Mobile Homelab Architecture¶

Portable infrastructure for dev, self-hosting, and travel.

Key principle: Mobile kit operates on-demand (7AM-7PM or travel). Headscale runs on VPS for 24/7 mesh availability. Mobile kit can be off without breaking the mesh.

Operating Model¶

Mode	Schedule	Notes

Why on-demand?¶

Paraguay heat: reduce active equipment
Energy savings: RPi 5 + Beryl AX off when not needed
Fire safety: fewer devices running 24/7
Mesh still works: Headscale on VPS handles coordination

Hardware¶

Device	Role	Power	Status

Phone Roles¶

Phone	Role	Carrier	Connection

A13 stays plugged in and tethered when mobile kit is running. A16 is personal phone, not part of homelab infrastructure.

Claro Prepaid Data (Samsung A13)¶

SIM: PYG 10,000 prepaid from local store

Pack	Duration	Notes

Features¶

WhatsApp free (1GB daily limit, no calls/video)
Data doesn't roll over
Prices include IVA
Dial *123# to see available packs

To verify¶

Tethering allowed (test before buying big pack)
Check simple.claro.com.py for current prices

References¶

Network Topology¶

            [Internet]
                 |
          [Samsung A13]
           USB Tether
                 |
         [Beryl AX Router]
          192.168.8.1
           /         \
          /           \
   [MacBook Air]    [RPi 5]
   192.168.8.10    192.168.8.5
         \           /
          \         /
        [Tailscale Mesh]
          100.x.x.x
              |
         [VPS - Headscale]
          100.77.172.46

Services¶

Beryl AX (Always-On When Kit Running)¶

Service	Port	Purpose

AdGuard Home is built into GL.iNet firmware - lightweight (~30MB), perfect for router.

Raspberry Pi 5 (On-Demand / Tinkering)¶

Service	Port	Purpose

RPi 5 is a tinkering device - can be reassigned to other projects. Beryl AX AdGuard provides DNS when RPi 5 is busy/off.

MacBook Air M1 (Workstation)¶

Service	Port	Purpose

| Docker workloads | Various | Dev containers |

DNS Strategy (Dual-DNS)¶

[Devices] → [Beryl AX AdGuard Home] → [Upstream DNS]
                    ↓ (fallback)
            [RPi 5 Pi-hole] → [Upstream DNS]

Scenario	Primary DNS	Fallback

Both provide ad-blocking. Redundancy without complexity.

IP Addressing¶

Local Network (Beryl AX)¶

Device	IP	MAC Reservation

| Beryl AX | 192.168.8.1 | - | | RPi 5 | 192.168.8.5 | Yes | | MacBook Air | 192.168.8.10 | Yes |

Tailscale Network (Headscale Mesh)¶

Device	Tailscale IP	Hostname	Role

Headscale on VPS assigns and coordinates all IPs. Run tailscale status to see current mesh.

Scenarios¶

Traveling (Primary Use Case)¶

[Hotel Wifi/Tethering] → [Beryl AX] → [RPi 5 + MacBook]
                                           ↓
                                    [Tailscale Mesh]
                                           ↓
                                    [VPS - Headscale]
                                           ↓
                                  [Home devices: connected]

Mobile kit provides local DNS (Pi-hole)
MacBook ↔ RPi 5 works locally
Tailscale mesh connects to home via VPS

At Home¶

[Home Router] → [Beryl AX optional] → [RPi 5 + MacBook]
                         ↓
                 [All devices on Tailscale]
                         ↓
                   [VPS coordinates]

RPi 5 optional at home (Fixed homelab Pi-hole available)
MacBook connects directly to home network or via Tailscale

Mobile Kit Off¶

[MacBook only on home WiFi]
         ↓
   [Tailscale Mesh]
         ↓
  [VPS - Headscale] ← Still running 24/7
         ↓
  [Home devices: connected]

RPi 5 and Beryl AX powered off
Mesh still works (VPS handles coordination)
MacBook connects via home network + Tailscale

Deployment Order¶

Phase	Task	Status

RPi 5 (Moved to Fixed Homelab)¶

RPi 5 has been migrated from the mobile kit to the fixed homelab, running OpenClaw directly (not Docker). See docs/rpi5-deployment-plan.md.

Backup Strategy¶

Source	Destination	Method	Frequency

Headscale backup handled by VPS (see docker/vps/networking/headscale/backup.sh).

Security Considerations¶

Pi-hole web password in .env (set via pihole -a -p)
Beryl AX admin password: change from default
Enable Beryl AX firewall, disable WAN access to admin

Power Management¶

Daily Operation (7AM-7PM)¶

# Morning: Power on
# - Plug in RPi 5
# - Power on Beryl AX
# - Wait ~2 minutes for boot

# Evening: Power off
# - Safe to unplug (Pi-hole is stateless)
# - Mesh continues via VPS

Hot Days¶

On extremely hot days, keep mobile kit off entirely:

MacBook uses home WiFi + Tailscale
Mesh works via VPS
No impact on homelab operation

Future Enhancements¶

[ ] Tailscale exit node on RPi 5
[ ] Syncthing between MacBook and RPi 5
[ ] Ansible playbooks for declarative deployment