The home laboratory
Keeping the craft current
Outside paid work I run a production-shaped home laboratory — a version-controlled, infrastructure-as-code environment where I stay genuinely hands-on with the tools I design with. It's home-lab scale rather than enterprise-production, but the engineering disciplines are the same, and it's where ideas get pressure-tested before they reach a client estate.
Logical architecture
How it fits together
A deliberately abstracted view — enough to show the shape of the environment and the security thinking behind it, with nothing that would help anyone find or fingerprint it.
Zone topology
The same environment seen as security zones. External services and the home network reach the lab only through a default-deny firewall; lab hosts are split between a management plane and a workload plane, and a shared hardening baseline applies to every managed host.
Workstreams
What's running
Virtualisation & infrastructure foundation
A type-1 hypervisor host runs the estate as a mix of containers and VMs, every guest provisioned from declarative first-boot configuration. Base hardening is applied uniformly across the fleet as a role, not by hand.
Identity & private PKI
A two-tier certificate authority with an offline, hardware-key-protected root and ACME-automated issuance across the fleet, paired with a dedicated secrets store providing service-to-service authentication and short-lived credentials.
Zero-trust network & remote access
A default-deny, segmented network with per-service firewall rules and intrusion detection, host-level packet filtering, and identity-aware remote access — an identity provider with hardware-key MFA and a documented break-glass path. Firewall log-noise reduction is run as a compensating-control discipline, tracked in the decision record.
Configuration management & IaC
The whole estate is version-controlled and managed with idempotent automation roles and a structured inventory — convergent configuration, cloud-init as the canonical first-boot path, and a patch-then-validate discipline for fleet-wide change.
Monitoring, observability & SIEM
A metrics and alerting stack with custom alert rules and endpoint probes, alongside log analytics and SIEM detection — decoders and rules written from first principles and validated against a test harness — plus continuous network asset discovery with its own scan-health alerting.
DNS & service hygiene
An authoritative internal DNS service with native metrics integration and custom SIEM decoders built and validated from canonical log samples.
Git ops & self-hosted CI/CD
Self-hosted git with TLS and telemetry, and a CI runner deliberately isolated from the git host so a build compromise cannot reach the repository service — blast-radius thinking applied to a home setup.
Storage & backup
A ZFS storage appliance serving network shares, with encrypted offsite backup — the 3-2-1 principle applied at lab scale.
Self-hosted GenAI platform & AI security
A multi-tier local LLM platform — always-on local inference, a GPU-accelerated local tier, and a cloud frontier tier — sitting behind an authenticated gateway, with a custom protocol server wrapping the runtime and an A/B harness driving routing decisions. The pipeline is threat-modelled against STRIDE and the OWASP LLM Top 10, with attacker-controllable input treated as a prompt-injection surface.
How I work
The disciplines behind it
The lab is as much about method as it is about tools — the habits below are the same ones I bring to a client engagement.
Decision records with rationale
Every material choice is written down once with its reasoning and revisited on a trigger — the same discipline I bring to an architecture decision log at work.
Audit before relying
New tools and data sources are assessed for data quality and currency before anything downstream is built on them — schema completeness is not the same as data currency, a lesson codified after it bit me.
Empirical evaluation
Choices between options are settled with paired runs and a scoring rubric rather than opinion — applied to both model selection and a gateway bake-off.
Guardrails on AI-agent actions
Where I use AI agents in my own automation, they operate under explicit constraints — preview-and-summary before any file write, never-auto-apply on soft-signal classifications, and verbatim quarantine of sensitive context. Personal-workflow scale, but structurally the design problem enterprise agent-permissioning has to solve.
A note on honesty: this is personal practice kept deliberately at home-lab scale — it keeps my implementation skills current, it isn't a claim to enterprise-production depth. I keep that boundary explicit, here and in conversation.