Overview

The physical layer ROOT runs on. ThinkCentre M70q-class mini PC + TP-Link AX3000 + Proxmox + a bastion VM. ThinkPad as daily-driver dev box; MacBook for travel/portfolio work.

The homelab is the ground truth for the program. basecamp — the 9-tier platform you build across 60 months — runs here. Every pattern in Year 1 and beyond is verified by operating real software on this real hardware. When Phase 7 (Kubernetes + GitOps) lands at Month 10, this is the box K3s reconciles against. When the data tier lands in Year 3, this is the box Iceberg + Trino + Spark live on.

The shape is deliberate: one mini PC running Proxmox, one bastion VM as the SSH entry point, plus client laptops that talk to it over Tailscale. No rack, no NAS, no GPU. The constraint is the curriculum — small hardware forces you to operate the patterns, not throw resources at the problem.

These docs land pre-Phase-1, before Year 1 starts. Read them in order: hardware → proxmox → thinkpad-setup → macbook-setup. The Master Plan hardware section gives the 60-month spend curve; this directory is the operational detail.

---

Topology

Internet (DITO 5G)
   │
TP-Link AX3000 router (192.168.0.1)
   ├─ M70q Gen 5 — Proxmox host (192.168.0.50, root)
   │     ├─ bastion VM (192.168.0.10, ubuntu)
   │     ├─ k3s nodes — k3s-master, k3s-worker-1, k3s-worker-2
   │     ├─ Postgres VM (Y1 P3)
   │     └─ ... more VMs as ROOT phases land
   │
   ├─ ThinkPad (T14s) — daily driver dev env
   └─ MacBook — travel + portfolio commits

The router is consumer-grade on purpose — it’s the failure surface you’ll diagnose against in Phase 2 (Networking). The bastion is the only host reachable from outside the LAN; everything else hides behind it. Once Tailscale is up, your tailnet replaces port-forwarding entirely.

Why the bastion exists

The bastion is a small Ubuntu VM that does one job: be the SSH entry point. It hardens once (nftables default-deny, key-only SSH, unattended-upgrades) and you never log into the Proxmox host directly from the internet. When Phase 2 deepens networking and Phase 7 lands K3s, the bastion is also where kubectl gets called from — keeping the kubeconfig off your laptops.

---

Pages

Doc	What
hardware.md	M70q specs, IP plan, RAM/storage budget over 60 months, upgrade schedule
proxmox.md	Hypervisor install + bastion VM + network layout
thinkpad-setup.md	Ubuntu 24.04 dev environment — daily driver
macbook-setup.md	macOS dev environment — secondary / travel

---

When each lands

• Hardware — pre-Phase-1 (homelab bought + assembled before ROOT starts)
• Proxmox + bastion — pre-Phase-1 (Stage 2 of the Start Here checklist)
• ThinkPad setup — pre-Phase-1 (Stage 3)
• MacBook setup — when needed for travel / portfolio commits

Don’t skip the pre-Phase-1 stages

Phase 1 assumes the homelab is alive: Proxmox responding, bastion reachable over SSH, ThinkPad able to push to GitHub. If any of those is broken, Phase 1 turns into infrastructure setup instead of OS-foundations work — and you’ll resent both. Verify the topology end-to-end (laptop → bastion → Proxmox web UI) before opening Phase 1.

---

Why “homelab” (not cloud-only)

Three reasons:

1. Cost — running ROOT on cloud only would be $5K+/year. Homelab is ~$700 hardware + ~$70-150 cloud across 60 months total.
2. Pattern integrity — operating at home forces you to encounter real failures (disk dies, network drops, power blips). Cloud abstracts these away.
3. Independence — when AWS is down (or you stop paying), basecamp keeps running. The platform is yours.

Cloud is for: Y2 P10-11 AWS+GCP exploration ($50), Y4 P25 GPU spot ($20-50). That’s it. See the Master Plan cloud requirements for the full breakdown.