Home Lab Infrastructure

The lab runs more than five VMs across three network segments, with five layers of monitoring and no default passwords anywhere.

This is a production home lab built from the ground up to replicate enterprise-grade segmented infrastructure. It runs on Proxmox VE with multiple isolated VMs across VLANs, an OPNsense firewall controlling all inter-segment traffic, and a full observability stack (Prometheus, Grafana, Loki) for centralized monitoring. I built and operate it the way a security-conscious organization would: least-privilege access, automated posture switching via firewall APIs, Tailscale mesh networking with no exposed ports, and Cloudflare tunnels for external access. Building this taught me more about how enterprise defenses actually work - and where they break down - than any certification course could.

Infrastructure Topology

Hover over components to learn more

VLAN Segmentation Strategy

All traffic between network segments passes through the OPNsense firewall, which enforces stateful inspection rules per-VLAN. This means a compromised research VM cannot reach production services, and management access is restricted to trusted endpoints only.

• Management VLAN: Administrative access to Proxmox and infrastructure. Locked to specific devices and key-based SSH only
• Standard Network: Production services like the portfolio site, Gitea, and the monitoring stack. Outbound-only internet access where needed
• Security VLAN: Fully isolated research environment for offensive security testing. Kali Linux, Windows target VMs, and offensive security lab environments operate here with no path to production

Automated Posture Switching

A custom shell script (posture-ctl.sh) calls the OPNsense REST API to toggle between predefined firewall rule sets. This enables rapid switching between operational postures: normal operations, lockdown mode, and research mode. Rather than manually editing firewall rules, a single command changes the entire network's security stance.

The Stack

Full observability requires three pillars: metrics, logs, and visualization. This lab implements all three with open-source tooling, providing the same visibility that enterprise SOC teams rely on.

• Prometheus: Scrapes metrics from all services and infrastructure endpoints at regular intervals. Stores time-series data for alerting and trend analysis
• Grafana: Unified dashboard layer visualizing metrics from Prometheus and logs from Loki. Custom dashboards for container health, network throughput, and security events
• Loki: Log aggregation backend that indexes log streams from all services. Enables grep-like querying across the entire infrastructure without shipping raw logs to a third party
• Promtail: Log shipping agent deployed alongside services. Tails log files and container stdout, then pushes structured log entries to Loki with labels for filtering
• cAdvisor: Container-level resource monitoring exposing CPU, memory, network, and filesystem metrics per container. Feeds directly into Prometheus

Dedicated SOC Display

A dedicated ThinkCentre serves as an always-on IDS and SOC monitoring board. This provides a persistent physical display of security-relevant dashboards, log streams, and alert states. Having a dedicated monitoring surface means anomalies are visible at a glance, not buried in a browser tab.

What gets monitored

• Container health, restart counts, and resource consumption across all Docker services
• Host-level CPU, memory, disk I/O, and network throughput on every node
• Firewall rule hit counts and inter-VLAN traffic patterns from OPNsense
• SSH authentication events, including failed attempts and MFA challenges
• Application-level logs from Nginx, Gitea, and other hosted services
• Tailscale connection state and peer health across the mesh network

Security Operations Dashboard

PhantomBoard is a dedicated SOC analytics dashboard I run in the lab to turn raw logs and metrics into actionable security context. It aggregates data from the monitoring stack and network sensors so I can visualize events the same way a junior SOC analyst would review them.

• Event Correlation: Normalizes and correlates firewall logs, authentication events, container metrics, and endpoint telemetry into a single operational view
• Alert Triage: Surfaces anomalies such as failed SSH attempts, unexpected inter-VLAN traffic, and container restarts for rapid review
• Trend Analysis: Tracks traffic patterns and resource utilization over time to spot deviations from baseline behavior
• Incident Drill-down: Links high-level alerts back to underlying logs in Loki and metrics in Grafana for root-cause analysis

Why It Matters

Monitoring tools collect data; a SOC dashboard interprets it. Building PhantomBoard taught me how to present security-relevant information clearly, prioritize alerts, and avoid alert fatigue. It also reinforces the difference between noisy data and actual indicators of misconfiguration or intrusion.

Security lessons from building it

• Segmentation is the foundation: VLANs are not optional. Flat networks are indefensible. The moment I isolated research VMs from production, the blast radius of any misconfiguration dropped dramatically
• Automation prevents drift: Manual firewall changes get forgotten. The posture-switching script means security policy is code, not a wiki page that goes stale
• Monitoring without alerting is useless: Dashboards look impressive, but the real value is when anomalies surface automatically. A log nobody reads is the same as no log at all
• Defense in depth is not redundancy: Each layer defends against different threats. The firewall stops network-level attacks, container hardening stops breakouts, SSH MFA stops credential theft. Removing any one layer leaves a real gap
• Zero-trust is a design philosophy: Tailscale and Cloudflare tunnels mean I never had to open an inbound port. Every connection is authenticated and encrypted by default, not as an afterthought
• Complexity is the enemy of security: Every service added is another attack surface. The discipline is knowing when not to deploy something, and keeping what you do deploy minimal and patched
• Incident response starts with visibility: When something breaks (and it will), the first question is always "what changed?" Centralized logging with Loki makes that answerable in seconds instead of hours