Skip to content
Back to overview
Architecture deep-dive

How Beelab actually works.

Every layer, every node, every diagram. Built scalable, documented honest. Nothing here is theoretical, the same architecture ships in your install.

See the seven layersOpen the diagrams
7
Layers
N
VMs · scales 1 to N
5
VLANs

The Architecture

Seven layers, one stack.

The architecture has seven layers: Physical, Network, DevOps Pipeline, Orchestration, AI Station, Backup Station, and Observability + Recovery. Every layer earns its place by closing a specific failure mode. Security isn't a separate layer; it cuts across all of them.

Security cuts across every layer.
Layer 01

Physical

The reference build runs Proxmox VE 8 across a primary plus compute nodes (scales 1 to N nodes). The primary carries the VMs and a software-defined storage pool sized to your tier (NFS for VM access, Seafile / ownCloud / OpenCloud sync overlays, ZFS mirror on the backup tier, RAID across the live tier on the roadmap). The compute nodes handle workload distribution. Live migration across nodes means maintenance never interrupts the cluster.

The primary runs enterprise-grade NVMe TLC for live workloads, plus a secondary drive for disaster recovery clones. A Clonezilla clone restores the entire system in about 10 minutes if the primary fails.

  • HP EliteDesk
  • Lenovo ThinkCentre
  • Mac mini Pro
  • Raspberry Pi
  • Pi Zero
  • IP KVM
  • NVMe TLC
  • software-defined pool (sized to your tier)
  • UPS (tiered)
  • SNMP env monitoring

Components & roles · reference build (scales 1 to N)

  • Primary node (enterprise PC family)Proxmox hypervisor, VMs, software-defined storage pool sized to your tier (NFS, Seafile / ownCloud / OpenCloud overlays, ZFS mirror on backup tier, RAID on the roadmap)
  • Compute nodes (validated enterprise PC family)Proxmox nodes that spread workloads across the cluster, with live migration so maintenance never interrupts running VMs
  • Production tier (Talos)Talos Linux production cluster. Immutable, no SSH, API-only. Runs upstream Kubernetes for hardened production workloads (apps you cannot afford to break).
  • DevOps tier (k3s on Ubuntu)k3s control plane on Ubuntu (a lighter Kubernetes distro). Cilium CNI + MetalLB. For the lab and CI/CD side, where fast rebuild matters more than hardening.
  • k3s worker poolk3s workers sized to your tier, attached to the DevOps k3s control plane (not Talos), where fast rebuild matters more than hardening.
  • AI mesh (head + secondary + 2 agent nodes)Mac Studio Ultra 96 GB (head) plus Mac mini Pro 64 GB secondary plus two Mac mini Pro 24 GB agent runners, 208 GB pooled across the Tailscale mesh
  • Backup tier (primary + mirror)PBS + NVMe / TrueNAS ZFS mirror (sized to your tier), kept on machines isolated from the live cluster
  • Security nodeThreat detection (Wazuh + T-Pot honeypot), security monitoring, forensics
  • Raspberry Pi watchdogs plus IP KVMHoneypot (T-Pot), edge testing, live IDE, remote BIOS
  • Pi Zero watchdogsPing watchdog + GPIO relay auto-reboot
  • Enterprise software firewallOPNsense in the reference build, pfSense and VyOS work too. Multi-VLAN segmentation, inter-VLAN routing, IDS via the Suricata plugin
Real hardware

This is the reference rack. Yours scales from 1 node to N.

Sixteen U, ten functional sections. A Proxmox cluster, a four-node Apple Silicon mesh on Tailscale, four Raspberry Pi 5 (16GB) edge and lab boards, and an isolated security node. The architecture diagram and the real photos line up because nothing on the diagram is theoretical. Apple Silicon hardware is supplied by the buyer unless quoted as a bundle.

/rack/architecture.png
Architecture

Every U mapped. Every node has one job.

16U reference buildTen functional sectionsReal hardwarePhotographed in the reference build.

If the hardware dies

Hardware dies. The stack rebuilds.

If the hardware dies tomorrow, I lose nothing. The VMs, configs, services, and firewall rules all exist as code in a private Git repo.

Ansible playbooks cover the VMs. Docker Compose handles the applications. The enterprise software firewall and VLAN configs are exported and versioned. Every failure scenario I've hit has a tested runbook. Point the playbooks at fresh hardware, answer about fifteen questions (IP range, domain, drives, services), and the stack rebuilds itself. That's the entire point ⚡

Reserve a Beelab spotSee the runbooks
code/hardware/code
9f2c1abansible: pin k3s 1.32
a83d4e0compose: bump immich digest
12d9bf5opnsense: export rules.xml
Every change. Versioned. Replayable.
Ready to build yours

The architecture is the easy part.

Pick the configuration that fits, or send me a note and I will walk you through what your stack should actually look like.

See pricing
Beelab

The Sovereign Platform with AI built in, on hardware you own.

Release notes and what ships next, no spam.

© 2026 Beelab. Source available under FSL-1.1-ALv2.

All third-party product names, service marks, and trademarks named on this site are property of their respective owners. Beelab is independent of and not affiliated with these providers.