Private Cloud Design — ZFS (N+1)

Proxmox VE platform with per-tenant VLANs (VRF tiers), ZFS-based NVMe storage (DRBD RF=2 hot tier), immutable backups, and dual-ISP edge with HA firewalls. Four hypervisors (3 active + 1 HA), three storage nodes.

%%{init: {
  'theme': 'base',
  'themeVariables': {
    'primaryColor': '#eff6ff',
    'primaryTextColor': '#1e3a8a',
    'primaryBorderColor': '#3b82f6',
    'lineColor': '#64748b',
    'secondaryColor': '#f8fafc',
    'tertiaryColor': '#ffffff',
    'fontFamily': 'Inter'
  }
}}%%
flowchart TB
  classDef internet fill:#dcfce7,stroke:#166534,stroke-width:2px,color:#14532d,rx:5,ry:5
  classDef edge     fill:#fee2e2,stroke:#991b1b,stroke-width:2px,color:#7f1d1d,rx:5,ry:5
  classDef core     fill:#e0e7ff,stroke:#4338ca,stroke-width:2px,color:#3730a3,rx:5,ry:5
  classDef compute  fill:#eff6ff,stroke:#2563eb,stroke-width:2px,color:#1e40af,rx:5,ry:5
  classDef storage  fill:#f1f5f9,stroke:#475569,stroke-width:2px,color:#0f172a,rx:5,ry:5

  subgraph Internet[" Internet Connectivity "]
    ISP1[(ISP #1)]:::internet
    ISP2[(ISP #2)]:::internet
  end

  subgraph Edge[" Edge Security (HA) "]
    FW_A["FW Node A"]:::edge
    FW_B["FW Node B"]:::edge
  end

  subgraph Core[" Core Switching (MLAG Domain) "]
    ToR_A["ToR Switch A\n(25/100G)"]:::core
    ToR_B["ToR Switch B\n(25/100G)"]:::core
    ToR_A <== "2x100G ISL" ==> ToR_B
  end

  ISP1 & ISP2 -- "1G/10G BGP" --> FW_A & FW_B
  FW_A & FW_B -- "2x10G LACP" --> ToR_A & ToR_B

  subgraph Compute_Cluster[" Compute Cluster (4 Nodes) "]
    HV1["HV 01"]:::compute
    HV2["HV 02"]:::compute
    HV3["HV 03"]:::compute
    HV4["HV 04"]:::compute
  end

  subgraph Storage_Array[" Storage Cluster (3 Nodes) "]
    STO["Storage Nodes\n(x3 ZFS/Ceph)"]:::storage
  end

  HV1 & HV2 & HV3 & HV4 -- "2x25G Bond" --> ToR_A
  HV1 & HV2 & HV3 & HV4 -- "2x25G Bond" --> ToR_B
  STO -- "2x100G LACP" --> ToR_A
  STO -- "2x100G LACP" --> ToR_B
        

%%{init: {'theme': 'base', 'themeVariables': {'fontFamily': 'Inter'}}}%%
flowchart TB
  subgraph Internet
    ISP1[(ISP #1)]
    ISP2[(ISP #2)]
  end
  subgraph Edge
    FW_A[Firewall A]
    FW_B[Firewall B]
  end
  subgraph Core
    ToR_A[ToR A]
    ToR_B[ToR B]
  end
  ISP1 & ISP2 --> FW_A & FW_B
  FW_A & FW_B --> ToR_A & ToR_B
  subgraph Nodes
    HV[Hypervisors x4]
    STO[Storage x3]
  end
  HV & STO --> ToR_A & ToR_B