR4
Storage 256GB SSD
Role Proxmox primary: Immich, Vaultwarden, Traefik, Postgres
~06/21
prodesk
Box 2 — HP ProDesk 600 G4 SFF
CPU i5-8500 (6c/6t)
RAM 8GB DDR4
Role HAOS VM, Zigbee, Frigate NVR
live
auxlab
Observability — GCP e2-micro
Role Monitoring, alerting
Stack Prometheus, Grafana, Uptime Kuma
Network Tailscale mesh
decom
newprod
Decommissioned 06/04/2026
Migrated Immich → homelab
Status VM, disks, IP — deleted

Service Registry

Service Host Endpoint Stack Status
Immich
Photo mgmt — 65GB, 5,072 assets
 homelab immich.shadeh.dev Docker · CF Tunnel · Traefik live
Home Assistant
Automation, Matter, Zigbee (pending)
 homelab ha.shadeh.dev Docker · host net · CF Tunnel live
Vaultwarden
Self-hosted Bitwarden-compatible
 cloudlab vault.shadeh.dev Docker · CF Tunnel · Restic→B2 live
Actual Budget
Local-first finance — data stays on node
 cloudlab budget.shadeh.dev Docker · CF Tunnel live
Traefik v3
Reverse proxy — label-based routing
 homelab + cloudlab internal Docker · CF DNS-01 · wildcard TLS live
Grafana + Prometheus
Node Exporter Full · dashboard 1860
 auxlab internal Docker · Tailscale mesh live
Uptime Kuma
Endpoint health monitoring
 auxlab internal Docker · Tailscale live
CrowdSec
Collaborative IPS + firewall bouncer
 homelab + cloudlab — Docker live
Restic → B2
Immich backup · 02:00 AST · Vaultwarden 00:00 UTC
 homelab + cloudlab Backblaze B2 systemd timer · Persistent=true partial
Frigate NVR
Object detection, camera feeds
 prodesk — Proxmox VM planned
Immich ML worker
CLIP / face recognition
 optiplex — Disabled — pending hardware pending hw

Network & Security

Tailscale mesh CF Tunnel CF Zero Trust DNS-01 wildcard TLS CGNAT bypass No open inbound ports
T&T CGNAT kills all inbound. Tailscale handles node-to-node mesh. Cloudflare Tunnel fronts all public services — zero firewall holes. GCP VPC is the real perimeter for cloudlab (UFW is cosmetic there; Docker bypasses iptables ordering).
⚠
Known issue: homelab dirty power recovery — Docker, Tailscale, SSH occasionally fail after unclean reboot. Fix pending: After=network-online.target on all three systemd units.

Backup Strategy

// IMMICH — 3-2-1 in progress
homelab local
→
Restic → B2
→
homelab target ⚠ pending
// VAULTWARDEN
cloudlab
→
Restic → B2
→
cloudlab→homelab pending
⚠
Pending: Telegram notifications not yet wired for Immich or Vaultwarden backups. Two empty Immich Restic snapshots need pruning. Secondary cloudlab→homelab backup requires keypair SSH on port 22.

Build Timeline

Late Apr 2026
Multi-node foundation
cloudlab + auxlab on GCP. Tailscale mesh. Vaultwarden, Actual Budget, CrowdSec, Prometheus/Grafana, Uptime Kuma. Ansible repo scaffolded.
Early May 2026
Homelab rebuild — Debian 13 Trixie
Clean install. Docker CE, Dockge, UFW, CrowdSec, SSH hardening. Home Assistant deployed (network_mode: host). Matter server for local mDNS device discovery.
May–Jun 2026
Immich migration + Traefik v3
newprod → homelab. DB restored, 65GB media rsynced, 5,072 assets verified. Restic→B2 live at 02:00 AST. NPM nuked. Traefik v3.7.1 owns 80/443. CF Tunnel for all public subdomains.
Jun 2026
shadeh.dev — public presence
Domain registered. Cloudflare Pages + Astro. Full site with pricing, demo pages, contact form, and SEO signals live.
In flight
Proxmox two-node cluster
OptiPlex 5070 + ProDesk 600 G4 arriving ~06/21. Full service migration. Immich ML worker re-enabled. HAOS on ProDesk. Frigate NVR planned.
Post-cluster
DIY hardware layer
5× LOLIN S3 Mini wall switches — AHT20 sensor, ESPHome native API. Pi Pico 2W for rover motor control (PIO + micro-ROS). ROS2/Nav2 rover build.

Full Stack

// core
Docker Compose Traefik v3 Cloudflare Tunnel Tailscale Restic Backblaze B2
// infra
GCP Cloudflare CrowdSec Prometheus Grafana Uptime Kuma systemd Ansible
// services
Immich Home Assistant Vaultwarden Actual Budget Dockge Postgres ESPHome Matter
// incoming
Proxmox Frigate Zigbee micro-ROS ROS2/Nav2

Need someone who actually runs this stuff?

Whether you need a custom website, a professional email setup, or someone to sort out your business infrastructure — built properly and handed over to you.

Visit shadeh.dev → WhatsApp me