Homelab

Table of Contents

A living reference, not a dated post. The lab exists to keep the hands-on side current: segmentation designed like production, telemetry that actually lands somewhere, and detections written against behavior rather than signatures. This page changes as the build does.

Build Status
#

Host and hypervisor Converting the desktop to a Proxmox host, parts sourced
In progress
Network segmentation Management, services and detonation VLANs with policy between them
Ongoing
Telemetry and detection Log pipeline first, then detection rules mapped to MITRE ATT&CK
Queued

Hardware
#

Proxmox Hypervisor

Host

Ryzen 9 5900X, 12C/24T

64GB DDR4-3200

A repurposed desktop rather than a used enterprise server. Gigabyte B550 AORUS ELITE V2 board, EVGA SuperNOVA G3 1000W supply. Enough cores and memory to run a segmented lab without a second box or a rack in the garage.

Proxmox
KVM
Virtualization

Quad-Port Intel I350

Network

NICGIGA

Four gigabit ports

Four ports means real segmentation instead of everything sharing one interface. Management, services, and the detonation network stay separate at the NIC rather than only in software.

VLANs
Trunking
Segmentation

Out-of-Band Management

Access

Sipeed NanoKVM-PCIe

Remote KVM over IP

Console access that survives the host being unreachable. The point of a lab is breaking things on purpose, which means needing a way back in that does not depend on whatever just broke.

Remote Console
Recovery

1000VA LiFePO4 UPS

Power

GoldenMate

600W output

Lithium iron phosphate rather than sealed lead acid, for the cycle life and the absence of a replacement schedule. Sized for graceful shutdown, not for riding out an outage.

Runtime
Graceful Shutdown

The GPU is still open: an RTX 3080 already on hand against an RTX 3060 12GB for lower idle draw, with local model work and hashcat on the other side of that tradeoff.

Network Design
#

Three segments, with policy between them rather than a flat network and good intentions.

flowchart LR
  WAN((Internet)) --> RTR[Router / Firewall]
  RTR --> MGMT[Management VLAN]
  RTR --> SVC[Services VLAN]
  RTR --> LAB[Lab / Detonation VLAN]
  MGMT --> PVE[Proxmox Host]
  SVC --> PVE
  LAB --> PVE

Management carries the hypervisor and out-of-band access. Services carries the things meant to stay up. The detonation segment is where anything untrusted runs, and it does not get to talk to the other two.

Planned Services
#

The stack the lab is being built to support, and what each piece is there to prove.

Guest	Role	Why it is here
Wazuh	SIEM and endpoint telemetry	Detection engineering against real host data
Grafana + Prometheus	Metrics and dashboards	Observability that predates the incident
OpenVAS / Greenbone	Vulnerability scanning	Assessment, then the harder half: remediation tracking
Ansible	Configuration management	Rebuilds that are repeatable rather than remembered
Documentation wiki	Runbooks and architecture	The artifact that outlives the lab

Still cooking

Resource allocation, backup targets, and the writeups that come out of each milestone are not finished yet. Everything above gets documented as it lands, with sanitized configs and playbooks published alongside on GitHub.

Check the Writeups section for the pieces that are done.

There are no articles to list here yet.

Build Status#

Hardware#