Yazamco Private Cloud — Network & Storage Design (N+1 with 4 HV / 3 Storage)

Proxmox VE platform with per-tenant VLANs (VRF tiers), ZFS-based NVMe storage (DRBD RF=2 hot tier), immutable backups (optional), and dual-ISP edge with HA firewalls. Four hypervisors (3 active + 1 HA), three storage nodes (2 active + 1 HA). N+1 at each failure domain.

%%{init: {'theme': 'base', 'themeVariables': {'fontFamily': 'Inter, sans-serif', 'fontSize': '14px'}}}%%
flowchart TB

  %% === STYLES ===
  classDef internet fill:#166534,stroke:#22c55e,stroke-width:2px,color:#fff,border-radius:12px
  classDef edge    fill:#991b1b,stroke:#f87171,stroke-width:3px,color:#fff,border-radius:16px,font-weight:bold
  classDef core    fill:#5b21b6,stroke:#c4b5fd,stroke-width:2px,color:#fff,border-radius:12px
  classDef oob     fill:#1f2937,stroke:#6b7280,stroke-width:1.5px,color:#e5e7eb,border-radius:10px
  classDef network fill:#1e3a8a,stroke:#93c5fd,stroke-width:2px,color:#fff,border-radius:10px
  classDef compute fill:#1e40af,stroke:#60a5fa,stroke-width:2px,color:#fff,border-radius:12px
  classDef storage fill:#1e293b,stroke:#475569,stroke-width:2px,color:#e2e8f0,border-radius:12px

  %% === INTERNET ===
  subgraph Internet["Dual ISPs (2×1 Gbps)"]
    ISP1[(ISP #1\neBGP)]
    ISP2[(ISP #2\neBGP)]
  end
  class ISP1,ISP2 internet

  %% === EDGE SECURITY ===
  subgraph Edge["NGFW HA + WAF/DDoS"]
    direction LR
    FW_A["Firewall A\n**Active**"]
    FW_B["Firewall B\n**Standby**"]
    WAF["Fortinet WAF\nPer-Tenant"]
    DDoS["ISP DDoS Scrub"]
  end
  class FW_A,FW_B,WAF,DDoS edge

  ISP1 -->|"eBGP / Static"| FW_A
  ISP2 -->|"eBGP / Static"| FW_B
  FW_A <-->|"HA Sync\n< 3s Failover"| FW_B
  FW_A --- WAF
  ISP1 --- DDoS
  ISP2 --- DDoS

  %% === CORE / ToR ===
  subgraph Core["Collapsed Core / ToR\nMLAG + LACP"]
    direction LR
    ToR_A["ToR/Core A\n25G Ports"]
    ToR_B["ToR/Core B\n25G Ports"]
    ToR_A <== "2×100G ISL\nMLAG" ==> ToR_B
  end
  class ToR_A,ToR_B core

  FW_A -->|"VLAN Trunks"| ToR_A
  FW_B -->|"VLAN Trunks"| ToR_B

  %% === OOB ===
  subgraph OOB["Out-of-Band Management"]
    OOB_SW["1G OOB Switch"]
    LTE["LTE Failover"]
    BASTION["Bastion Host\nMFA + JIT"]
  end
  class OOB_SW,LTE,BASTION oob

  OOB_SW --- LTE
  OOB_SW --- BASTION

  %% === VRFs / VLANs ===
  subgraph Networks["VRFs & VLANs"]
    VRF_MGMT[["MGMT\n10.10.0.0/16\nVLAN 10"]]
    VRF_STORE[["STORAGE\n10.20.0.0/16\nVLAN 30\nMTU 9000"]]
    VRF_CLUSTER[["CLUSTER\n10.30.0.0/16\nVLAN 40"]]
    VRF_SERV[["SERVICES\n10.40.0.0/16\nVLAN 50"]]
    VRF_SILVER[["TENANT-SILVER\nVLAN 1000–1199"]]
    VRF_GOLD[["TENANT-GOLD\nVLAN 2000–2199"]]
  end
  class VRF_MGMT,VRF_STORE,VRF_CLUSTER,VRF_SERV,VRF_SILVER,VRF_GOLD network

  ToR_A -.-> VRF_MGMT & VRF_STORE & VRF_CLUSTER & VRF_SERV & VRF_SILVER & VRF_GOLD
  ToR_B -.-> VRF_MGMT & VRF_STORE & VRF_CLUSTER & VRF_SERV & VRF_SILVER & VRF_GOLD

  %% === PROXMOX HVs ===
  subgraph Compute["Proxmox VE\n4 HVs: 3+1 HA"]
    direction TB
    HV1["HV-1\n4×10G (2/ToR)\n+1G OOB"]
    HV2["HV-2\n4×10G (2/ToR)\n+1G OOB"]
    HV3["HV-3\n4×10G (2/ToR)\n+1G OOB"]
    HV4["HV-4\n4×10G (2/ToR)\n+1G OOB\n**Spare**"]
  end
  class HV1,HV2,HV3,HV4 compute

  HV1 -->|"bond0: Data\nbond1: Storage"| ToR_A
  HV1 --> ToR_B
  HV2 --> ToR_A & ToR_B
  HV3 --> ToR_A & ToR_B
  HV4 --> ToR_A & ToR_B

  %% === ZFS STORAGE ===
  subgraph Storage["ZFS Storage\n3 Nodes: 2+1 HA"]
    ST1["STOR-1\n24× NVMe Gen4"]
    ST2["STOR-2\n24× NVMe Gen4"]
    ST3["STOR-3\n24× NVMe Gen4\n**Spare**"]
  end
  class ST1,ST2,ST3 storage

  ST1 -->|"25G MLAG"| ToR_A
  ST1 --> ToR_B
  ST2 --> ToR_A & ToR_B
  ST3 --> ToR_A & ToR_B

  BASTION -->|"Secure Access"| VRF_MGMT

  %% === ACTIVE & WORKING LINKS ===
  click FW_B "https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/573688/ha-active-passive-cluster" "FortiGate HA Failover"
  click ToR_A "https://www.arista.com/en/support/advisory/mlag" "Arista MLAG Guide"
  click HV4 "https://pve.proxmox.com/wiki/High_Availability" "Proxmox HA Auto-Migration"
  click ST3 "https://openzfs.github.io/openzfs-docs/man/8/zpool-replace.8.html" "ZFS Auto-Rebuild from Spare"
        

%%{init: {'theme': 'base', 'themeVariables': {'fontFamily': 'Inter, sans-serif', 'fontSize': '14px'}}}%%
flowchart TB

  %% === STYLES ===
  classDef storage    fill:#1e293b,stroke:#475569,stroke-width:2px,color:#e2e8f0,border-radius:12px
  classDef hot        fill:#c53030,stroke:#e53e3e,stroke-width:3px,color:#fff,border-radius:16px,font-weight:bold
  classDef warm       fill:#dd6b20,stroke:#f6ad55,stroke-width:2px,color:#fff,border-radius:12px
  classDef compute    fill:#1e40af,stroke:#60a5fa,stroke-width:2px,color:#fff,border-radius:12px
  classDef backup     fill:#0d9488,stroke:#5eead4,stroke-width:2px,color:#fff,border-radius:12px
  classDef note       fill:#f8fafc,stroke:#94a3b8,stroke-dasharray:8 4,stroke-width:1.5px,color:#475569,border-radius:8px,font-style:italic

  %% === ZFS STORAGE CLUSTER ===
  subgraph ZFS_Cluster["ZFS Storage Cluster\n3 Nodes: 2 Active + 1 HA"]
    direction LR
    ST1["STOR-1\n24× NVMe Gen4"]
    ST2["STOR-2\n24× NVMe Gen4"]
    ST3["STOR-3\n24× NVMe Gen4\n**Spare Node**"]
  end
  class ST1,ST2,ST3 storage

  %% === HOT TIER ===
  subgraph HOT["HOT Tier: DRBD\n**RF=2 Replication**"]
    LVs["Replicated VM Disks\nUltra-Low Latency\niSCSI / NVMe-oF"]
  end
  class LVs hot

  %% === WARM TIER ===
  subgraph WARM["WARM/COLD Tier: ZFS RAIDZ2"]
    RAIDZ2["Per-Node RAIDZ2\n4×6 NVMe vdevs\nHigh Capacity"]
  end
  class RAIDZ2 warm

  %% === CONNECTIONS ===
  ST1 -->|ZFS Pool| LVs
  ST2 -->|ZFS Pool| LVs
  ST3 -->|ZFS Pool| LVs
  ST1 -->|Local vdevs| RAIDZ2
  ST2 -->|Local vdevs| RAIDZ2
  ST3 -->|Local vdevs| RAIDZ2

  %% === PROXMOX COMPUTE ===
  subgraph PVE["Proxmox VE Cluster\n4 HVs: 3+1 HA"]
    direction TB
    VMs["**VM Disks** → HOT Tier\nTemplates → SERVICES VRF"]
  end
  class VMs compute

  PVE <== "25G Storage Network\nLACP + MTU 9000" ==> LVs

  %% === BACKUP & DR ===
  subgraph BACKUP["Backup & Disaster Recovery"]
    direction TB
    PBS["Proxmox Backup Server\nEncrypted Landing Zone"]
    S3["Immutable S3 (Optional)\n14–30d WORM Lock"]
    DR["Warm DR Site (Optional)\nGold VMs Only"]
  end
  class PBS,S3,DR backup

  PVE -->|"VSS-Aware Backups"| PBS
  PBS -->|"GFS: 30d/12m/7y"| S3
  PVE -.->|"Async Replication"| DR

  %% === RESILIENCY NOTE ===
  note["**Resiliency**\n1 Node Down → HOT Tier **UP**\nRebuild to ST3 → Full HA"]
  note --> LVs
  note --> RAIDZ2
  class note note

  %% === ACTIVE & WORKING LINKS ===
  click ST3 "https://linbit.com/drbd/" "Spare node auto-joins on failure"
  click LVs "https://linbit.com/linstor/" "DRBD ensures zero RPO"
  click DR "https://pve.proxmox.com/wiki/High_Availability" "Proxmox HA & Replication Docs"