I've been slowly cleaning up my homelab networking and adding some redundancy, and I'd like a sanity check from people who have been doing this longer than me.
My setup is basically:
– Raspberry Pi 5 as the main/production server
– Mac mini as a secondary/dev server
– Docker/Compose on both
– Traefik on both hosts
– AdGuard Home on both hosts
– Router DHCP gives clients both AdGuard instances as DNS servers
– Local services use a private .lan domain
– Tailscale for remote/private access
– Cloudflare Tunnel for the few services I expose publicly
– Cloudflare Access in front of some public services, with mTLS for the more sensitive ones
– No inbound port forwarding
– ISP is behind CGNAT
The Pi is still the "main" node, but I've been trying to avoid making it a single point of failure.
For DNS, both AdGuard instances are independent resolvers with the same local rewrites. I've tested UDP/TCP DNS against both, local records, public resolution, and reboot/failover behavior.
Local traffic is roughly:
LAN client
|
v
AdGuard Home
|
v
local hostname
|
+—-> Pi Traefik —-> Pi containers
|
+—-> Mac Traefik —> Mac containers
Remote/private access:
Phone / laptop
|
Tailscale
|
Home LAN / DNS
Public services:
Internet
|
Cloudflare
|
Cloudflare Tunnel
|
Traefik
|
Container
I also run a connector for the same Cloudflare Tunnel on both hosts, so I treat it as one tunnel with two connectors rather than two separate tunnels.
One slightly nerdier part of the setup is that I wrote a small mapper for the lab. It periodically collects read-only state from both machines and generates Markdown/Mermaid diagrams plus an inventory in a private Git repo.
It discovers things like:
– Hosts
– Containers
– Docker networks
– Traefik routers/services
– Local DNS paths
– AdGuard rewrite drift
– Tailscale nodes
– Cloudflare tunnel connectors
– Public vs private routes
I'm currently adding read-only Cloudflare API discovery too, so eventually it can validate the full path instead of just knowing that the local side exists:
public hostname
|
v
Cloudflare Tunnel ingress
|
v
origin host
|
v
Traefik router
|
v
Traefik service
|
v
container
I'm deliberately making that part conservative. If the mapper can't actually prove a route exists, it marks it as unvalidated instead of guessing.
Mainly wondering:
– Does running two independent AdGuard instances make sense here?
– Is two Traefik instances a reasonable approach for two hosts?
– Is there an obvious single point of failure I'm overlooking?
– Would you structure ingress between the two machines differently?
– Does using Tailscale for private access and Cloudflare Tunnel only for selected public services sound reasonable?
– What part of this setup feels unnecessarily complicated?
– If this were your lab, what would you improve next?
I'm not really trying to build enterprise HA at home. I just enjoy getting it to the point where rebooting one machine doesn't randomly take down DNS or remote access.
Would especially appreciate criticism around the networking/DNS/ingress side rather than just recommendations for more services to install.
Source: r/homelab · by /u/Guilty_Bird_3123