mirror of
https://github.com/ced4568/ceds-homelab.git
synced 2026-08-13 04:04:01 +00:00
Merge branch 'main' of https://github.com/ced4568/ceds-homelab
This commit is contained in:
@@ -1,16 +1,78 @@
|
|||||||
# Ced's HomeLab
|
# 🧠 Ced’s HomeLab (Enterprise Infrastructure & Monitoring Lab)
|
||||||
|
|
||||||
Ced's HomeLab is my personal mini–datacenter: a segmented, cloud-connected environment built for learning, experimentation, and portfolio work. It includes:
|
> A production-style infrastructure lab showcasing real-world systems engineering, monitoring, and platform operations.
|
||||||
|
|
||||||
- Proxmox virtualization
|
This environment functions as a **personal datacenter**, combining virtualization, Kubernetes orchestration, observability, and secure external access.
|
||||||
- TrueNAS ZFS storage
|
|
||||||
- A 12-node Raspberry Pi K3s cluster
|
|
||||||
- Nginx Proxy Manager + Cloudflare Tunnel
|
|
||||||
- Home Assistant + IoT integration
|
|
||||||
- Media stack (Arr suite + Jellyfin)
|
|
||||||
- Observability (Grafana, Prometheus, Uptime Kuma)
|
|
||||||
|
|
||||||
This repo is the **documentation and configuration hub** for the entire environment.
|
---
|
||||||
|
|
||||||
|
## 🚀 What This Lab Demonstrates
|
||||||
|
|
||||||
|
- Infrastructure design (Proxmox + virtualized services)
|
||||||
|
- Kubernetes orchestration (12-node K3s cluster)
|
||||||
|
- Network segmentation (VLAN architecture)
|
||||||
|
- Monitoring & observability (Grafana, Prometheus, Uptime Kuma)
|
||||||
|
- Secure service exposure (Cloudflare Tunnels + reverse proxy)
|
||||||
|
- Real-world system integration (data, services, automation)
|
||||||
|
|
||||||
|
## 🔥 Featured Project: SOC Lab
|
||||||
|
|
||||||
|
A focused project within this homelab that demonstrates monitoring, logging, and security concepts.
|
||||||
|
|
||||||
|
👉 [View SOC Lab Project](soc-lab/README.md)
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🏗️ Architecture Overview
|
||||||
|
|
||||||
|
This lab is built around three core layers:
|
||||||
|
|
||||||
|
### 🖥️ Infrastructure Layer
|
||||||
|
- Proxmox VE hypervisor
|
||||||
|
- Virtual Machines + LXC containers
|
||||||
|
- TrueNAS storage backend (ZFS, NFS, SMB)
|
||||||
|
|
||||||
|
### ☸️ Orchestration Layer
|
||||||
|
- 12-node K3s Kubernetes cluster
|
||||||
|
- Workload segmentation (ingress, data, monitoring)
|
||||||
|
- MetalLB + NGINX ingress
|
||||||
|
|
||||||
|
### 🌐 Access & Networking Layer
|
||||||
|
- VLAN segmented network (UDR)
|
||||||
|
- Nginx Proxy Manager
|
||||||
|
- Cloudflare Tunnel (zero port-forwarding)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🎯 Purpose
|
||||||
|
|
||||||
|
This lab is designed to:
|
||||||
|
|
||||||
|
- Simulate production-style environments
|
||||||
|
- Build hands-on infrastructure experience
|
||||||
|
- Develop monitoring and system visibility skills
|
||||||
|
- Serve as a real-world engineering portfolio project
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📸 Key System Views
|
||||||
|
|
||||||
|
### 🖥️ Proxmox Infrastructure
|
||||||
|
|
||||||
|
|
||||||
|
### 🖥️ Proxmox Workloads
|
||||||
|
|
||||||
|
|
||||||
|
### ☸️ K3s Cluster Nodes & Pods
|
||||||
|
|
||||||
|
|
||||||
|
### 🌐 Reverse Proxy (Nginx Proxy Manager)
|
||||||
|
|
||||||
|
|
||||||
|
### 📊 Service Monitoring (Uptime Kuma)
|
||||||
|
|
||||||
|
|
||||||
|
### 📊 Grafana Dashboard
|
||||||
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
@@ -18,12 +80,12 @@ This repo is the **documentation and configuration hub** for the entire environm
|
|||||||
|
|
||||||
The lab runs behind a UniFi Dream Router (UDR) with VLAN segmentation:
|
The lab runs behind a UniFi Dream Router (UDR) with VLAN segmentation:
|
||||||
|
|
||||||
| Network | Subnet | Purpose |
|
| Network | Subnet | Purpose |
|
||||||
|--------------|----------------|---------------------------------|
|
|--------|--------|--------|
|
||||||
| Main | 10.10.10.0/24 | Daily-use devices |
|
| Main | 10.10.10.0/24 | Daily-use devices |
|
||||||
| MyHomeIOT | 10.10.20.0/24 | IoT devices, TVs, consoles |
|
| MyHomeIOT | 10.10.20.0/24 | IoT devices, TVs, consoles |
|
||||||
| HomeLab | 10.10.30.0/24 | Servers, services, K3s, storage |
|
| HomeLab | 10.10.30.0/24 | Servers, services, K3s, storage |
|
||||||
| Guest | 10.10.99.0/24 | Guest Wi-Fi |
|
| Guest | 10.10.99.0/24 | Guest Wi-Fi |
|
||||||
|
|
||||||
The HomeLab VLAN (10.10.30.0/24) hosts all core infrastructure.
|
The HomeLab VLAN (10.10.30.0/24) hosts all core infrastructure.
|
||||||
|
|
||||||
@@ -31,79 +93,74 @@ The HomeLab VLAN (10.10.30.0/24) hosts all core infrastructure.
|
|||||||
|
|
||||||
## 🧱 Core Components
|
## 🧱 Core Components
|
||||||
|
|
||||||
### Proxmox VE
|
### 🖥️ Proxmox VE
|
||||||
|
|
||||||
- Main hypervisor for VMs and LXCs
|
- Main hypervisor for VMs and LXCs
|
||||||
- Future expansion to a Proxmox cluster (+5 nodes)
|
- Future expansion to a Proxmox cluster (+5 nodes)
|
||||||
- Uses TrueNAS for shared storage (NFS / iSCSI)
|
- Uses TrueNAS for shared storage (NFS / iSCSI)
|
||||||
|
📁 See: `proxmox/`
|
||||||
See: [`proxmox/`](proxmox/)
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
### TrueNAS (ZFS Storage)
|
### 💾 TrueNAS (ZFS Storage)
|
||||||
|
|
||||||
- Manages ZFS pools and datasets
|
- Manages ZFS pools and datasets
|
||||||
- NFS exports for Proxmox VM storage
|
- NFS exports for Proxmox VM storage
|
||||||
- SMB / media dataset for Jellyfin & Arr stack
|
- SMB / media dataset for Jellyfin & Arr stack
|
||||||
|
📁 See: `truenas/`
|
||||||
See: [`truenas/`](truenas/)
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
### K3s Raspberry Pi Cluster
|
### ☸️ K3s Raspberry Pi Cluster
|
||||||
|
A 12-node K3s cluster built on Raspberry Pi hardware for orchestrating containerized workloads across the lab.
|
||||||
|
|
||||||
A 12-node K3s cluster (Raspberry Pis) for running:
|
Current and planned uses include:
|
||||||
|
|
||||||
- Containerized apps
|
- Containerized applications
|
||||||
- Ingress-based routing
|
- Ingress-based routing
|
||||||
- GitOps and helm-based workloads (future)
|
- Monitoring workloads
|
||||||
|
- Future GitOps and Helm-based deployments
|
||||||
|
|
||||||
K3s is part of the HomeLab but documented in detail in its own repo:
|
📌 Full cluster repo:
|
||||||
- https://github.com/ced4568/ced-k3s-homelab
|
https://github.com/ced4568/ced-k3s-homelab
|
||||||
|
|
||||||
This repo may reference that cluster and contain high-level config patterns.
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
### Reverse Proxy & Cloudflare Tunnel
|
### 🌐 Reverse Proxy & Cloudflare Tunnel
|
||||||
|
- Nginx Proxy Manager (NPM)
|
||||||
- Nginx Proxy Manager (NPM) on the HomeLab VLAN
|
|
||||||
- Cloudflare Tunnel (no port forwarding)
|
- Cloudflare Tunnel (no port forwarding)
|
||||||
- Wildcard DNS: `*.cedshomelab.com`
|
- Wildcard DNS: `*.cedshomelab.com`
|
||||||
|
|
||||||
External access flow:
|
**Traffic Flow:**
|
||||||
|
|
||||||
```text
|
|
||||||
Internet → Cloudflare Edge → Tunnel → NPM → Internal Services
|
Internet → Cloudflare Edge → Tunnel → NPM → Internal Services
|
||||||
```
|
|
||||||
|
|
||||||
Docs: [`docs/Add_New_Service_Guide.md`](docs/Add_New_Service_Guide.md)
|
📁 Docs: `docs/Add_New_Service_Guide.md`
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
### Home Automation
|
### 🏠 Home Automation
|
||||||
|
- Home Assistant (Proxmox VM)
|
||||||
|
- IoT isolated on MyHomeIOT VLAN
|
||||||
|
- Secure access via Cloudflare + NPM
|
||||||
|
- `trusted_proxies` configured
|
||||||
|
|
||||||
- Home Assistant (HA) in Proxmox
|
📁 Config: `home-assistant/`
|
||||||
- IoT devices isolated on MyHomeIOT VLAN
|
|
||||||
- HA exposed via Cloudflare + NPM
|
|
||||||
- `trusted_proxies` configured for NPM
|
|
||||||
|
|
||||||
Config snippets: [`home-assistant/configuration-snippets/`](home-assistant/configuration-snippets/)
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
### Observability
|
### 📊 Observability (Ced’s NOC)
|
||||||
|
|
||||||
- Prometheus scrapes metrics from:
|
The lab includes an observability stack built around:
|
||||||
- Proxmox
|
|
||||||
- K3s
|
- Prometheus for metrics collection
|
||||||
- TrueNAS (future)
|
- Grafana for dashboards and visualization
|
||||||
- Home Assistant / MQTT (future)
|
|
||||||
- Grafana dashboards, including a **Ced's NOC** view
|
|
||||||
- Uptime Kuma for service-level monitoring
|
- Uptime Kuma for service-level monitoring
|
||||||
|
|
||||||
Notes and dashboards: [`monitoring/`](monitoring/)
|
Current and planned monitoring coverage includes:
|
||||||
|
- Proxmox performance
|
||||||
|
- K3s cluster health
|
||||||
|
- Service uptime
|
||||||
|
- Infrastructure visibility improvements over time
|
||||||
|
|
||||||
|
📁 See: `monitoring/`
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
@@ -180,45 +237,42 @@ Biggie (10.10.30.192) — cron: */5 * * * *
|
|||||||
|
|
||||||
## 🧭 Documentation
|
## 🧭 Documentation
|
||||||
|
|
||||||
- **How to add a new service via NPM + Cloudflare**
|
- Add new service: `docs/Add_New_Service_Guide.md`
|
||||||
[`docs/Add_New_Service_Guide.md`](docs/Add_New_Service_Guide.md)
|
- Architecture diagrams: `docs/Ced_Homelab_Diagrams.md`
|
||||||
|
- Roadmap: `docs/roadmap.md`
|
||||||
- **Architecture diagrams (Mermaid)**
|
|
||||||
[`docs/Ced_Homelab_Diagrams.md`](docs/Ced_Homelab_Diagrams.md)
|
|
||||||
|
|
||||||
- **Roadmap / future ideas**
|
|
||||||
[`docs/roadmap.md`](docs/roadmap.md)
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 🚀 Future Plans
|
## 🚀 Future Plans
|
||||||
|
|
||||||
- Full Proxmox cluster
|
- Full Proxmox cluster
|
||||||
- Cloudflare Zero Trust on critical services
|
- Cloudflare Zero Trust integration
|
||||||
- GitOps for K3s deployments (in ced-k3s-homelab)
|
- GitOps for K3s deployments
|
||||||
- Internal container registry
|
- Internal container registry
|
||||||
- K3s-specific wildcard routing (`*.apps.cedshomelab.com`)
|
- Advanced monitoring + alerting
|
||||||
- More detailed monitoring + alerting
|
- Portfolio site:
|
||||||
- Visual portfolio site on:
|
- chasedumphord.com
|
||||||
- `chasedumphord.com` or
|
- cedshomelab.com
|
||||||
- `cedshome.com`
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## ⚠️ Secrets & Security
|
## ⚠️ Security Practices
|
||||||
|
|
||||||
This repo **never** stores:
|
This repo never stores:
|
||||||
|
|
||||||
- API tokens
|
- API tokens
|
||||||
- Private keys
|
- Private keys
|
||||||
- Passwords
|
- Passwords
|
||||||
- Secret YAML files
|
- Sensitive configs
|
||||||
|
|
||||||
Any real config with secrets should be kept locally only, or represented here as `*.example` files.
|
All secrets are handled locally or via `.example` files.
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## ✨ Author
|
## 👤 Author
|
||||||
|
|
||||||
**Ced (Chase Dumphord)**
|
**Chase Dumphord**
|
||||||
Cybersecurity / GRC / SOC • Full-Stack Dev • Homelab builder
|
Digital Systems Engineer | Infrastructure | Data Systems | Automation
|
||||||
|
|
||||||
|
LinkedIn: https://www.linkedin.com/in/toochase-dumphord/
|
||||||
|
GitHub: https://github.com/ced4568
|
||||||
|
|||||||
+85
-133
@@ -1,177 +1,129 @@
|
|||||||
# Ced's HomeLab – Network & Cloud Architecture Diagrams
|
# 🧠 Ced's HomeLab - Architecture & Network Diagrams
|
||||||
|
|
||||||
This file contains **Mermaid diagrams** for:
|
This document provides visual representations of the Ced's HomeLab environment, including:
|
||||||
|
|
||||||
- Cloud & homelab architecture
|
- 🌐 Cloud and homelab architecture
|
||||||
- VLAN segmentation
|
- 🧩 VLAN segmentation
|
||||||
- Request flows (Proxmox, Home Assistant)
|
- 🔄 Request flow through Cloudflare, reverse proxy, and internal services
|
||||||
|
|
||||||
You can view or edit them with:
|
These diagrams explain how infrastructure components interact and how services are exposed.
|
||||||
- Mermaid Live Editor: https://mermaid.live
|
|
||||||
- Draw.io (Arrange → Insert → Advanced → Mermaid)
|
|
||||||
- GitHub / Obsidian / VS Code (Mermaid support)
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 1. High-Level Cloud & Homelab Architecture
|
## 🛠️ Viewing & Editing
|
||||||
|
|
||||||
|
You can view or edit these diagrams using:
|
||||||
|
|
||||||
|
- Mermaid Live Editor: https://mermaid.live
|
||||||
|
- Draw.io → Arrange → Insert → Advanced → Mermaid
|
||||||
|
- GitHub / VS Code with Mermaid support
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🌐 1. High-Level Cloud & Homelab Architecture
|
||||||
|
|
||||||
```mermaid
|
```mermaid
|
||||||
graph TD
|
graph TD
|
||||||
subgraph Internet["🌐 Internet"]
|
User[User Browser] --> CFDNS[Cloudflare DNS and SSL]
|
||||||
User[User Browser]
|
CFDNS --> CFZT[Cloudflare Zero Trust Planned]
|
||||||
end
|
CFZT --> CFTUN[Cloudflare Tunnel]
|
||||||
|
CFTUN --> NPM[Nginx Proxy Manager 10.10.30.210]
|
||||||
|
|
||||||
subgraph Cloudflare["Cloudflare Edge"]
|
NPM --> PVE[Proxmox VE Host 10.10.30.250]
|
||||||
CF_DNS[DNS & SSL]
|
NPM --> TRUENAS[TrueNAS Storage 10.10.30.143]
|
||||||
CF_ZT[Zero Trust (future)]
|
NPM --> HA[Home Assistant 10.10.30.104]
|
||||||
end
|
NPM --> GRAF[Grafana]
|
||||||
|
NPM --> PROM[Prometheus]
|
||||||
|
NPM --> UPTK[Uptime Kuma]
|
||||||
|
NPM --> JF[Jellyfin]
|
||||||
|
NPM --> ARR[Arr Suite]
|
||||||
|
|
||||||
subgraph Tunnel["Cloudflare Tunnel"]
|
PVE -.-> K3S[K3s Cluster 12 Nodes]
|
||||||
CF_Tunnel[cloudflared<br/>NPM LXC]
|
PVE -.-> OBS[Observability Stack]
|
||||||
end
|
PVE -.-> MEDIA[Media Services]
|
||||||
|
|
||||||
subgraph HomeLab_VLAN["HomeLab VLAN 10.10.30.0/24"]
|
|
||||||
NPM[Nginx Proxy Manager<br/>10.10.30.210]
|
|
||||||
PVE[Proxmox VE Host<br/>10.10.30.250]
|
|
||||||
TRUENAS[TrueNAS & Media<br/>10.10.30.143]
|
|
||||||
HA[Home Assistant<br/>10.10.30.104]
|
|
||||||
|
|
||||||
subgraph K3S["Raspberry Pi K3s Cluster<br/>12 nodes"]
|
|
||||||
K3S_M[Masters]
|
|
||||||
K3S_W[Workers]
|
|
||||||
end
|
|
||||||
|
|
||||||
subgraph OBS["Observability Stack"]
|
|
||||||
GRAF[Grafana]
|
|
||||||
PROM[Prometheus]
|
|
||||||
UPTK[Uptime Kuma]
|
|
||||||
end
|
|
||||||
|
|
||||||
subgraph MEDIA["Media & Arr Suite"]
|
|
||||||
ARR[Sonarr/Radarr/etc.]
|
|
||||||
JF[Jellyfin]
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
User -->|"https://*.cedshomelab.com"| CF_DNS --> CF_ZT
|
|
||||||
CF_ZT --> CF_Tunnel --> NPM
|
|
||||||
|
|
||||||
NPM -->|"dashy.cedshomelab.com"| NPM
|
|
||||||
NPM -->|"pve.cedshomelab.com"| PVE
|
|
||||||
NPM -->|"truenas.cedshomelab.com"| TRUENAS
|
|
||||||
NPM -->|"ha.cedshomelab.com"| HA
|
|
||||||
NPM -->|"jellyfin.cedshomelab.com"| JF
|
|
||||||
NPM -->|"grafana.cedshomelab.com"| GRAF
|
|
||||||
NPM -->|"prometheus.cedshomelab.com"| PROM
|
|
||||||
NPM -->|"uptime.cedshomelab.com"| UPTK
|
|
||||||
NPM -->|"arr.cedshomelab.com"| ARR
|
|
||||||
|
|
||||||
PVE -.-> OBS
|
|
||||||
PVE -.-> MEDIA
|
|
||||||
PVE -.-> K3S
|
|
||||||
TRUENAS -. Storage .- PVE
|
TRUENAS -. Storage .- PVE
|
||||||
TRUENAS -. Media Storage .- JF
|
TRUENAS -. Media Storage .- JF
|
||||||
```
|
```
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 2. VLAN & Network Segmentation Diagram
|
## 🧩 2. VLAN & Network Segmentation
|
||||||
|
|
||||||
```mermaid
|
```mermaid
|
||||||
flowchart LR
|
graph TD
|
||||||
subgraph UDR["UniFi Dream Router (UDR)"]
|
UDR[UniFi Dream Router]
|
||||||
GW_MAIN["VLAN Main 10.10.10.1"]
|
|
||||||
GW_IOT["VLAN IoT 10.10.20.1"]
|
|
||||||
GW_LAB["VLAN HomeLab 10.10.30.1"]
|
|
||||||
GW_GUEST["VLAN Guest 10.10.99.1"]
|
|
||||||
end
|
|
||||||
|
|
||||||
subgraph VLAN_MAIN["Main Network 10.10.10.0/24"]
|
MAIN[Main 10.10.10.0/24]
|
||||||
DEV1[Phones / Laptops / PCs]
|
IOT[MyHomeIOT 10.10.20.0/24]
|
||||||
end
|
LAB[HomeLab 10.10.30.0/24]
|
||||||
|
GUEST[Guest 10.10.99.0/24]
|
||||||
|
|
||||||
subgraph VLAN_IOT["MyHomeIOT 10.10.20.0/24"]
|
DEV[User Devices]
|
||||||
IOT1[IoT Devices]
|
IOTDEV[IoT Devices and TVs]
|
||||||
TV[Smart TVs / Consoles]
|
LABDEV[Servers and Services]
|
||||||
end
|
GDEV[Guest Devices]
|
||||||
|
|
||||||
subgraph VLAN_LAB["Ced's HomeLab 10.10.30.0/24"]
|
UDR --> MAIN
|
||||||
PVE[Proxmox Host(s)]
|
UDR --> IOT
|
||||||
NPM[Nginx Proxy Manager<br/>+ cloudflared]
|
UDR --> LAB
|
||||||
TRUENAS[TrueNAS]
|
UDR --> GUEST
|
||||||
HA[Home Assistant]
|
|
||||||
K3S["K3s Pi Cluster"]
|
|
||||||
OBS[Grafana / Prometheus / Uptime Kuma]
|
|
||||||
MEDIA[Arr Suite / Jellyfin]
|
|
||||||
end
|
|
||||||
|
|
||||||
subgraph VLAN_GUEST["Guest Network 10.10.99.0/24"]
|
MAIN --> DEV
|
||||||
GUEST_DEV[Guest Devices]
|
IOT --> IOTDEV
|
||||||
end
|
LAB --> LABDEV
|
||||||
|
GUEST --> GDEV
|
||||||
UDR --- VLAN_MAIN
|
|
||||||
UDR --- VLAN_IOT
|
|
||||||
UDR --- VLAN_LAB
|
|
||||||
UDR --- VLAN_GUEST
|
|
||||||
|
|
||||||
VLAN_MAIN -->|Restricted Access| VLAN_LAB
|
|
||||||
VLAN_IOT -->|HA API Only| HA
|
|
||||||
VLAN_GUEST -->|Internet Only| UDR
|
|
||||||
|
|
||||||
VLAN_LAB -->|Cloudflare Tunnel<br/>Outbound Only| NPM
|
|
||||||
```
|
```
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 3. Request Flow – Proxmox via `pve.cedshomelab.com`
|
## 🔄 3. Request Flow - Proxmox Access
|
||||||
|
|
||||||
```mermaid
|
```mermaid
|
||||||
sequenceDiagram
|
sequenceDiagram
|
||||||
participant User as User Browser
|
participant User
|
||||||
participant CF as Cloudflare Edge
|
participant CF as Cloudflare
|
||||||
participant Tunnel as cloudflared (NPM LXC)
|
participant Tunnel
|
||||||
participant NPM as Nginx Proxy Manager
|
participant NPM
|
||||||
participant PVE as Proxmox (10.10.30.250:8006)
|
participant PVE as Proxmox
|
||||||
|
|
||||||
User->>CF: HTTPS GET pve.cedshomelab.com
|
User->>CF: HTTPS request for pve.cedshomelab.com
|
||||||
CF->>CF: DNS resolve / SSL terminate / (Zero Trust auth)
|
CF->>Tunnel: Encrypted tunnel
|
||||||
CF-->>Tunnel: Encrypted Tunnel Connection
|
Tunnel->>NPM: Forward request
|
||||||
Tunnel-->>NPM: HTTP request (Host: pve.cedshomelab.com)
|
NPM->>PVE: Proxy to port 8006
|
||||||
NPM->>PVE: HTTPS to 10.10.30.250:8006<br/>proxy headers
|
PVE-->>NPM: UI response
|
||||||
PVE-->>NPM: Proxmox login HTML
|
NPM-->>Tunnel: Return response
|
||||||
NPM-->>Tunnel: Response
|
Tunnel-->>CF: Return response
|
||||||
Tunnel-->>CF: Encrypted tunnel response
|
CF-->>User: Proxmox UI
|
||||||
CF-->>User: HTTPS response (Proxmox UI)
|
|
||||||
```
|
```
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 4. Request Flow – Home Assistant via `ha.cedshomelab.com`
|
## 🔄 4. Request Flow - Home Assistant
|
||||||
|
|
||||||
```mermaid
|
```mermaid
|
||||||
sequenceDiagram
|
sequenceDiagram
|
||||||
participant User as User (Phone/Laptop)
|
participant User
|
||||||
participant CF as Cloudflare Edge
|
participant CF as Cloudflare
|
||||||
participant Tunnel as cloudflared (NPM LXC)
|
participant Tunnel
|
||||||
participant NPM as Nginx Proxy Manager
|
participant NPM
|
||||||
participant HA as Home Assistant (10.10.30.104:8123)
|
participant HA as Home Assistant
|
||||||
|
|
||||||
User->>CF: HTTPS GET ha.cedshomelab.com
|
User->>CF: HTTPS request for ha.cedshomelab.com
|
||||||
CF->>CF: DNS / SSL / (Zero Trust future)
|
CF->>Tunnel: Encrypted tunnel
|
||||||
CF-->>Tunnel: Encrypted tunnel connection
|
Tunnel->>NPM: Forward request
|
||||||
Tunnel-->>NPM: HTTP request with X-Forwarded-For
|
NPM->>HA: Proxy to port 8123
|
||||||
NPM->>HA: HTTP to 10.10.30.104:8123
|
HA-->>NPM: UI or API response
|
||||||
HA->>HA: Check trusted_proxies & use_x_forwarded_for
|
NPM-->>Tunnel: Return response
|
||||||
HA-->>NPM: HA UI / API response
|
Tunnel-->>CF: Return response
|
||||||
NPM-->>Tunnel: Response
|
CF-->>User: Home Assistant UI
|
||||||
Tunnel-->>CF: Response
|
|
||||||
CF-->>User: HTTPS response (HA UI)
|
|
||||||
```
|
```
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 5. Notes
|
## 🧠 Notes
|
||||||
|
|
||||||
- Cloudflare Zero Trust can be layered in front of any critical service.
|
- 🌐 All external access is routed through Cloudflare Tunnel
|
||||||
- External entrypoint is always `*.cedshomelab.com`.
|
- 🚫 No inbound port forwarding is required
|
||||||
- Only outbound traffic from the HomeLab VLAN is required.
|
- 🔗 Services are exposed via subdomains under `cedshomelab.com`
|
||||||
|
- 🧩 VLAN segmentation reduces unnecessary lateral movement
|
||||||
|
- 🔐 Cloudflare Zero Trust can be layered on sensitive services
|
||||||
|
|||||||
Binary file not shown.
|
After Width: | Height: | Size: 246 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 165 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 208 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 208 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 115 KiB |
@@ -0,0 +1,117 @@
|
|||||||
|
# 🧠 SOC Lab – Monitoring, Logging & Security Simulation
|
||||||
|
|
||||||
|
## 🚀 Overview
|
||||||
|
|
||||||
|
This SOC Lab is a focused project within my homelab environment designed to simulate real-world monitoring, logging, and basic security detection workflows.
|
||||||
|
|
||||||
|
The goal is to replicate how modern infrastructure teams observe system behavior, detect anomalies, and maintain service reliability.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🖥️ Infrastructure Backbone
|
||||||
|
|
||||||
|
* Proxmox VE (virtualization platform)
|
||||||
|
* Virtual Machines and LXC containers
|
||||||
|
* Segmented network environment (VLANs)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## ☸️ Kubernetes Environment
|
||||||
|
|
||||||
|
* 12-node K3s cluster (Raspberry Pi)
|
||||||
|
* Control plane + worker node architecture
|
||||||
|
* Workload segmentation:
|
||||||
|
|
||||||
|
* ingress
|
||||||
|
* data
|
||||||
|
* monitoring
|
||||||
|
|
||||||
|
```bash
|
||||||
|
kubectl get nodes -o wide
|
||||||
|
kubectl get pods -A
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🌐 Traffic & Service Routing
|
||||||
|
|
||||||
|
* Nginx Proxy Manager (reverse proxy)
|
||||||
|
* Cloudflare Tunnel (secure external access)
|
||||||
|
* Subdomain-based service exposure
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📊 Monitoring & Observability
|
||||||
|
|
||||||
|
* Prometheus (metrics collection)
|
||||||
|
* Grafana (dashboard visualization)
|
||||||
|
* Uptime Kuma (service monitoring)
|
||||||
|
|
||||||
|
### Key Capabilities:
|
||||||
|
|
||||||
|
* System performance tracking
|
||||||
|
* Service uptime monitoring
|
||||||
|
* Infrastructure visibility
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🔐 Security Layer (In Progress)
|
||||||
|
|
||||||
|
* CrowdSec (intrusion detection & prevention)
|
||||||
|
* Basic firewall and access control concepts
|
||||||
|
* Monitoring suspicious traffic patterns
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📜 Logging Pipeline (Planned)
|
||||||
|
|
||||||
|
* Grafana Loki (log aggregation)
|
||||||
|
* Centralized log visibility
|
||||||
|
* Correlation between logs and system activity
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## ⚔️ Attack Simulation (Planned)
|
||||||
|
|
||||||
|
To validate monitoring and logging systems, the following simulations are planned:
|
||||||
|
|
||||||
|
* Network scanning (nmap)
|
||||||
|
* Failed authentication attempts
|
||||||
|
* Traffic pattern analysis
|
||||||
|
|
||||||
|
```bash
|
||||||
|
nmap -A <target-ip>
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🧪 Skills Demonstrated
|
||||||
|
|
||||||
|
* Infrastructure design and deployment
|
||||||
|
* Kubernetes cluster management
|
||||||
|
* Monitoring and observability implementation
|
||||||
|
* Reverse proxy and traffic routing
|
||||||
|
* System-level thinking and troubleshooting
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🎯 Future Enhancements
|
||||||
|
|
||||||
|
* Full logging pipeline (Loki integration)
|
||||||
|
* Alerting (Grafana alerts)
|
||||||
|
* Security event tracking
|
||||||
|
* Automated deployments (CI/CD)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 💡 Key Takeaway
|
||||||
|
|
||||||
|
This lab demonstrates the ability to design, build, and operate a distributed system with monitoring and observability, reflecting real-world infrastructure and platform engineering practices.
|
||||||
Reference in New Issue
Block a user