← All projects

Infrastructure & Security Engineer

Zero Trust Proxmox Architecture

A homelab Proxmox cluster rebuilt around Zero Trust principles: identity-aware access, micro-segmentation, and no implicit trust between tiers.

  • Proxmox VE
  • OPNsense
  • Tailscale
  • Authentik
  • Step-CA

Architecture

WireGuardACL: adminTokenInternetOPNsense FirewallAdmin DeviceTailscale MeshIdentity-Aware ProxyAuthentik OIDCProxmox Mgmt UIApp Tier VMData Tier VM

Overview

Reworked a multi-node Proxmox cluster to remove the flat-trust LAN model. Every workload sits behind an identity-aware proxy, and the network is segmented so a compromised VM cannot pivot laterally.

Access to Proxmox management is gated by Authentik (OIDC) and a Tailscale ACL; only tagged admin devices on a compliant posture can even reach the management plane.

Principles enforced

  1. No service is reachable without first authenticating to the identity-aware proxy.
  2. Network segments are isolated VLANs on OPNsense; east-west traffic is denied by default.
  3. Internal CA (step-ca) issues short-lived certificates for service-to-service mTLS.
  4. All admin actions on Proxmox API are logged and forwarded to a central SIEM.