Docs / Lab Architecture

Lab Architecture

Logical architecture of the Home AI Lab — a Windows 11 host running Hyper-V VMs and WSL2 workloads, connected to a segmented LAN and extended into GCP via Tailscale VPN.

Home AI Lab architecture diagram showing REX host, Hyper-V VMs, WSL2 services, LAN infrastructure, and GCP extension

Click to open full size

Overview

The lab is built around a single high-spec Windows 11 host (REX) running AMD Ryzen 9 7950X3D with 128GB RAM and an RTX 5090 for local GPU inference. Hyper-V provides VM isolation; WSL2 provides a Linux environment for GPU workloads and MCP servers without the overhead of full VM virtualisation.

Layers

GCP

A LiteLLM proxy VM in Google Cloud presents a single OpenAI-compatible endpoint for all AI models — Claude and Gemini via Vertex AI, and local Gemma4 via the vLLM instance on REX. A Tailscale VPN gateway bridges the home network and GCP, making the proxy reachable as a local hostname.

LAN

The network runs on a Juniper EX3300 core switch with six VLANs — VM workloads, infrastructure, management, WiFi clients, IoT, and guest. pfSense handles inter-VLAN routing with a default-deny policy. An Aruba wireless controller manages the WiFi estate with per-SSID VLAN assignment. The Synology NAS serves as primary DNS for the internal domain and handles backups.

Host — Hyper-V VMs

  • KaliLinux — Weekly GVM/Greenbone vulnerability scans and daily Nmap network discovery
  • UbuntuClaw — Clawdia AI assistant with Piper TTS, Whisper ASR, and WhatsApp integration
  • DebIdentity — Step-CA internal PKI, Authentik identity provider, VaultWarden secrets vault
  • DebApps — Home Assistant, Traefik reverse proxy, and miscellaneous home services

Host — WSL2

  • vLLM — Gemma4-26B local inference with direct RTX 5090 CUDA access
  • MCP Servers — Four custom stdio MCP servers giving AI agents structured access to Juniper, pfSense, Aruba, and Synology

Key Design Decisions

  • MCP servers use stdio transport — more reliable than SSE in Docker and proxy environments
  • LiteLLM proxy runs in GCP, not locally — survives local infrastructure failures and provides a stable endpoint regardless of lab state
  • Identity VM uses local service accounts for services that must start before Authentik is healthy (avoiding circular boot dependencies)
  • VLANs isolate IoT, guest, and AI workloads — AI agents cannot reach client devices even with misconfigured tools

For the full narrative behind each layer, see the blog series.