Building the Home AI Lab
What is REX?
REX is my home AI lab — a Windows 11 Pro machine running Hyper-V with a collection of VMs, a Juniper core switch, OPNsense firewall, and a growing stack of self-hosted AI services. The goal is to run capable AI agents against real infrastructure, locally.
The VM Fleet
| VM | Purpose |
|---|---|
| KaliLinux | Security scanning — Greenbone (GVM) and Nmap |
| UbuntuClaw | AI assistant — Clawdia, Piper TTS, Whisper ASR |
| DebIdentity | Identity & secrets — Authentik, VaultWarden, Step-CA |
| DebApps | Self-hosted apps — Home Assistant, SearXNG, Traefik |
Local inference doesn’t run in a VM at all — vLLM serves Gemma4-26B from WSL2 on the host, with direct CUDA access to the RTX 5090, and the assistant VM calls it over the network.
AI Routing
All AI agents (Claude Code, Gemini CLI, LangGraph agents) route through a LiteLLM proxy running on GCP. The proxy sits behind an nginx reverse proxy with internal TLS (Step-CA) and caches calls to Vertex AI — Claude and Gemini models are both available behind a single OpenAI-compatible endpoint at https://litellm.sdx.local.
For Gemini CLI specifically, a /v1beta/ bypass routes directly to the Generative Language API — Vertex AI rejects the function_response.id field that Gemini CLI includes in tool call history.
MCP Servers
Four custom MCP servers run in WSL2 and give agents direct access to network infrastructure:
- Juniper — NETCONF management for the EX3300 core switch
- OPNsense — Firewall REST API
- Aruba — WiFi controller monitoring
- Synology — NAS management (FileStation, DownloadStation, health)
LangGraph agents consume these via langchain-mcp-adapters, spawning them as stdio subprocesses.
What’s Next
The next step is building the first real LangGraph agent — likely a network topology agent that can query the Juniper MCP server, cross-reference with OPNsense firewall rules, and surface anomalies. Stay tuned.
Update — August 2026
Most of the nouns in this post have changed since it was written. The shape hasn’t.
- The core switch is now a Juniper EX3400 virtual chassis. Two EX3400-24P units, one per room, stretched into a single logical switch at 172.16.100.254. The EX3300s were retired on 6 June 2026 after the core unit’s eUSB flash started corrupting config writes. The VC is also the DHCP server and the L3 gateway for every VLAN — OPNsense handles the edge, not inter-VLAN routing.
- Clawdia is gone. She was replaced by Homer, a Hermes Agent instance on the same VM, on 11 June 2026, and the NanoClaw stack was purged on 8 July. Homer still runs on local vLLM only, and the daily briefing now arrives on Telegram instead of WhatsApp.
- VaultWarden is decommissioned. Lab credentials now live in a single
age-encrypted file that gets decrypted per session. DebIdentity still runs Authentik and Step-CA. - There are two LiteLLM proxies now — a private one on GCE reachable over WireGuard, and a public one behind an HTTPS load balancer and Cloud Armor. Between them they serve the Claude 5 family, Gemini 2.5/3.x, and the local Gemma4 instance. Claude Opus 5 is the default on REX.
- The
/v1beta/nginx bypass no longer exists. LiteLLM handles Gemini’s native API surface itself, so the hand-rolled nginx intercept was removed. - The LangGraph topology agent was never built. Homer plus the six MCP servers turned out to cover the same ground conversationally, and the bespoke agent stopped being worth writing. See the full series for how each of these played out.