Infrastructure & Security Overview
The lab does not sit on a flat consumer network. The edge is an enterprise-grade UniFi Network ecosystem handling routing, firewalling and wireless, so segmentation and policy are enforced in one place rather than bolted on per host. Everything below is the standing posture — defaults are deny, exceptions are deliberate.
Environment Overview
Why UniFi: one controller means firewall rules, VLANs and wireless policy stay consistent and auditable instead of drifting across three different boxes.
Perimeter & Zero-Trust Ingress
- Zero exposed public WAN ports — no port forwards, no management plane facing the internet.
- Remote administration via encrypted WireGuard mesh (UniFi Teleport) only; there is no password-reachable admin path from outside.
- Ingress hardened with TLS 1.3 and a permanent HTTP→HTTPS redirect, so anything that is published is published encrypted.
Why: if the management surface is never routable from the internet, the entire class of "exposed admin panel" attacks stops being relevant.
Network Segmentation & Firewall
- Multi-tier VLAN segmentation enforced at the UniFi gateway rather than trusted to the endpoints.
- Strict stateful firewall policies isolating untrusted/IoT clients, the guest network, lab compute and core infrastructure from one another.
- Inter-VLAN traffic is denied by default — lab boxes cannot reach management, IoT cannot reach either.
Why it matters: the lab exists to be broken. Segmentation is what keeps a compromised experiment from becoming a compromised network.
DNS Filtering & Hygiene
- Network-wide DNS sinkholing with AdGuard Home alongside UniFi DNS Shield.
- Encrypted upstream transport (DoH / DoT) so resolution is not readable or rewritable in transit.
- UniFi Ad Blocker runs as a second, independent layer at the gateway, so filtering does not depend on a single resolver staying up.
- Tracking, telemetry and known-malicious domains are dropped before they resolve, for every client on the network.
Why: blocking at resolution covers devices that will never accept an agent or a browser extension — which is most of the IoT estate.
Host-Level Defense
PermitRootLogin no Password auth: disabled Why: credential stuffing and brute force need a password to chew on. There isn't one. Automated patching closes the window on known CVEs without waiting for me to notice.
Application Layer
- This site is a static Astro build — pre-rendered HTML and assets, served as files.
- No dynamic database, no server-side PHP or SQL, so there is no injection surface, no admin login and no CMS to keep patched.
Why static: the most reliable way to secure an application layer is to not run one.
Architecture only — no addressing, topology detail, hardware identifiers or version information is published here by design. See also: homelab_projects/.