diff --git a/README.md b/README.md index ef8f597..87ecb33 100644 --- a/README.md +++ b/README.md @@ -1,16 +1,78 @@ -# Ced's HomeLab +# 🧠 Ced’s HomeLab (Enterprise Infrastructure & Monitoring Lab) -Ced's HomeLab is my personal mini–datacenter: a segmented, cloud-connected environment built for learning, experimentation, and portfolio work. It includes: +> A production-style infrastructure lab showcasing real-world systems engineering, monitoring, and platform operations. -- Proxmox virtualization -- TrueNAS ZFS storage -- A 12-node Raspberry Pi K3s cluster -- Nginx Proxy Manager + Cloudflare Tunnel -- Home Assistant + IoT integration -- Media stack (Arr suite + Jellyfin) -- Observability (Grafana, Prometheus, Uptime Kuma) +This environment functions as a **personal datacenter**, combining virtualization, Kubernetes orchestration, observability, and secure external access. -This repo is the **documentation and configuration hub** for the entire environment. +--- + +## πŸš€ What This Lab Demonstrates + +- Infrastructure design (Proxmox + virtualized services) +- Kubernetes orchestration (12-node K3s cluster) +- Network segmentation (VLAN architecture) +- Monitoring & observability (Grafana, Prometheus, Uptime Kuma) +- Secure service exposure (Cloudflare Tunnels + reverse proxy) +- Real-world system integration (data, services, automation) + +## πŸ”₯ Featured Project: SOC Lab + +A focused project within this homelab that demonstrates monitoring, logging, and security concepts. + +πŸ‘‰ [View SOC Lab Project](soc-lab/README.md) +--- + +## πŸ—οΈ Architecture Overview + +This lab is built around three core layers: + +### πŸ–₯️ Infrastructure Layer +- Proxmox VE hypervisor +- Virtual Machines + LXC containers +- TrueNAS storage backend (ZFS, NFS, SMB) + +### ☸️ Orchestration Layer +- 12-node K3s Kubernetes cluster +- Workload segmentation (ingress, data, monitoring) +- MetalLB + NGINX ingress + +### 🌐 Access & Networking Layer +- VLAN segmented network (UDR) +- Nginx Proxy Manager +- Cloudflare Tunnel (zero port-forwarding) + +--- + +## 🎯 Purpose + +This lab is designed to: + +- Simulate production-style environments +- Build hands-on infrastructure experience +- Develop monitoring and system visibility skills +- Serve as a real-world engineering portfolio project + +--- + +## πŸ“Έ Key System Views + +### πŸ–₯️ Proxmox Infrastructure +![Proxmox](screenshots/proxmox-overview.png) + +### πŸ–₯️ Proxmox Workloads +![Proxmox](screenshots/proxmox-overview2.png) + +### ☸️ K3s Cluster Nodes & Pods +![K3s Nodes](screenshots/K3s-nodes.png) + +### 🌐 Reverse Proxy (Nginx Proxy Manager) +![Nginx](screenshots/NGN.png) + +### πŸ“Š Service Monitoring (Uptime Kuma) +![Uptime Kuma](screenshots/uptime-kuma.png) + +### πŸ“Š Grafana Dashboard +![Grafana](screenshots/grafana.png) --- @@ -18,12 +80,12 @@ This repo is the **documentation and configuration hub** for the entire environm The lab runs behind a UniFi Dream Router (UDR) with VLAN segmentation: -| Network | Subnet | Purpose | -|--------------|----------------|---------------------------------| -| Main | 10.10.10.0/24 | Daily-use devices | -| MyHomeIOT | 10.10.20.0/24 | IoT devices, TVs, consoles | -| HomeLab | 10.10.30.0/24 | Servers, services, K3s, storage | -| Guest | 10.10.99.0/24 | Guest Wi-Fi | +| Network | Subnet | Purpose | +|--------|--------|--------| +| Main | 10.10.10.0/24 | Daily-use devices | +| MyHomeIOT | 10.10.20.0/24 | IoT devices, TVs, consoles | +| HomeLab | 10.10.30.0/24 | Servers, services, K3s, storage | +| Guest | 10.10.99.0/24 | Guest Wi-Fi | The HomeLab VLAN (10.10.30.0/24) hosts all core infrastructure. @@ -31,79 +93,74 @@ The HomeLab VLAN (10.10.30.0/24) hosts all core infrastructure. ## 🧱 Core Components -### Proxmox VE - +### πŸ–₯️ Proxmox VE - Main hypervisor for VMs and LXCs - Future expansion to a Proxmox cluster (+5 nodes) -- Uses TrueNAS for shared storage (NFS / iSCSI) - -See: [`proxmox/`](proxmox/) +- Uses TrueNAS for shared storage (NFS / iSCSI) +πŸ“ See: `proxmox/` --- -### TrueNAS (ZFS Storage) - +### πŸ’Ύ TrueNAS (ZFS Storage) - Manages ZFS pools and datasets - NFS exports for Proxmox VM storage -- SMB / media dataset for Jellyfin & Arr stack - -See: [`truenas/`](truenas/) +- SMB / media dataset for Jellyfin & Arr stack +πŸ“ See: `truenas/` --- -### K3s Raspberry Pi Cluster +### ☸️ K3s Raspberry Pi Cluster +A 12-node K3s cluster built on Raspberry Pi hardware for orchestrating containerized workloads across the lab. -A 12-node K3s cluster (Raspberry Pis) for running: +Current and planned uses include: -- Containerized apps +- Containerized applications - Ingress-based routing -- GitOps and helm-based workloads (future) +- Monitoring workloads +- Future GitOps and Helm-based deployments -K3s is part of the HomeLab but documented in detail in its own repo: -- https://github.com/ced4568/ced-k3s-homelab - -This repo may reference that cluster and contain high-level config patterns. +πŸ“Œ Full cluster repo: +https://github.com/ced4568/ced-k3s-homelab --- -### Reverse Proxy & Cloudflare Tunnel - -- Nginx Proxy Manager (NPM) on the HomeLab VLAN +### 🌐 Reverse Proxy & Cloudflare Tunnel +- Nginx Proxy Manager (NPM) - Cloudflare Tunnel (no port forwarding) - Wildcard DNS: `*.cedshomelab.com` -External access flow: - -```text +**Traffic Flow:** Internet β†’ Cloudflare Edge β†’ Tunnel β†’ NPM β†’ Internal Services -``` -Docs: [`docs/Add_New_Service_Guide.md`](docs/Add_New_Service_Guide.md) +πŸ“ Docs: `docs/Add_New_Service_Guide.md` --- -### Home Automation +### 🏠 Home Automation +- Home Assistant (Proxmox VM) +- IoT isolated on MyHomeIOT VLAN +- Secure access via Cloudflare + NPM +- `trusted_proxies` configured -- Home Assistant (HA) in Proxmox -- IoT devices isolated on MyHomeIOT VLAN -- HA exposed via Cloudflare + NPM -- `trusted_proxies` configured for NPM - -Config snippets: [`home-assistant/configuration-snippets/`](home-assistant/configuration-snippets/) +πŸ“ Config: `home-assistant/` --- -### Observability +### πŸ“Š Observability (Ced’s NOC) -- Prometheus scrapes metrics from: - - Proxmox - - K3s - - TrueNAS (future) - - Home Assistant / MQTT (future) -- Grafana dashboards, including a **Ced's NOC** view +The lab includes an observability stack built around: + +- Prometheus for metrics collection +- Grafana for dashboards and visualization - Uptime Kuma for service-level monitoring -Notes and dashboards: [`monitoring/`](monitoring/) +Current and planned monitoring coverage includes: +- Proxmox performance +- K3s cluster health +- Service uptime +- Infrastructure visibility improvements over time + +πŸ“ See: `monitoring/` --- @@ -180,45 +237,42 @@ Biggie (10.10.30.192) β€” cron: */5 * * * * ## 🧭 Documentation -- **How to add a new service via NPM + Cloudflare** - [`docs/Add_New_Service_Guide.md`](docs/Add_New_Service_Guide.md) - -- **Architecture diagrams (Mermaid)** - [`docs/Ced_Homelab_Diagrams.md`](docs/Ced_Homelab_Diagrams.md) - -- **Roadmap / future ideas** - [`docs/roadmap.md`](docs/roadmap.md) +- Add new service: `docs/Add_New_Service_Guide.md` +- Architecture diagrams: `docs/Ced_Homelab_Diagrams.md` +- Roadmap: `docs/roadmap.md` --- ## πŸš€ Future Plans - Full Proxmox cluster -- Cloudflare Zero Trust on critical services -- GitOps for K3s deployments (in ced-k3s-homelab) +- Cloudflare Zero Trust integration +- GitOps for K3s deployments - Internal container registry -- K3s-specific wildcard routing (`*.apps.cedshomelab.com`) -- More detailed monitoring + alerting -- Visual portfolio site on: - - `chasedumphord.com` or - - `cedshome.com` +- Advanced monitoring + alerting +- Portfolio site: + - chasedumphord.com + - cedshomelab.com --- -## ⚠️ Secrets & Security +## ⚠️ Security Practices -This repo **never** stores: +This repo never stores: -- API tokens -- Private keys -- Passwords -- Secret YAML files +- API tokens +- Private keys +- Passwords +- Sensitive configs -Any real config with secrets should be kept locally only, or represented here as `*.example` files. +All secrets are handled locally or via `.example` files. --- -## ✨ Author +## πŸ‘€ Author -**Ced (Chase Dumphord)** -Cybersecurity / GRC / SOC β€’ Full-Stack Dev β€’ Homelab builder +**Chase Dumphord** +Digital Systems Engineer | Infrastructure | Data Systems | Automation + +LinkedIn: https://www.linkedin.com/in/toochase-dumphord/ +GitHub: https://github.com/ced4568 diff --git a/docs/Ced_Homelab_Diagrams.md b/docs/Ced_Homelab_Diagrams.md index 97a6c8e..96ddcbd 100644 --- a/docs/Ced_Homelab_Diagrams.md +++ b/docs/Ced_Homelab_Diagrams.md @@ -1,177 +1,129 @@ -# Ced's HomeLab – Network & Cloud Architecture Diagrams +# 🧠 Ced's HomeLab - Architecture & Network Diagrams -This file contains **Mermaid diagrams** for: +This document provides visual representations of the Ced's HomeLab environment, including: -- Cloud & homelab architecture -- VLAN segmentation -- Request flows (Proxmox, Home Assistant) +- 🌐 Cloud and homelab architecture +- 🧩 VLAN segmentation +- πŸ”„ Request flow through Cloudflare, reverse proxy, and internal services -You can view or edit them with: -- Mermaid Live Editor: https://mermaid.live -- Draw.io (Arrange β†’ Insert β†’ Advanced β†’ Mermaid) -- GitHub / Obsidian / VS Code (Mermaid support) +These diagrams explain how infrastructure components interact and how services are exposed. --- -## 1. High-Level Cloud & Homelab Architecture +## πŸ› οΈ Viewing & Editing + +You can view or edit these diagrams using: + +- Mermaid Live Editor: https://mermaid.live +- Draw.io β†’ Arrange β†’ Insert β†’ Advanced β†’ Mermaid +- GitHub / VS Code with Mermaid support + +--- + +## 🌐 1. High-Level Cloud & Homelab Architecture ```mermaid graph TD - subgraph Internet["🌐 Internet"] - User[User Browser] - end + User[User Browser] --> CFDNS[Cloudflare DNS and SSL] + CFDNS --> CFZT[Cloudflare Zero Trust Planned] + CFZT --> CFTUN[Cloudflare Tunnel] + CFTUN --> NPM[Nginx Proxy Manager 10.10.30.210] - subgraph Cloudflare["Cloudflare Edge"] - CF_DNS[DNS & SSL] - CF_ZT[Zero Trust (future)] - end + NPM --> PVE[Proxmox VE Host 10.10.30.250] + NPM --> TRUENAS[TrueNAS Storage 10.10.30.143] + NPM --> HA[Home Assistant 10.10.30.104] + NPM --> GRAF[Grafana] + NPM --> PROM[Prometheus] + NPM --> UPTK[Uptime Kuma] + NPM --> JF[Jellyfin] + NPM --> ARR[Arr Suite] - subgraph Tunnel["Cloudflare Tunnel"] - CF_Tunnel[cloudflared
NPM LXC] - end - - subgraph HomeLab_VLAN["HomeLab VLAN 10.10.30.0/24"] - NPM[Nginx Proxy Manager
10.10.30.210] - PVE[Proxmox VE Host
10.10.30.250] - TRUENAS[TrueNAS & Media
10.10.30.143] - HA[Home Assistant
10.10.30.104] - - subgraph K3S["Raspberry Pi K3s Cluster
12 nodes"] - K3S_M[Masters] - K3S_W[Workers] - end - - subgraph OBS["Observability Stack"] - GRAF[Grafana] - PROM[Prometheus] - UPTK[Uptime Kuma] - end - - subgraph MEDIA["Media & Arr Suite"] - ARR[Sonarr/Radarr/etc.] - JF[Jellyfin] - end - end - - User -->|"https://*.cedshomelab.com"| CF_DNS --> CF_ZT - CF_ZT --> CF_Tunnel --> NPM - - NPM -->|"dashy.cedshomelab.com"| NPM - NPM -->|"pve.cedshomelab.com"| PVE - NPM -->|"truenas.cedshomelab.com"| TRUENAS - NPM -->|"ha.cedshomelab.com"| HA - NPM -->|"jellyfin.cedshomelab.com"| JF - NPM -->|"grafana.cedshomelab.com"| GRAF - NPM -->|"prometheus.cedshomelab.com"| PROM - NPM -->|"uptime.cedshomelab.com"| UPTK - NPM -->|"arr.cedshomelab.com"| ARR - - PVE -.-> OBS - PVE -.-> MEDIA - PVE -.-> K3S + PVE -.-> K3S[K3s Cluster 12 Nodes] + PVE -.-> OBS[Observability Stack] + PVE -.-> MEDIA[Media Services] TRUENAS -. Storage .- PVE TRUENAS -. Media Storage .- JF ``` --- -## 2. VLAN & Network Segmentation Diagram +## 🧩 2. VLAN & Network Segmentation ```mermaid -flowchart LR - subgraph UDR["UniFi Dream Router (UDR)"] - GW_MAIN["VLAN Main 10.10.10.1"] - GW_IOT["VLAN IoT 10.10.20.1"] - GW_LAB["VLAN HomeLab 10.10.30.1"] - GW_GUEST["VLAN Guest 10.10.99.1"] - end +graph TD + UDR[UniFi Dream Router] - subgraph VLAN_MAIN["Main Network 10.10.10.0/24"] - DEV1[Phones / Laptops / PCs] - end + MAIN[Main 10.10.10.0/24] + IOT[MyHomeIOT 10.10.20.0/24] + LAB[HomeLab 10.10.30.0/24] + GUEST[Guest 10.10.99.0/24] - subgraph VLAN_IOT["MyHomeIOT 10.10.20.0/24"] - IOT1[IoT Devices] - TV[Smart TVs / Consoles] - end + DEV[User Devices] + IOTDEV[IoT Devices and TVs] + LABDEV[Servers and Services] + GDEV[Guest Devices] - subgraph VLAN_LAB["Ced's HomeLab 10.10.30.0/24"] - PVE[Proxmox Host(s)] - NPM[Nginx Proxy Manager
+ cloudflared] - TRUENAS[TrueNAS] - HA[Home Assistant] - K3S["K3s Pi Cluster"] - OBS[Grafana / Prometheus / Uptime Kuma] - MEDIA[Arr Suite / Jellyfin] - end + UDR --> MAIN + UDR --> IOT + UDR --> LAB + UDR --> GUEST - subgraph VLAN_GUEST["Guest Network 10.10.99.0/24"] - GUEST_DEV[Guest Devices] - end - - UDR --- VLAN_MAIN - UDR --- VLAN_IOT - UDR --- VLAN_LAB - UDR --- VLAN_GUEST - - VLAN_MAIN -->|Restricted Access| VLAN_LAB - VLAN_IOT -->|HA API Only| HA - VLAN_GUEST -->|Internet Only| UDR - - VLAN_LAB -->|Cloudflare Tunnel
Outbound Only| NPM + MAIN --> DEV + IOT --> IOTDEV + LAB --> LABDEV + GUEST --> GDEV ``` --- -## 3. Request Flow – Proxmox via `pve.cedshomelab.com` +## πŸ”„ 3. Request Flow - Proxmox Access ```mermaid sequenceDiagram - participant User as User Browser - participant CF as Cloudflare Edge - participant Tunnel as cloudflared (NPM LXC) - participant NPM as Nginx Proxy Manager - participant PVE as Proxmox (10.10.30.250:8006) + participant User + participant CF as Cloudflare + participant Tunnel + participant NPM + participant PVE as Proxmox - User->>CF: HTTPS GET pve.cedshomelab.com - CF->>CF: DNS resolve / SSL terminate / (Zero Trust auth) - CF-->>Tunnel: Encrypted Tunnel Connection - Tunnel-->>NPM: HTTP request (Host: pve.cedshomelab.com) - NPM->>PVE: HTTPS to 10.10.30.250:8006
proxy headers - PVE-->>NPM: Proxmox login HTML - NPM-->>Tunnel: Response - Tunnel-->>CF: Encrypted tunnel response - CF-->>User: HTTPS response (Proxmox UI) + User->>CF: HTTPS request for pve.cedshomelab.com + CF->>Tunnel: Encrypted tunnel + Tunnel->>NPM: Forward request + NPM->>PVE: Proxy to port 8006 + PVE-->>NPM: UI response + NPM-->>Tunnel: Return response + Tunnel-->>CF: Return response + CF-->>User: Proxmox UI ``` --- -## 4. Request Flow – Home Assistant via `ha.cedshomelab.com` +## πŸ”„ 4. Request Flow - Home Assistant ```mermaid sequenceDiagram - participant User as User (Phone/Laptop) - participant CF as Cloudflare Edge - participant Tunnel as cloudflared (NPM LXC) - participant NPM as Nginx Proxy Manager - participant HA as Home Assistant (10.10.30.104:8123) + participant User + participant CF as Cloudflare + participant Tunnel + participant NPM + participant HA as Home Assistant - User->>CF: HTTPS GET ha.cedshomelab.com - CF->>CF: DNS / SSL / (Zero Trust future) - CF-->>Tunnel: Encrypted tunnel connection - Tunnel-->>NPM: HTTP request with X-Forwarded-For - NPM->>HA: HTTP to 10.10.30.104:8123 - HA->>HA: Check trusted_proxies & use_x_forwarded_for - HA-->>NPM: HA UI / API response - NPM-->>Tunnel: Response - Tunnel-->>CF: Response - CF-->>User: HTTPS response (HA UI) + User->>CF: HTTPS request for ha.cedshomelab.com + CF->>Tunnel: Encrypted tunnel + Tunnel->>NPM: Forward request + NPM->>HA: Proxy to port 8123 + HA-->>NPM: UI or API response + NPM-->>Tunnel: Return response + Tunnel-->>CF: Return response + CF-->>User: Home Assistant UI ``` --- -## 5. Notes +## 🧠 Notes -- Cloudflare Zero Trust can be layered in front of any critical service. -- External entrypoint is always `*.cedshomelab.com`. -- Only outbound traffic from the HomeLab VLAN is required. +- 🌐 All external access is routed through Cloudflare Tunnel +- 🚫 No inbound port forwarding is required +- πŸ”— Services are exposed via subdomains under `cedshomelab.com` +- 🧩 VLAN segmentation reduces unnecessary lateral movement +- πŸ” Cloudflare Zero Trust can be layered on sensitive services diff --git a/screenshots/K3s-nodes.png b/screenshots/K3s-nodes.png new file mode 100644 index 0000000..12da401 Binary files /dev/null and b/screenshots/K3s-nodes.png differ diff --git a/screenshots/NGN.png b/screenshots/NGN.png new file mode 100644 index 0000000..d6a41d2 Binary files /dev/null and b/screenshots/NGN.png differ diff --git a/screenshots/proxmox-overview.png b/screenshots/proxmox-overview.png new file mode 100644 index 0000000..d976764 Binary files /dev/null and b/screenshots/proxmox-overview.png differ diff --git a/screenshots/proxmox-overview2.png b/screenshots/proxmox-overview2.png new file mode 100644 index 0000000..1014fe5 Binary files /dev/null and b/screenshots/proxmox-overview2.png differ diff --git a/screenshots/uptime-kuma.png b/screenshots/uptime-kuma.png new file mode 100644 index 0000000..fd01f9b Binary files /dev/null and b/screenshots/uptime-kuma.png differ diff --git a/soc-lab/README.md b/soc-lab/README.md new file mode 100644 index 0000000..53c0a69 --- /dev/null +++ b/soc-lab/README.md @@ -0,0 +1,117 @@ +# 🧠 SOC Lab – Monitoring, Logging & Security Simulation + +## πŸš€ Overview + +This SOC Lab is a focused project within my homelab environment designed to simulate real-world monitoring, logging, and basic security detection workflows. + +The goal is to replicate how modern infrastructure teams observe system behavior, detect anomalies, and maintain service reliability. + +--- + +## πŸ–₯️ Infrastructure Backbone + +* Proxmox VE (virtualization platform) +* Virtual Machines and LXC containers +* Segmented network environment (VLANs) + +![Proxmox](../screenshots/proxmox-overview.png) + +--- + +## ☸️ Kubernetes Environment + +* 12-node K3s cluster (Raspberry Pi) +* Control plane + worker node architecture +* Workload segmentation: + + * ingress + * data + * monitoring + +```bash +kubectl get nodes -o wide +kubectl get pods -A +``` + +![K3s](../screenshots/K3s-nodes.png) + +--- + +## 🌐 Traffic & Service Routing + +* Nginx Proxy Manager (reverse proxy) +* Cloudflare Tunnel (secure external access) +* Subdomain-based service exposure + +![Nginx](../screenshots/NGN.png) + +--- + +## πŸ“Š Monitoring & Observability + +* Prometheus (metrics collection) +* Grafana (dashboard visualization) +* Uptime Kuma (service monitoring) + +### Key Capabilities: + +* System performance tracking +* Service uptime monitoring +* Infrastructure visibility + +![Uptime Kuma](../screenshots/uptime-kuma.png) + +--- + +## πŸ” Security Layer (In Progress) + +* CrowdSec (intrusion detection & prevention) +* Basic firewall and access control concepts +* Monitoring suspicious traffic patterns + +--- + +## πŸ“œ Logging Pipeline (Planned) + +* Grafana Loki (log aggregation) +* Centralized log visibility +* Correlation between logs and system activity + +--- + +## βš”οΈ Attack Simulation (Planned) + +To validate monitoring and logging systems, the following simulations are planned: + +* Network scanning (nmap) +* Failed authentication attempts +* Traffic pattern analysis + +```bash +nmap -A +``` + +--- + +## πŸ§ͺ Skills Demonstrated + +* Infrastructure design and deployment +* Kubernetes cluster management +* Monitoring and observability implementation +* Reverse proxy and traffic routing +* System-level thinking and troubleshooting + +--- + +## 🎯 Future Enhancements + +* Full logging pipeline (Loki integration) +* Alerting (Grafana alerts) +* Security event tracking +* Automated deployments (CI/CD) + +--- + +## πŸ’‘ Key Takeaway + +This lab demonstrates the ability to design, build, and operate a distributed system with monitoring and observability, reflecting real-world infrastructure and platform engineering practices.