A zero-trust global mesh bridging Oracle Cloud, a local Proxmox cluster, and a dedicated GPU compute node. Public traffic routes through Cloudflare to an OCI edge, then over Tailscale to local services, with LLM inference offloaded to dedicated hardware. No exposed ports. No cloud AI.
Zero open ports on the home router. The OCI instance accepts no inbound traffic except Tailscale peer handshakes, making it invisible to port scanners. Cloudflare Tunnels handle public ingress, routing requests to the OCI edge, which proxies them over the encrypted mesh to local services. The GPU compute node joins the mesh via Tailscale subnet routing, so inference requests from Open WebUI on OCI reach the local GPU with no direct internet exposure.
Open WebUI runs on OCI and is the user-facing interface for all LLM interaction. Inference requests are forwarded over the Tailscale mesh to LM Studio on the local GPU node, keeping model weights and conversation data entirely off the internet.
Serves Qwen 3 (27B/35B) on local GPU hardware via an OpenAI-compatible API. Inference requests arrive over the Tailscale mesh from Open WebUI on OCI.
LM Studio
Qwen 3 27B
Qwen 3 35B
Deployed on the OCI edge instance. Connects to LM Studio on the GPU node via its OpenAI-compatible endpoint over the encrypted mesh.
Open WebUI
Docker
Qdrant handles semantic search for RAG retrieval. PostgreSQL with pgvector stores structured embeddings for hybrid keyword and semantic queries.
Qdrant
pgvector
Orchestrates agentic workflows, connecting the AI stack to external services and automating multi-step LLM pipelines without custom glue code.
n8n
Lightweight fallback for smaller models and tasks that don't need GPU compute. Handles embeddings and quick-turnaround requests locally on the Proxmox cluster.
Ollama
Promtail ships logs from all services and the Cowrie honeypot to Loki. Grafana visualises threat patterns, service health, and inference metrics.
Grafana
Loki
Promtail
The broader lab stack: DNS, storage, virtualisation, and isolated gaming workloads, all on the same Proxmox cluster as the AI services.
A Cowrie SSH honeypot runs alongside the production stack, capturing live attacker behaviour. Logs ship via Promtail to Loki and are visualised in Grafana, providing a continuous feed of real brute-force patterns, credential attempts, and post-exploit command sequences.
The live data from this honeypot feeds the SSH Honeypot Research page, which breaks down attacker origins, credential reuse, and post-exploit session behaviour.