#Security
Login watch, and the WAF again
An alert when login attempts come from an address never seen to succeed, without noise from 5G; dashboards fixed; and a night when the WAF was killed 139 times.
Security audit, fleet updates and email
A black-box and grey-box audit, schedulable updates for the whole fleet with vulnerability watch, readable logs, and emails that finally get past the filters.
ADR 0021: Intrusion detection and prevention in lightweight layers
Suricata on the firewall, CrowdSec shared by every machine with blocking at the firewall, detection rules on the centralised logs; no heavy SIEM.
ADR 0022: An internal certificate authority and verified TLS on internal flows
An internal authority (offline root, intermediate on the firewall) to encrypt and authenticate every flow between machines, and make DNS or ARP spoofing useless.
ADR 0023: Fleet updates and security watch
Each machine publishes its update status, a nightly watch compares versions and known vulnerabilities, and maintenance is launched in two clicks in Semaphore (announcement, then scheduled update).
Post-mortem: the whole household banned by the WAF
Intrusion tests run from the home network got its public address banned; the whole family received 403s on the sign-in portal.
ADR 0018: One group per service, with administration rights and quotas derived from the directory
Access to each service is granted by adding someone to a group; applications' administration rights follow the administrators group; quotas are set from the accounts page.
ADR 0019: Encrypted off-site backups, focused on what cannot be replaced
Every night, VM exports, photos and files leave encrypted for a 1 TB remote storage; anything that can be copied again from its source is left out.
ADR 0020: Centralised logs with VictoriaLogs, agentless collection
Logs from every machine reach VictoriaLogs on the monitoring VM through mechanisms already in place (journald, syslog), and can be searched in Grafana.
ADR 0015: Semaphore UI to run Ansible from the homelab
An internal web interface, protected by SSO, runs the versioned playbooks; its access is restricted and verified.
ADR 0016: An OpenBao secrets vault, alongside SOPS
Secrets move into an OpenBao vault (SSO sign-in, identity-based access, audit); SOPS remains the bootstrap store.
ADR 0017: Inviting people without sending a password, from an accounts page
Accounts are created without a password and the person chooses their own through a one-time link; an administration page, behind the VPN and SSO, replaces the command line.
ADR 0008: Exposing personal services directly behind OPNsense and BunkerWeb
Photos and the drive are published without Cloudflare, through a port forward to a BunkerWeb WAF in the DMZ.
ADR 0009: A single domain, maximebertrand.net
maximebertrand.net is used for everything (showcase site, public services, internal zone), replacing ADR 0004.
ADR 0011: LLDAP directory and Authelia single sign-on
A single LDAP directory for accounts and an SSO portal with two-factor authentication for every published service.
First server in service, first audit
The T330 is running, and so is the firewall; an audit of what exists sets the priorities before adding services.
ADR 0007: A LAB isolated behind its own firewall
The LAB has its own OPNsense, connected to PROD through a routed transit without NAT.
ADR 0002: Public exposure through Cloudflare Tunnel
The showcase site is exposed through an outbound tunnel, with no inbound port open.