A small enterprise, at home.

The homelab is where I practice the things I sell. It runs the same categories of tooling a company's IT department runs, scaled to a closet: a firewall, a VPN mesh, DNS filtering, centralized logs, intrusion detection, a SIEM, a password manager, a media server and nightly backups. It is documented like a production system because that is the habit I want.

Party

What is running

Container host

Docker

Every service runs in Docker Compose with persistent volumes on a separate data drive, so the operating system disk stays clean and backups are one directory.

Journal

Quest log

Milestones from the lab notebook. Each one is documented with the objective, what went wrong, the fix and the lesson, because the lesson is the point.

LAB-001
Headless Debian server
Minimal bare-metal install chosen over a hypervisor while memory was tight.
Enterprise equivalent: On-prem server provisioning
Complete
LAB-003
Storage tiering
Operating system on NVMe, all data and container volumes on a separate drive.
Enterprise equivalent: SAN/NAS tiering
Complete
LAB-006
DNS sinkhole
Pi-hole with curated threat lists, verified by watching a known tracker resolve to nothing.
Enterprise equivalent: Cisco Umbrella, Cloudflare Gateway
Complete
LAB-007
Centralized logging
rsyslog ingestion with dynamic per-host files and a seven-day rolling rotation.
Enterprise equivalent: Splunk forwarders, Elastic Beats
Complete
LAB-011
Network intrusion detection
Suricata in a container on the host network, writing structured alerts to disk.
Enterprise equivalent: Palo Alto Threat Prevention, Snort
Complete
LAB-012
SIEM deployment
Multi-container Wazuh with indexer, manager and dashboard; port conflicts and kernel limits sorted out along the way.
Enterprise equivalent: Splunk ES, Microsoft Sentinel
Complete
LAB-013
IDS to SIEM pipeline
Suricata alerts flowing into Wazuh rules and firing live on the dashboard.
Enterprise equivalent: Structured log ingestion
Complete
LAB-014
VPN mesh and firewall hardening
Every device on the mesh, blanket firewall rules replaced with explicit per-port allow-lists, monitoring on the SIEM itself.
Enterprise equivalent: Zero-trust access, segmentation
Complete
LAB-015
Bastion host
A hardened always-on jump box as the only remote entry point, with power-restore and unattended upgrades.
Enterprise equivalent: AWS bastion, Azure jump box
Complete
LAB-016
Custom detection rules
A child rule extending the vendor ruleset, verified with the SIEM's own test harness after chasing a field-name gotcha.
Enterprise equivalent: Sigma rules, SPL
Complete
LAB-017
Backups, key-only SSH, password manager
Nightly volume backups, password SSH disabled everywhere in favour of ED25519 keys, Vaultwarden deployed, DNS fallback on every device.
Enterprise equivalent: Backup policy, PAM, secrets management
Complete
LAB-019
SIEM agents on every endpoint
Extend Wazuh coverage from network alerts to host telemetry, including Windows event forwarding.
Planned
LAB-020
Emerging Threats ruleset
Turn on thousands of real-world Suricata signatures and tune the noise.
Planned
LAB-022
Dashboards
Grafana over the SIEM data for a proper SOC-style view.
Planned

Next quest In progress

Next: the rebuild

The lab is being rebuilt from scratch with a narrower purpose: a VPN and network monitoring core, Docker hosting for this site and client sites, and a small self-hosted AI model scoped to handle first-line intake by email without eating the whole machine. Hardware and services will be listed here once it is stable, with numbers rather than adjectives.

Architecture

How this site is built

Next.js, standalone output: App Router, strict TypeScript, Tailwind tokens. The build produces a small Node server that runs in one container.
The level: Plain Canvas 2D with a fixed-timestep loop and no game library. The map is data; the doors come from the same navigation list the header uses.
Content as config: Every word lives in one typed file. Anything unconfirmed is flagged and rendered with an in-progress tag.
Sign-in: Google sign-in implemented directly against OpenID Connect, sessions in an SQLite file on a volume, and the minimum data needed to remember your settings.
Docker: Multi-stage image, non-root user, health endpoint, compose file with reverse-proxy labels ready for the lab.
Proxy, TLS, backups: Reverse proxy in front with automatic certificates, the home connection behind a tunnel, nightly backups of the data volume.

Changelog

2026-09-26Davi, the site assistant: a self-hosted chat helper for questions about the services and for starting an inquiry. Privacy notice, terms and accessibility statement updated to describe it.
2026-09-25Portraits on the Home and About pages, the logo signed off, Privacy and Terms given their own worlds, and the services page reworked: click-to-select roster and a board-game project map.
2026-09-24Progression added to the level, worlds and cutscenes across the site, settings and sign-in, copy rewritten from the resume and lab notebook.
2026-09-23Project started: audit of the WordPress site, plan, design system, landing level and pages.

Next stage

Want this kind of setup for your business?

Hosting, monitoring and backups, run the way the lab is run.

Get in touch