← All Posts OVERVIEW #00 · · 3 min read

Building the Home AI Lab

An overview of REX - the Windows 11 host machine running a fleet of Hyper-V VMs, local LLMs, and MCP-connected network infrastructure.

#homelab#ai#infrastructure

What is REX?

REX is my home AI lab - a Windows 11 Pro machine running Hyper-V with a collection of VMs, a Juniper core switch, an OPNsense firewall, and a growing stack of self-hosted AI services. The goal is simple: run capable AI agents against real infrastructure, locally.

The VM Fleet

VMPurpose
KaliLinuxSecurity scanning - Greenbone (GVM) and Nmap
UbuntuClawAI assistant - Clawdia, Piper TTS, Whisper ASR
DebIdentityIdentity & secrets - Authentik, VaultWarden, Step-CA
DebAppsSelf-hosted apps - Home Assistant, SearXNG, Traefik

Local inference doesn’t run in a VM at all - vLLM serves Gemma4-26B from WSL2 on the host, with direct CUDA access to the RTX 5090, and the assistant VM calls it over the network.

AI Routing

All AI agents (Claude Code, Gemini CLI, LangGraph agents) route through a LiteLLM proxy running on GCP. The proxy sits behind an nginx reverse proxy with internal TLS (Step-CA) and caches calls to Vertex AI - Claude and Gemini models are both available behind a single OpenAI-compatible endpoint at https://litellm.sdx.local.

For Gemini CLI, a /v1beta/ bypass routes straight to the Generative Language API - Vertex AI rejects the function_response.id field that Gemini CLI includes in tool call history.

MCP Servers

Four custom MCP servers run in WSL2 and give agents direct access to network infrastructure:

  • Juniper - NETCONF management for the EX3300 core switch
  • OPNsense - Firewall REST API
  • Aruba - WiFi controller monitoring
  • Synology - NAS management (FileStation, DownloadStation, health)

LangGraph agents consume these via langchain-mcp-adapters, spawning them as stdio subprocesses.

What’s Next

The next step is building the first real LangGraph agent - likely a network topology agent that can query the Juniper MCP server, cross-reference with OPNsense firewall rules, and surface anomalies. Stay tuned.

Update - August 2026

Most of the nouns in this post have changed since I wrote it. The shape hasn’t.

  • The core switch is now a Juniper EX3400 virtual chassis - Two EX3400-24P units, one per room, stretched into a single logical switch at 172.16.100.254. I retired the EX3300s on 6 June 2026 after the core unit’s eUSB flash started corrupting config writes. The VC is also the DHCP server and the L3 gateway for every VLAN - OPNsense handles the edge, not inter-VLAN routing.
  • Clawdia is gone - I replaced her with Homer, a Hermes Agent instance on the same VM, on 11 June 2026, and purged the NanoClaw stack on 8 July. Homer still runs on local vLLM only, and the daily briefing now lands on Telegram instead of WhatsApp.
  • VaultWarden is decommissioned - Lab credentials now live in a single age-encrypted file decrypted per session. DebIdentity still runs Authentik and Step-CA.
  • There are two LiteLLM proxies now - A private one on GCE reachable over WireGuard, and a public one behind an HTTPS load balancer and Cloud Armor. Between them they serve the Claude 5 family, Gemini 2.5/3.x, and the local Gemma4 instance. Claude Opus 5 is the default on REX.
  • The /v1beta/ nginx bypass no longer exists - LiteLLM handles Gemini’s native API surface directly, so I removed the hand-rolled nginx intercept.
  • The LangGraph topology agent was never built - Homer plus the six MCP servers turned out to cover the same ground conversationally, and the bespoke agent stopped being worth writing. See the full series for how each of these played out.

Update - October 2026

Three more things shifted between August and October:

  • Gemma 4 was replaced by Swift-Qwen3.8-27B-NVFP4 - It runs mixed FP8/NVFP4 quantisation on the RTX 5090’s Blackwell tensor cores with roughly half the thinking-token overhead.
  • The VM fleet grew to seven - A fifth Hyper-V VM (VoiceGW) now runs dedicated speech-to-text and text-to-speech for Home Assistant and a Google Glass Enterprise Edition 2 wearable client. Two lightweight Debian VMs on the Synology NAS (Jumphost and UtilityHost) handle out-of-band jump access and off-host cloud media sync.
  • The MCP servers split into read and write instances - Five infrastructure servers now load read-only by default, with write-capable instances gated behind an explicit admin profile.

Home AI Lab Architecture (October 2026)

Current logical topology as of October 2026 - see the Lab Architecture page for the full layer-by-layer breakdown.