Homelab Podman Quadlet architecture orchestrates multiple containerized services (Matrix, Immich, Outline, Plex) on Fedora CoreOS via systemd units, with Traefik reverse proxy, CrowdSec security gateway, and nftables firewall protecting inbound traffic. Data flows from internet users through layered security (nftables default-deny, CrowdSec ForwardAuth, SELinux) to Traefik socket activation, which routes requests to application stacks backed by iSCSI LVM storage and NFS shares. Bitwarden secrets manager injects credentials into Podman Quadlet units provisioned by OpenTofu, while Grafana Alloy, Telegraf, and Victoria observability stack (VictoriaMetrics, VictoriaLogs, VictoriaTraces) monitor the entire system. This architecture demonstrates defense-in-depth security, immutable infrastructure, and comprehensive observability for self-hosted deployments. Fork and customize this diagram on Diagrams.so to adapt the stack topology, add additional services, or modify security policies for your homelab. The design balances security hardening with operational simplicity using declarative infrastructure-as-code and container-native tooling.