Split-Horizon Homelab: A Public Showcase on CloudFront, a Private Core at Home, and Zero Open Ports

Every homelab eventually runs into the same dilemma when you want to show it off: open ports on your home router and accept a permanent background hum of port scans, or hide everything behind a VPNVPNVirtual Private NetworkNetworkingAn encrypted network tunnel that extends a private network across a public network, enabling hosts to send and receive data as if directly connected to the private LAN. where nobody can see what you’ve built.

For home-lab.net, I’m taking a third route: split-horizon. The same domain name leads to two completely different places depending on where you’re standing.

---

1. The Core Principles

1. Zero open ports on the home router. No port forwarding, no UPnP, no inbound exceptions. The router drops everything that arrives uninvited. (Our NURO line actually has a real public IPv4IPv4Internet Protocol Version 4NetworkingThe fourth revision of the Internet Protocol using 32-bit addresses (e.g. 192.0.2.1), routed via DNS A records across packet-switched networks. address, so forwarding would work. I’m choosing not to—it would publish our home IP and tie the design to a feature most Japanese lines don’t even offer.)
2. A public showcase on the edge. Visitors to https://www.home-lab.net get a static site served from S3 and CloudFront: hardware specs, topology, and write-ups, with nothing that touches the house.
3. A private core at home. On the home network—or on my phone over WireGuard—the same domain resolves to a Proxmox server in the closet, with the private services behind single sign-on.

---

2. Network Topology & Relays

The trick in every arrow touching the house: the connection starts from inside. Nothing on the internet ever initiates a connection to the home router.

The Tokyo Bridge: WireGuard Relay & SES Mail

Two small AWSAWSAmazon Web ServicesCloudAmazon global cloud computing platform offering on-demand compute, object storage, content delivery, and managed infrastructure services across dozens of geographic regions. pieces in Tokyo do the work an open port would normally do:

• The WireGuard relay (alwaysroute.com). The Proxmox host dials out a persistent WireGuard tunnel to a tiny, stateless Lightsail instance in Tokyo. Phones use WireGuard’s On-Demand rules: on mobile data or someone else’s Wi-FiWi-FiIEEE 802.11 Wireless NetworkingNetworkingA family of wireless local area network (WLAN) radio protocols based on the IEEE 802.11 standards operating in the 2.4 GHz, 5 GHz, and 6 GHz spectrum bands., they connect through the relay automatically; on our home Wi-Fi, the tunnel switches itself off. Only traffic for the homelab goes through the tunnel—everything else uses the normal internet connection. I’m spinning the relay out as its own project at alwaysroute.com, and wrote separately about designing its logo.
• Mail through SES and S3. The domain’s MX record points at Amazon SES in Tokyo, which checks SPFSPFSender Policy FrameworkSecurityAn email authentication standard allowing domain owners to publish DNS records specifying authorized mail transfer agents (MTAs) permitted to send on their behalf., DKIMDKIMDomainKeys Identified MailSecurityAn email authentication standard using asymmetric public-key cryptography to verify sender domain identity and ensure in-transit message tampering prevention., and DMARCDMARCDomain-based Message Authentication & ConformanceSecurityA security policy framework leveraging SPF and DKIM validation results to instruct receiving mail servers how to treat fraudulent or spoofed messages., then drops each message into an encrypted S3 bucket. At home, a small worker pulls new messages over outbound HTTPSHTTPSHypertext Transfer Protocol SecureSecurityAn extension of HTTP that encrypts and authenticates client-server communication over Transport Layer Security (TLS) to prevent eavesdropping and tampering. and hands them to Stalwart, the local mail server. Outgoing mail goes back out through SES on port 587. If the homelab is down for a day, mail simply waits in S3. The full design is in the zero-port mail write-up, and the Umami analytics pipeline uses the same pattern.

---

3. The Private Core: One Proxmox Host

Instead of spreading services across several power-hungry machines—a lesson I learned the expensive way when I liquidated two-thirds of my server rack—the private side is planned around a single Proxmox VE host:

• Caddy terminates TLSTLSTransport Layer SecuritySecurityCryptographic protocol operating above transport protocols to provide mutual authentication, confidentiality, and data integrity over networks. for *.home-lab.net using a wildcard certificate issued over DNSDNSDomain Name SystemNetworkingThe distributed hierarchical naming system that translates human-readable hostnames into numerical IP addresses and directs mail routing via MX records. (Route 53Route 53Amazon Route 53CloudAWS highly available, authoritative cloud Domain Name System (DNS) service supporting latency-based routing, health checks, and CloudFront alias records. DNS-01), so nothing needs to be reachable from the internet to get a valid certificate.
• Authelia puts one passkey login in front of every internal service.
• Unbound answers *.home-lab.net with the local Caddy proxy for anyone at home or on the tunnel; everyone else gets the public CloudFront answer.
• Private services: a browser start page, SearXNG for private search, Immich for photos, Stalwart and Roundcube for mail, and GitLab CE for code.
• OpenZFSZFSZettabyte File SystemStorageAn enterprise combined file system and logical volume manager featuring copy-on-write, data integrity checksumming, snapshots, and software RAID. storage managed directly by Proxmox—no separate NASNASNetwork-Attached StorageStorageA dedicated file-level storage server connected to a network that provides consolidated data access to heterogeneous clients via NFS, SMB, or S3 protocols. appliance—with fast NVMeNVMeNon-Volatile Memory ExpressStorageAn open logical-device interface specification engineered specifically for solid-state storage over PCIe buses, maximizing parallel I/O queues. mirrors for databases and mail, and bulk storage for the photo library.

Local AIAIArtificial IntelligenceAIComputer systems and neural architectures capable of reasoning, code synthesis, pattern recognition, and autonomous agentic execution. (ai.home-lab.net) isn’t part of this box. It’s a later phase, waiting on a dedicated low-power Mac Studio, for reasons that come down to idle watts and electricity prices.

The start page itself, and how one Astro codebase builds both the public site and the private one, deserves its own post—so I’ll leave it there for now.

---

Closing: Two Sites, One Name

From the outside, home-lab.net is a quiet static website. From the couch, it’s the front door to everything we run at home. The only things exposed to the internet are a CDNCDNContent Delivery NetworkNetworkingA geographically distributed network of edge proxy servers that caches and serves static web assets close to end-users to reduce latency and origin load., a mail service, and a disposable relay in AWS—none of which are in our house.

It’s a bit more plumbing than forwarding ports 80 and 443 and hoping for the best. But it means the router at home can say no to everyone, all the time, and nothing breaks.