Projects

Home lab work, security-focused build notes, and lessons learned from planning and maintaining small systems with care.

Completed

Containerized Home Services Hardening

Built and hardened a containerized home services stack with isolated application roles, controlled outbound network paths, and automated backups. The goal was to keep the system useful while reducing the chance that one misconfigured component could affect the rest of the environment.

Docker VPN egress Pinned images Backups

What I Built

The stack uses separate Docker containers for distinct application roles, supporting services, and controlled network egress. Persistent data is separated from replaceable containers so maintenance, updates, and recovery can be handled more predictably.

Security Focus

I treated the build like a small segmentation project: separate services by function, limit unnecessary reachability, and make failure behavior matter. Selected outbound traffic is attached to a VPN container network namespace so it cannot silently fall back to the default WAN route if the VPN path fails.

Operational Work

The project included dependency planning, persistent data handling, service ordering, digest-pinned container updates, and automated backups for the configuration and state that would matter during recovery. Container updates are handled by recreating services from recorded image digests, then validating the running image IDs against the pinned digest image IDs.

Validation & Backup Testing

Confirmed daily age-encrypted local configuration backups, weekly age-encrypted offsite configuration backups through rclone crypt, and weekly full Docker backups to object storage with Object Lock Compliance retention. The server stores only the public age recipient key, allowing it to encrypt backups without being able to decrypt them if the host is compromised.

Key separation The server stores only the public recipient key. The private decryption key is kept separately outside the environment.
Layered config backups Configuration backups are encrypted with age before local retention or remote sync, with remote copies additionally protected through rclone crypt.
Full backup retention Full Docker backups are age-encrypted before upload to object storage protected by Object Lock Compliance retention.
Plaintext cleanup Backup scripts remove temporary plaintext archives after encryption and include cleanup handling for failed runs.

Next Builds

Planned

Segmented Virtual Lab Network

Reset and configure a managed switch, build VLAN-backed lab segments, and run a small virtualized environment with Windows endpoints, Windows servers, Linux hosts, and a pfSense firewall until dedicated firewall hardware is added.

VLANsVMwarepfSense
Planned

Isolated Malware Analysis Environment

Design a detonation and analysis environment that is isolated from both the home network and the broader lab. The goal is to support safe malware-analysis practice and eventually align the setup with TCM Security's PMRP path.

IsolationMalware analysisPMRP
Planned

Digital Forensics Practice Lab

Build repeatable forensic practice cases around evidence handling, disk images, artifact review, timeline development, and reporting. This will support future EnCase certification work without publishing case data or sensitive images.

DFIREvidence handlingEnCase