Lab Matrix
lab-matrix Host Configuration
Role: Primary homelab (L2 gateway) — workstation + server
Platform: x86_64-linux (AMD CPU + AMD GPU)
Architecture Role
lab-matrix is the L2 gateway in our two-layer architecture. It runs all backend services but has no public IP — traffic reaches it through vps-pacman (L1) over Tailscale.
Services
| Category | Services |
|---|---|
| Identity | Kanidm (id.alienzj.org) |
| SSO | OAuth2-Proxy (local instance for SSO on direct Tailscale access) |
| Database | PostgreSQL 18 (backend for all services) |
| Monitoring | Gatus (status.alienzj.org), VictoriaMetrics (metrics.alienzj.org), Gotify (push.alienzj.org) |
| Git | Forgejo (git.alienzj.org) |
| Password | Vaultwarden (bw.alienzj.org) |
| RSS | FreshRSS (rss.alienzj.org) |
| Books | Calibre (books.alienzj.org) |
Stalwart (mail.alienzj.org) | |
| Photos | Immich (immich.alienzj.org) |
| Documents | Paperless (paper.alienzj.org), Stirling-PDF (pdf.alienzj.org) |
| Office | OnlyOffice (office.alienzj.org), Affine (affine.alienzj.org) |
| Notes | HedgeDoc (note.alienzj.org) |
| AI/LLM | LiteLLM (litellm.alienzj.org) |
| Bookmarks | Linkwarden (links.alienzj.org) |
| Home | Grocy (grocy.alienzj.org), Mealie (meal.alienzj.org) |
| Shell | Atuin sync server (atuin.alienzj.org) |
| Proxy | Sing-box (TUN mode), Nginx (QUIC/kTLS) |
Imported Modules
modules/modules.nix: All service toggles and host-specific settingsmodules/hardware.nix: AMD CPU/GPU, HIDPI, YubiKey, Bluetooth, SSDmodules/storage.nix: Disko schema for Btrfs + LUKS2modules/virt.nix: Docker/Podman isolationmodules/secrets.nix: Agenix secret declarations
Setup
See Homelab Bootstrap Guide for the step-by-step operational setup — secrets preparation, Kanidm admin recovery, OAuth2-Proxy OIDC client registration, and service startup order.
SSL and ACME
lab-matrix runs all services with nginx.ssl = false. SSL is terminated at L1 (vps-pacman); traffic between L1 and L2 travels inside a Tailscale WireGuard tunnel. lab-matrix does not run ACME and should not be given a Cloudflare API token — the *.alienzj.org wildcard cert is managed exclusively by vps-pacman.
The L2 nginx still applies full SSO (auth_request /oauth2/auth) via the local oauth2-proxy instance over a Unix socket. The auth chain is independent of SSL on L2. See SSO & Identity Management for the full encryption layering.