mzliu.ca

Public project wiki

Homelab status,
in the open.

Architecture decisions, build milestones, and public progress reports for the infrastructure behind mzliu.ca.

Current state

Project status

Last updated July 14, 2026

Public portalOnline
PicturesOnline · Access protected
Proxmox hostHardware in transit
Canada egressDesign complete

Status report 001

Foundation day

Summary

The project moved from pre-design into its first working public services. The Canada-side VPN architecture was clarified, the public domain was activated, and two static sites were deployed through a Git-driven Cloudflare Pages workflow.

Architecture and planning

  • Produced a phased Proxmox and Canada–China connectivity design.
  • Defined phase one as individual China devices connecting to a Canada-hosted tunnel endpoint for Canadian Internet egress.
  • Deferred site-to-site routing until a Ubiquiti gateway can be installed locally in China during a future visit.
  • Preserved a core reliability rule: homelab failures must not interrupt either household's ordinary local Internet.

Public web foundation

  • Registered and activated mzliu.ca with Cloudflare.
  • Built a dependency-free static portal with a locally stored hero image.
  • Deployed the portal from GitHub using Cloudflare Pages.
  • Connected the apex domain to the production Pages deployment.
  • Verified that GitHub pushes trigger automatic production deployments.

Pictures service

  • Published a dedicated gallery at pics.mzliu.ca.
  • Added a responsive grid with 16 pictures per page.
  • Added a full-screen viewer with previous/next and keyboard navigation.
  • Protected the gallery with Cloudflare Access and Google authentication.
  • Restricted authorization to explicitly approved accounts.

Service namespace

mzliu.caPublic portal and wiki
pics.mzliu.caProtected pictures gallery
proxmox.mzliu.caReserved private management portal
dashboard.mzliu.caReserved private Homepage dashboard
vpn.mzliu.caReserved Canada tunnel endpoint
status.mzliu.caReserved observability service

Security posture

The public portal remains independent of the future SER8, while private or administrative services will receive individual access controls. Credentials, recovery material, internal addresses, and private topology details are excluded from this public wiki.

Next milestone

Bring up the Canada host.

  1. Inventory the Canada LAN, DHCP pool, reservations, and management address.
  2. Receive and validate the Beelink SER8 hardware before replacing its factory OS.
  3. Install Proxmox and verify that normal household Internet remains independent.
  4. Deploy the first Linux VM and validate a remote client tunnel from outside Canada.
  5. Add the private Homepage dashboard and monitoring after the base is stable.