lab

Most of my projects run on hardware I own. It's where I learn things properly, by running them for real, breaking them and writing down why.

The numbers are a snapshot pushed out of the lab every few minutes. Nothing on this site can reach into it.

Network

A dedicated firewall splits the network into zones by trust level. I lock the zones down one at a time, so each ends up closed by default with only the flows it needs.

• Servers, games, IoT, guests and management on separate segments
• Public services are reached through a VPS edge, never by opening ports at home
• Intrusion detection on the firewall plus CrowdSec at the edge
• DNS-level blocking with a canary that alerts if blocking silently stops working

Identity

Admin interfaces sit behind single sign-on with passkey-only login.

• Authentik as identity provider (OIDC and forward-auth)
• Valid TLS certificates everywhere via DNS-01

Observability

Every host ships metrics and logs to one place, and alerts go somewhere I actually look.

• Prometheus, Loki and Grafana, with Alloy as the agent
• Per-host alert rules with severities, plus freshness alerts for hosts that stop reporting
• SNMP from the core switch, firewall logs, TLS expiry

Platform

A Proxmox hypervisor runs most workloads as VMs and containers. Config is kept in git, and a nightly job snapshots live config with secrets redacted.

• Self-hosted git with CI runners (this site deploys from it)
• Next up: a kubeadm cluster managed with OpenTofu, Ansible and Argo CD