Homelab Re-architecture — Where I'm At And Where I'm Headed. Looking For Feedback

I've been running a homelab for a while and I'm in the middle of a full security overhaul. Attaching two diagrams — current state and end state. Would appreciate a sanity check before I get too far in.

The goal

I want to share a few services with ~20 friends, browser only, no client install on their end. And I want to do it fully self-hosted — no cloud phone-home, no per-user licensing, no features locked behind paid tiers. That last part matters to me. It's why I dropped Tailscale (user limits) and a couple other options that gate SSO behind enterprise plans.

What I have now

3 node K3s cluster on refurbished Dell business desktops running Fedora. One control plane + worker, two workers. All the cluster disks are LUKS encrypted with network bound disk encryption (Tang/Clevis), so they unlock at boot when they can reach the Tang server and stay locked if a box gets stolen.

Outside the cluster I have an old laptop running Forgejo, the Unifi controller, and AdGuard Home in Podman. Everything is managed with Ansible and committed to Forgejo. A TrueNAS box serves NFS for all the persistent volumes.

Running Jellyfin, Mealie, Joplin, and SparkyFitness, each in its own namespace, behind Traefik with a wildcard Let's Encrypt cert from cert-manager (DNS-01). Home Assistant lives on its own little machine with a robot vacuum and some smart bulbs.

The problem: it's all one flat network. No VLANs, no firewall zones, no IdP, no secrets management, and nothing is reachable from outside. It works great for me at home but "share with friends" right now would basically mean handing them my LAN. Not happening.

Where I'm going

I wrote a 12 phase plan and I'm being strict about the order — nothing gets exposed until the access plane is fully validated. Rough sequence:

1. VLANs + UniFi zone-based firewall. Five zones: the existing infra network stays untouched (so Tang/NBDE keeps working), plus Management, IoT, HomeAuto, and Trusted. Learned the hard way that UniFi's ZBF allows inter-zone traffic by default, so every boundary needs an explicit deny.

2. Host hardening — AdGuard and the Unifi controller rebound to localhost, HTTPS in front.

3. Swap Flannel for Cilium so I get NetworkPolicy and eBPF stuff later.

4. Kanidm as the IdP. Picked it because it's lightweight, Rust, no database dependency, and fully open. Two gotchas I know about going in: it signs tokens with ES256 (lots of clients assume RS256) and requires PKCE. I'm validating the Kanidm ↔ NetBird OIDC integration before building anything on top of it. Authentik is my fallback if it doesn't work out.

5. Infisical (self-hosted, with its K8s operator) for secrets. No more plaintext in manifests.

6. NetBird self-hosted on a small hardened VPS. WireGuard mesh for me, built-in reverse proxy for friends — they just open a URL and hit SSO. This is the piece that beat everything else for my requirements.

7. First public service. Exactly one, through the proxy, just me at first.

8. Mesh routing into the infra network for admin — with an explicit admins-only policy, because NetBird routes bypass access control by default. That one surprised me and seems like the easiest way to accidentally expose a whole subnet.

9. Friends come on via an SSO group. Proxy only, they never touch the mesh.

10. Monitoring — Prometheus, Loki, Grafana, Hubble. Critical alerts to my phone through Home Assistant.

11. Tetragon for runtime enforcement.

12. Then add services one at a time.

What I'd like feedback on

- Anyone running NetBird's reverse proxy (still beta) for browser-only guest access? How has it held up?

- Kanidm + NetBird OIDC — any landmines beyond the ES256/PKCE stuff?

- Does the phase order make sense, or would you sequence the IdP/secrets/access plane differently?

- Anything obviously missing from the threat model for "friends get browser access to a couple apps"?

Happy to answer questions about any of it.