Projects

Home lab work, security-focused build notes, and lessons learned from planning and maintaining small systems with care.

Completed

Containerized Home Services Hardening

Built and hardened a containerized home services stack with isolated application roles, controlled outbound network paths, and automated backups. The goal was to keep the system useful while reducing the chance that one misconfigured component could affect the rest of the environment.

Docker VPN egress Pinned images Backups

What I Built

The stack uses separate Docker containers for distinct application roles, supporting services, and controlled network egress. Persistent data is separated from replaceable containers so maintenance, updates, and recovery can be handled more predictably.

Security Focus

I treated the build like a small segmentation project: separate services by function, limit unnecessary reachability, and make failure behavior matter. Selected outbound traffic is attached to a VPN container network namespace so it cannot silently fall back to the default WAN route if the VPN path fails.

Operational Work

The project included dependency planning, persistent data handling, service ordering, digest-pinned container updates, and automated backups for the configuration and state that would matter during recovery. Container updates are handled by recreating services from recorded image digests, then validating the running image IDs against the pinned digest image IDs.

Validation & Backup Testing

Confirmed daily age-encrypted local configuration backups, weekly age-encrypted offsite configuration backups through rclone crypt, and weekly full Docker backups to object storage with Object Lock Compliance retention. The server stores only the public age recipient key, allowing it to encrypt backups without being able to decrypt them if the host is compromised.

Key separation The server stores only the public recipient key. The private decryption key is kept separately outside the environment.
Layered config backups Configuration backups are encrypted with age before local retention or remote sync, with remote copies additionally protected through rclone crypt.
Full backup retention Full Docker backups are age-encrypted before upload to object storage protected by Object Lock Compliance retention.
Plaintext cleanup Backup scripts remove temporary plaintext archives after encryption and include cleanup handling for failed runs.
Project report

Containerized Home Services Hardening

Overview

This project started as an availability and operational-control problem. The original workflow ran from a personal workstation and depended on manual steps: starting a VPN, launching applications, maintaining libraries, watching behavior, and shutting everything down at night.

The updated design moved that workflow into a dedicated NAS and Docker environment. The focus was not simply hosting the same services somewhere else. The goal was to make the environment more resilient, easier to maintain, safer to recover, and less dependent on a user being present to keep it running.

Goals

Reduce manual work

Move from a workstation-bound process to an always-on service model that could run predictably without daily manual startup and shutdown.

Control failure behavior

Make selected outbound traffic depend on the intended VPN path instead of silently falling back to the default residential WAN route.

Improve recovery

Separate persistent data from disposable containers, encrypt backups before storage or upload, and document a clearer recovery path.

Sanitized Architecture

A high-level view of the traffic path without publishing hostnames, IP addresses, paths, account details, bucket names, or scripts.

Security Decisions

  • Controlled egress: The VPN-bound service path is attached to the Gluetun VPN container network namespace so it should fail closed instead of quietly using the normal WAN route.
  • Digest-pinned updates: Containers are recreated from explicit image digests, running image IDs are checked against pinned digest image IDs, and the digest inventory is updated after validation.
  • Separated backup keys: The NAS stores only the public age recipient key. It can encrypt backups, but it does not hold the private decryption key needed to read them later.

Validation

  • VPN egress: Checked external IP behavior from inside the VPN-bound container path and confirmed it differed from the residential WAN IP.
  • Failure behavior: Interrupted or simulated loss of the VPN path and confirmed the dependent path did not silently fall back to the default WAN route.
  • Health and watchdog logic: Added checks so dependent service behavior is tied to VPN container health instead of blind restarts.
  • Backup handling: Confirmed local encrypted backup creation, offsite encrypted upload, retention settings, cleanup behavior, and scheduled-job logs.

Backup Flow

The environment creates daily age-encrypted local configuration backups, weekly age-encrypted offsite configuration backups to Google Drive through rclone crypt, and weekly full Docker backups to Backblaze B2 with Object Lock Compliance retention.

What Got Tricky

Dependency behavior

Selected outbound traffic needed to depend on the VPN path in a way that made failure obvious and safe.

Backup cleanup

Backup scripts needed cleanup handling so failed runs would not leave temporary plaintext archives behind.

Update proof

Moving away from mutable tags required a repeatable process for recording digests and checking running image IDs after recreation.

Lessons and Next Improvements

  • Backups are only part of recovery. A future improvement is to perform periodic restore drills to a separate test environment.
  • Failure behavior matters. A system can look functional while still failing open in an unsafe way.
  • Digest-pinned updates add friction, but they make the environment easier to audit and reason about.
  • Next improvements include failed-backup alerting, cleaner runbooks, stronger network segmentation, and more infrastructure-as-code documentation.

Next Builds

Planned

Segmented Virtual Lab Network

Reset and configure a managed switch, build VLAN-backed lab segments, and run a small virtualized environment with Windows endpoints, Windows servers, Linux hosts, and a pfSense firewall until dedicated firewall hardware is added.

VLANsVMwarepfSense
Planned

Isolated Malware Analysis Environment

Design a detonation and analysis environment that is isolated from both the home network and the broader lab. The goal is to support safe malware-analysis practice and eventually align the setup with TCM Security's PMRP path.

IsolationMalware analysisPMRP
Planned

Digital Forensics Practice Lab

Build repeatable forensic practice cases around evidence handling, disk images, artifact review, timeline development, and reporting. This will support future EnCase certification work without publishing case data or sensitive images.

DFIREvidence handlingEnCase