cat ~/writeups/*.md
Writeups
Build logs documenting how the lab was put together: design decisions, gotchas, and the reasoning behind each deployment.
ProxDoc: An Inventory & Compliance Platform with Agentless Proxmox Scanning, Risk Scoring, and Auto-Generated Docs
September 2, 2026
ProxDoc is the lab's inventory and compliance platform: it connects once to the Proxmox API, scans every guest agentlessly, scores each one's security and DR posture against rule packs, and auto-generates the documentation for a 12-node, 59-guest cluster.
ProxmoxComplianceCSPMPythonReactAutomationHomelabThe Self-Hosted AI Tier: Private Inference with Ollama, OpenWebUI, and ComfyUI
August 26, 2026
A private ChatGPT and image generator where no token leaves the lab: OpenWebUI as the one authenticated front door, with Ollama, two ComfyUI instances, and Qwen3-TTS pinned to the cluster's heaviest compute behind it.
OllamaOpenWebUIComfyUILLMSelf-HostedPrivacyHomelabThe Zero-Trust Access Tier: Twingate, Guacamole, and a Hardened Jumpbox
August 19, 2026
Reachable by me from anywhere and by no one else: Twingate brokers outbound-only, identity-scoped access with zero inbound ports, Guacamole renders RDP/SSH/VNC in the browser, and a hardened jumpbox keeps the blast radius small.
TwingateZero TrustApache GuacamoleRustDeskReverse ProxyRemote AccessSecurityThe Observability Tier: Watching 12 Nodes with InfluxDB, Telegraf, and Loki
August 12, 2026
Watching a 12-node, 59-guest cluster by splitting 'is it healthy?' into three questions and three stores: metrics in InfluxDB via Telegraf, logs in Loki, and up/down in Uptime Kuma, with Grafana over the top.
InfluxDBTelegrafLokiGrafanaMonitoringObservabilityProxmoxThe Isolation & Privacy Tier: KASM, SearXNG, and Hardened Docker
April 12, 2026
How I run disposable browsers and a private metasearch engine as self-hosted services: KASM Workspaces for throwaway browsing and malware triage, SearXNG for tracking-free search, all behind a hardened Docker and reverse-proxy setup with real egress control.
KASMSearXNGDockerBrowser IsolationSelf-HostedPrivacypfSense as the Lab's Perimeter and Segmentation Engine
March 22, 2026
The network security foundation everything else sits on: VLAN segmentation with a default-deny posture, Suricata inline IPS, WireGuard remote access, and the pfSense API that lets Wazuh firewall an attacker automatically.
pfSenseNetwork SecuritySuricataVLANFirewallWireGuardA Distributed Honeypot Network With OpenCanary
March 5, 2026
Deploying lightweight OpenCanary sensors across every VLAN to catch lateral movement early: the service config, why placement beats sophistication, the pipeline into Wazuh and pfSense, and how I keep the sensors themselves from becoming a liability.
OpenCanaryHoneypotDeceptionThreat IntelligenceDetection EngineeringBuilding a Wazuh SIEM/EDR From Scratch
February 10, 2026
How I stood up Wazuh as the detection backbone of the lab: the containerized deployment, custom decoders and rules, an OpenCanary-to-firewall response loop, MISP IOC matching, and every tuning gotcha that cost me an evening.
WazuhSIEMEDRDetection EngineeringMITRE ATT&CKAutomating a MISP Vulnerability Attack Feed
January 18, 2026
A capstone project that became a permanent lab service: a Python pipeline that pulls CVE data from multiple sources, scopes it to the software I actually run, enriches it, and publishes correlated events into MISP that Wazuh consumes as live IOCs.
MISPThreat IntelligencePythonCVEAutomation