mirror of
https://github.com/ced4568/ceds-homelab.git
synced 2026-08-13 04:04:01 +00:00
Update positioning, remove VLAN IPs, remove icons from SOC lab
This commit is contained in:
@@ -1,21 +1,21 @@
|
|||||||
# Ced's HomeLab — Live Infrastructure & Observability Platform
|
# Ced's HomeLab Live Infrastructure & Observability Platform
|
||||||
|
|
||||||
> A production-style homelab running real infrastructure, real workloads, and a live NOC dashboard — built by a Digital Systems Engineer at GE Aerospace who needed a place to practice what he preaches.
|
> A production-style homelab running real infrastructure, real workloads, and a live NOC dashboard built by a DevOps and Cloud Infrastructure Engineer at GE Aerospace who needed a place to practice what he preaches.
|
||||||
|
|
||||||
[](https://noc.chasedumphord.com)
|
[](https://noc.chasedumphord.com)
|
||||||
[](https://chasedumphord.com)
|
[](https://chasedumphord.com)
|
||||||
[](#infrastructure-layer)
|
[](#infrastructure-layer)
|
||||||
[](#network--vlan-architecture)
|
[](#network--vlan-architecture)
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## Why I Built This
|
## Why I Built This
|
||||||
|
|
||||||
I work on the Digital Team at GE Aerospace building data pipelines and dashboards for industrial systems.
|
I'm a DevOps and Cloud Infrastructure Engineer currently on the Digital Team at GE Aerospace building data pipelines and dashboards for industrial systems.
|
||||||
|
|
||||||
But Ced's NOC didn't start there.
|
But Ced's NOC didn't start there.
|
||||||
|
|
||||||
It started about five years ago with an old Dell tower I found in the trash, a few cheap upgrades, and way too much curiosity. I didn't even know what a homelab was. I just knew I wanted to see if I could make it do something useful. That server became BigWorld — the primary node that still anchors this cluster today.
|
It started about five years ago with an old Dell tower I found in the trash, a few cheap upgrades, and way too much curiosity. I didn't even know what a homelab was. I just knew I wanted to see if I could make it do something useful. That server became BigWorld the primary node that still anchors this cluster today.
|
||||||
|
|
||||||
What started as a media server and a couple of small VMs went down a rabbit hole and never came back. Five years later it's a 6-node Proxmox cluster, a 12-node Raspberry Pi K3s cluster, a VLAN-segmented network, and a full observability stack running 24/7.
|
What started as a media server and a couple of small VMs went down a rabbit hole and never came back. Five years later it's a 6-node Proxmox cluster, a 12-node Raspberry Pi K3s cluster, a VLAN-segmented network, and a full observability stack running 24/7.
|
||||||
|
|
||||||
@@ -38,18 +38,18 @@ graph TB
|
|||||||
NPM[Nginx Proxy Manager]
|
NPM[Nginx Proxy Manager]
|
||||||
end
|
end
|
||||||
|
|
||||||
subgraph Network["Network — UniFi UDR"]
|
subgraph Network["Network UniFi UDR"]
|
||||||
MAIN[Main VLAN 10.10.10.0/24]
|
MAIN[Main VLAN]
|
||||||
IOT[IoT VLAN 10.10.20.0/24]
|
IOT[IoT VLAN]
|
||||||
LAB[HomeLab VLAN 10.10.30.0/24]
|
LAB[HomeLab VLAN]
|
||||||
GUEST[Guest VLAN 10.10.99.0/24]
|
GUEST[Guest VLAN]
|
||||||
end
|
end
|
||||||
|
|
||||||
subgraph Desktop["Primary Workstation"]
|
subgraph Desktop["Primary Workstation"]
|
||||||
PS[PrimeStation]
|
PS[PrimeStation]
|
||||||
end
|
end
|
||||||
|
|
||||||
subgraph Proxmox["Compute — Proxmox Cluster (6 Nodes)"]
|
subgraph Proxmox["Compute Proxmox Cluster (6 Nodes)"]
|
||||||
BW[BigWorld — Primary]
|
BW[BigWorld — Primary]
|
||||||
BG[Biggie]
|
BG[Biggie]
|
||||||
SN[Snoop]
|
SN[Snoop]
|
||||||
@@ -58,34 +58,34 @@ graph TB
|
|||||||
DD[DrDre]
|
DD[DrDre]
|
||||||
end
|
end
|
||||||
|
|
||||||
subgraph K3s["Orchestration — K3s Cluster (12 Nodes)"]
|
subgraph K3s["Orchestration K3s Cluster (12 Nodes)"]
|
||||||
subgraph CP["Control Plane"]
|
subgraph CP["Control Plane"]
|
||||||
CP1[k3s-django-1]
|
CP1[k3s-django-1]
|
||||||
CP2[k3s-django-2]
|
CP2[k3s-django-2]
|
||||||
CP3[k3s-django-3]
|
CP3[k3s-django-3]
|
||||||
end
|
end
|
||||||
subgraph INGRESS["Workers — Ingress"]
|
subgraph INGRESS["Workers Ingress"]
|
||||||
W1[k3s-node-1]
|
W1[k3s-node-1]
|
||||||
W2[k3s-node-2]
|
W2[k3s-node-2]
|
||||||
W3[k3s-node-3]
|
W3[k3s-node-3]
|
||||||
end
|
end
|
||||||
subgraph DATA["Workers — Data"]
|
subgraph DATA["Workers Data"]
|
||||||
W4[k3s-node-4]
|
W4[k3s-node-4]
|
||||||
W5[k3s-node-5]
|
W5[k3s-node-5]
|
||||||
W6[k3s-node-6]
|
W6[k3s-node-6]
|
||||||
end
|
end
|
||||||
subgraph MON["Workers — Monitoring"]
|
subgraph MON["Workers Monitoring"]
|
||||||
W7[k3s-node-7]
|
W7[k3s-node-7]
|
||||||
W8[k3s-node-8]
|
W8[k3s-node-8]
|
||||||
W9[k3s-node-9]
|
W9[k3s-node-9]
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
subgraph Storage["Storage — TrueNAS"]
|
subgraph Storage["Storage TrueNAS"]
|
||||||
TN[TrueNAS]
|
TN[TrueNAS]
|
||||||
end
|
end
|
||||||
|
|
||||||
subgraph NOC["Observability — Ced's NOC"]
|
subgraph NOC["Observability Ced's NOC"]
|
||||||
PROM[Prometheus]
|
PROM[Prometheus]
|
||||||
GRAF[Grafana]
|
GRAF[Grafana]
|
||||||
KUMA[Uptime Kuma]
|
KUMA[Uptime Kuma]
|
||||||
@@ -117,18 +117,18 @@ graph TB
|
|||||||
|
|
||||||
## Node Inventory
|
## Node Inventory
|
||||||
|
|
||||||
### Proxmox Cluster — 6 Nodes
|
### Proxmox Cluster 6 Nodes
|
||||||
|
|
||||||
| Node | Role |
|
| Node | Role |
|
||||||
|------|------|
|
|------|------|
|
||||||
| BigWorld | Primary Proxmox node — cluster anchor, original lab server |
|
| BigWorld | Primary Proxmox node cluster anchor, original lab server |
|
||||||
| Biggie | Compute node |
|
| Biggie | Compute node |
|
||||||
| Snoop | Compute node |
|
| Snoop | Compute node |
|
||||||
| TooShort | Compute node |
|
| TooShort | Compute node |
|
||||||
| Tupac | Compute node |
|
| Tupac | Compute node |
|
||||||
| DrDre | Compute node |
|
| DrDre | Compute node |
|
||||||
|
|
||||||
### K3s Cluster — 12 Nodes
|
### K3s Cluster 12 Nodes
|
||||||
|
|
||||||
| Node | Role |
|
| Node | Role |
|
||||||
|------|------|
|
|------|------|
|
||||||
@@ -162,32 +162,32 @@ graph TB
|
|||||||
|
|
||||||
## Infrastructure Layers
|
## Infrastructure Layers
|
||||||
|
|
||||||
### Infrastructure Layer — Proxmox Cluster
|
### Infrastructure Layer Proxmox Cluster
|
||||||
|
|
||||||
Six-node Proxmox VE cluster anchored by BigWorld — the original server that started this whole lab. TrueNAS provides centralized ZFS storage with NFS exports for VM disk images and SMB shares for media workloads.
|
Six-node Proxmox VE cluster anchored by BigWorld the original server that started this whole lab. TrueNAS provides centralized ZFS storage with NFS exports for VM disk images and SMB shares for media workloads.
|
||||||
|
|
||||||
📁 Configs: [`proxmox/`](./proxmox/) · [`truenas/`](./truenas/) · [`home-assistant/`](./home-assistant/)
|
Configs: [`proxmox/`](./proxmox/) · [`truenas/`](./truenas/) · [`home-assistant/`](./home-assistant/)
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
### Orchestration Layer — K3s on Raspberry Pi
|
### Orchestration Layer K3s on Raspberry Pi
|
||||||
|
|
||||||
A 12-node K3s cluster running on Raspberry Pi hardware with workers segmented by role — mirroring real Kubernetes production patterns at lab scale. Three dedicated control plane nodes ensure high availability. Worker groups are purpose-built for ingress routing, data workloads, and monitoring collection.
|
A 12-node K3s cluster running on Raspberry Pi hardware with workers segmented by role mirroring real Kubernetes production patterns at lab scale. Three dedicated control plane nodes ensure high availability. Worker groups are purpose built for ingress routing, data workloads, and monitoring collection.
|
||||||
|
|
||||||
📌 Full cluster documentation: **[ced-k3s-homelab →](https://github.com/ced4568/ced-k3s-homelab)**
|
Full cluster documentation: **[ced-k3s-homelab →](https://github.com/ced4568/ced-k3s-homelab)**
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
### Network & VLAN Architecture
|
### Network & VLAN Architecture
|
||||||
|
|
||||||
All traffic runs through a UniFi Dream Router with hard VLAN segmentation. The HomeLab VLAN is fully isolated from daily-use devices — the same network segmentation principle I apply to industrial OT/IT environments at work.
|
All traffic runs through a UniFi Dream Router with hard VLAN segmentation. The HomeLab VLAN is fully isolated from daily-use devices the same network segmentation principle I apply to industrial OT/IT environments at work.
|
||||||
|
|
||||||
| VLAN | Subnet | Purpose |
|
| VLAN | Purpose |
|
||||||
|------|--------|---------|
|
|------|---------|
|
||||||
| Main | `10.10.10.0/24` | Daily-use devices, workstations |
|
| Main | Daily-use devices, workstations |
|
||||||
| IoT | `10.10.20.0/24` | Smart home devices, consoles, TVs |
|
| IoT | Smart home devices, consoles, TVs |
|
||||||
| HomeLab | `10.10.30.0/24` | All servers, K3s nodes, storage, services |
|
| HomeLab | All servers, K3s nodes, storage, services |
|
||||||
| Guest | `10.10.99.0/24` | Guest Wi-Fi — no internal access |
|
| Guest | Guest Wi-Fi — no internal access |
|
||||||
|
|
||||||
**Traffic flow for external access:**
|
**Traffic flow for external access:**
|
||||||
```
|
```
|
||||||
@@ -196,11 +196,11 @@ Internet → Cloudflare Edge → Tunnel → Nginx Proxy Manager → Internal Ser
|
|||||||
|
|
||||||
Zero open ports. No port forwarding. All external access goes through Cloudflare Tunnel.
|
Zero open ports. No port forwarding. All external access goes through Cloudflare Tunnel.
|
||||||
|
|
||||||
📁 Configs: [`cloudflare/`](./cloudflare/) · [`npm/`](./npm/) · [`docs/Add_New_Service_Guide.md`](./docs/Add_New_Service_Guide.md)
|
Configs: [`cloudflare/`](./cloudflare/) · [`npm/`](./npm/) · [`docs/Add_New_Service_Guide.md`](./docs/Add_New_Service_Guide.md)
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
### Observability — Ced's NOC
|
### Observability Ced's NOC
|
||||||
|
|
||||||
The centerpiece of this lab. A live Network Operations Center dashboard giving real-time visibility into every layer of the infrastructure.
|
The centerpiece of this lab. A live Network Operations Center dashboard giving real-time visibility into every layer of the infrastructure.
|
||||||
|
|
||||||
@@ -219,8 +219,8 @@ The centerpiece of this lab. A live Network Operations Center dashboard giving r
|
|||||||
- Network latency across VLANs
|
- Network latency across VLANs
|
||||||
- TrueNAS pool health and disk utilization
|
- TrueNAS pool health and disk utilization
|
||||||
|
|
||||||
📺 **[View Live NOC Dashboard →](https://noc.chasedumphord.com)**
|
**[View Live NOC Dashboard →](https://noc.chasedumphord.com)**
|
||||||
📁 Configs: [`monitoring/`](./monitoring/)
|
Configs: [`monitoring/`](./monitoring/)
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
@@ -292,10 +292,10 @@ ceds-homelab/
|
|||||||
This repository contains **no secrets, tokens, API keys, or passwords.**
|
This repository contains **no secrets, tokens, API keys, or passwords.**
|
||||||
|
|
||||||
- All sensitive values are stored locally or passed via environment variables
|
- All sensitive values are stored locally or passed via environment variables
|
||||||
- Template/example files use placeholder values only (`.example` suffix)
|
- Template/example files use placeholder values only (.example suffix)
|
||||||
- External access is zero-trust via Cloudflare Tunnel — no exposed ports
|
- External access is zero-trust via Cloudflare Tunnel no exposed ports
|
||||||
- VLANs enforce hard network segmentation between device classes
|
- VLANs enforce hard network segmentation between device classes
|
||||||
- Internal IPs are intentionally omitted from public documentation
|
- Internal IPs and subnet ranges are intentionally omitted from public documentation
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
@@ -303,8 +303,8 @@ This repository contains **no secrets, tokens, API keys, or passwords.**
|
|||||||
|
|
||||||
| Project | Description |
|
| Project | Description |
|
||||||
|---------|-------------|
|
|---------|-------------|
|
||||||
| [ced-k3s-homelab](https://github.com/ced4568/ced-k3s-homelab) | Full documentation for the 12-node Raspberry Pi K3s cluster |
|
| [ced-k3s-homelab](https://github.com/ced4568/ced-k3s-homelab) | Full documentation for the 12 node Raspberry Pi K3s cluster |
|
||||||
| [ceds-aprs-igate](https://github.com/ced4568/ceds-aprs-igate) | Dual-node APRS RF-to-internet iGate (KJ5JCO) |
|
| [ceds-aprs-igate](https://github.com/ced4568/ceds-aprs-igate) | Dual-node APRS RF to internet iGate (KJ5JCO) |
|
||||||
| [ced-portfolio](https://github.com/ced4568/ced-portfolio) | Source for chasedumphord.com |
|
| [ced-portfolio](https://github.com/ced4568/ced-portfolio) | Source for chasedumphord.com |
|
||||||
|
|
||||||
---
|
---
|
||||||
@@ -312,7 +312,7 @@ This repository contains **no secrets, tokens, API keys, or passwords.**
|
|||||||
## Author
|
## Author
|
||||||
|
|
||||||
**Chase Dumphord (Ced)**
|
**Chase Dumphord (Ced)**
|
||||||
Digital Systems Engineer · GE Aerospace · Oxford, MS
|
DevOps and Cloud Infrastructure Engineer · GE Aerospace · Oxford, MS
|
||||||
|
|
||||||
Building systems that connect industrial hardware to actionable data.
|
Building systems that connect industrial hardware to actionable data.
|
||||||
|
|
||||||
|
|||||||
+15
-15
@@ -1,6 +1,6 @@
|
|||||||
# 🧠 SOC Lab – Monitoring, Logging & Security Simulation
|
# SOC Lab Monitoring, Logging & Security Simulation
|
||||||
|
|
||||||
## 🚀 Overview
|
## Overview
|
||||||
|
|
||||||
This SOC Lab is a focused project within my homelab environment designed to simulate real-world monitoring, logging, and basic security detection workflows.
|
This SOC Lab is a focused project within my homelab environment designed to simulate real-world monitoring, logging, and basic security detection workflows.
|
||||||
|
|
||||||
@@ -8,9 +8,9 @@ The goal is to replicate how modern infrastructure teams observe system behavior
|
|||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 🖥️ Infrastructure Backbone
|
## Infrastructure Backbone
|
||||||
|
|
||||||
* Proxmox VE (virtualization platform)
|
* 6-node Proxmox VE cluster (virtualization platform)
|
||||||
* Virtual Machines and LXC containers
|
* Virtual Machines and LXC containers
|
||||||
* Segmented network environment (VLANs)
|
* Segmented network environment (VLANs)
|
||||||
|
|
||||||
@@ -18,7 +18,7 @@ The goal is to replicate how modern infrastructure teams observe system behavior
|
|||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## ☸️ Kubernetes Environment
|
## Kubernetes Environment
|
||||||
|
|
||||||
* 12-node K3s cluster (Raspberry Pi)
|
* 12-node K3s cluster (Raspberry Pi)
|
||||||
* Control plane + worker node architecture
|
* Control plane + worker node architecture
|
||||||
@@ -37,7 +37,7 @@ kubectl get pods -A
|
|||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 🌐 Traffic & Service Routing
|
## Traffic & Service Routing
|
||||||
|
|
||||||
* Nginx Proxy Manager (reverse proxy)
|
* Nginx Proxy Manager (reverse proxy)
|
||||||
* Cloudflare Tunnel (secure external access)
|
* Cloudflare Tunnel (secure external access)
|
||||||
@@ -47,7 +47,7 @@ kubectl get pods -A
|
|||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 📊 Monitoring & Observability
|
## Monitoring & Observability
|
||||||
|
|
||||||
* Prometheus (metrics collection)
|
* Prometheus (metrics collection)
|
||||||
* Grafana (dashboard visualization)
|
* Grafana (dashboard visualization)
|
||||||
@@ -63,7 +63,7 @@ kubectl get pods -A
|
|||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 🔐 Security Layer (In Progress)
|
## Security Layer (In Progress)
|
||||||
|
|
||||||
* CrowdSec (intrusion detection & prevention)
|
* CrowdSec (intrusion detection & prevention)
|
||||||
* Basic firewall and access control concepts
|
* Basic firewall and access control concepts
|
||||||
@@ -71,7 +71,7 @@ kubectl get pods -A
|
|||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 📜 Logging Pipeline (Planned)
|
## Logging Pipeline (Planned)
|
||||||
|
|
||||||
* Grafana Loki (log aggregation)
|
* Grafana Loki (log aggregation)
|
||||||
* Centralized log visibility
|
* Centralized log visibility
|
||||||
@@ -79,7 +79,7 @@ kubectl get pods -A
|
|||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## ⚔️ Attack Simulation (Planned)
|
## Attack Simulation (Planned)
|
||||||
|
|
||||||
To validate monitoring and logging systems, the following simulations are planned:
|
To validate monitoring and logging systems, the following simulations are planned:
|
||||||
|
|
||||||
@@ -93,17 +93,17 @@ nmap -A <target-ip>
|
|||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 🧪 Skills Demonstrated
|
## Skills Demonstrated
|
||||||
|
|
||||||
* Infrastructure design and deployment
|
* Infrastructure design and deployment
|
||||||
* Kubernetes cluster management
|
* Kubernetes cluster management
|
||||||
* Monitoring and observability implementation
|
* Monitoring and observability implementation
|
||||||
* Reverse proxy and traffic routing
|
* Reverse proxy and traffic routing
|
||||||
* System-level thinking and troubleshooting
|
* Production systems thinking and operational discipline
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 🎯 Future Enhancements
|
## Future Enhancements
|
||||||
|
|
||||||
* Full logging pipeline (Loki integration)
|
* Full logging pipeline (Loki integration)
|
||||||
* Alerting (Grafana alerts)
|
* Alerting (Grafana alerts)
|
||||||
@@ -112,6 +112,6 @@ nmap -A <target-ip>
|
|||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 💡 Key Takeaway
|
## Key Takeaway
|
||||||
|
|
||||||
This lab demonstrates the ability to design, build, and operate a distributed system with monitoring and observability, reflecting real-world infrastructure and platform engineering practices.
|
This lab demonstrates real infrastructure ownership designing, building, and operating a distributed system with full observability stack, security detection, and cloud-native tooling reflecting production-grade platform engineering practices.
|
||||||
Reference in New Issue
Block a user