This is the whole thing in one place: a segmented VMware lab behind a pfSense firewall, one identity provider enforcing MFA everywhere, a full metrics-and-logs monitoring stack, and encrypted off-site backups that have actually been restored. It runs on a single gaming PC and it’s built to be operated, not just stood up — so the point of this page isn’t the parts list, it’s how they fit and what happens when one breaks.
The Lab
The home lab as one system — the topology, every component, and how it's secured. Each box links to the post where I built it.
1
inbound port — WireGuard only, all else closed
MFA
on every login, enforced centrally
3
firewall-isolated VLANs
15
components, each with a write-up
5
telemetry & egress flows
Topology at a glance
How it's actually run
No pretending this is a datacentre. It's a virtual lab on one machine — so here's the real operating model, including what it doesn't do yet.
Environment
Virtual
VMware VMs on a single workstation (my main PC) — a learning and build environment, not dedicated always-on hardware.
Availability
While in use
Powered up when I'm working and shut down nightly. Monitoring, alerting and log detection run during uptime — not 24/7 yet.
Backups
Two layers · restore-tested
Off-site disaster recovery: consistent DB snapshots (pg_dump / SQLite .backup), age-encrypted, pushed off the host — and restored into a throwaway container to prove they work. Local full VM clones sit alongside for fast rollback (same host, so not DR on their own).
Recovery
Returns on boot
Every service is restart:unless-stopped or systemd-enabled, so the stack comes back on its own once the machine powers on.
Secrets
Encrypted off-box
age public-key encryption; the private key is deliberately kept off the cloud storage that holds the backups.
Next step
Always-on host
Moving the load-bearing services onto dedicated hardware, so identity, firewall and detection stop depending on a VM that sleeps.
Every layer, every component
The lab as defence in depth — and every box below links to the post where I built it.
Boundary & network
A firewall VM is the only thing the rest of the lab talks to the world through — default-deny, private ranges blocked outbound, segmented into isolated zones.
pfSense firewall
runsDedicated VM · WAN + LAN 10.10.0.0/24
securedDefault-deny rules; MFA admin login
VLAN segmentation
runsVLANs 10 / 20 / 30 — Trusted, IoT, Guest
securedInter-VLAN traffic firewalled by default
WireGuard VPN
runsOn pfSense, reached from mobile data
securedKey-based, through the nested firewall
Identity & access
One identity provider with MFA is the single login authority — for web dashboards and for the firewall's own admin login. Who you are and what you may do are decided in one place.
Authentik IdP
runsDocker on the Debian VM
securedMFA enforced centrally, group-based roles
pfSense ↔ Authentik LDAP
runsFirewall auth against the IdP
securedMFA + group admin on a device with no browser
Vaultwarden
runsDocker + Caddy, wildcard TLS via DNS-01
securedZero inbound ports; reached over WireGuard
Compute & automation
One hardened Debian VM hosts the containers and the agent workflow. It runs the services above and the monitoring below, and it's locked down as its own audited surface.
Debian VM
runsVMware host for Docker + native services
securedAuto-updates, nftables, Tailscale-only SSH, sandboxing
MCP hub
runsCustom server on the VM, over Tailscale
securedNo inbound ports, narrow tool surface
Claude Code pipeline
runsDrives the blog + lab work from the VM
securedDeterministic hooks gate posts, builds, commands
Observability & detection
Metrics answer 'what's the number', logs answer 'what happened', and alerts reach out so nothing waits to be noticed. Dashboards, alerting, and a log SIEM on one stack.
Prometheus
runsNative systemd, localhost-bound :9090
securedScrapes the VM + pfSense, no external exposure
Grafana
runsDashboards over the metric + log stores
securedSSO via OIDC, admin by group membership
Alertmanager → ntfy
runsDocker :9093 → phone push
securedMetric + log alerts, formatted, loopback-bound
Loki SIEM
runsLoki + Promtail + rsyslog, in Docker
securedpfSense/auth/syslog centralised, LogQL detection
Resilience & edge
The parts that decide whether the lab survives a bad day: encrypted off-site backups that have actually been restored, and a physical glance display that never crosses the isolation boundary.
From signal to phone
Both halves of monitoring feed one alert path: a number crossing a threshold, or a log line matching a pattern, ends up as the same buzz in my pocket — with an all-clear when it resolves.
📈 Prometheus · metrics
🪵 Loki · logs
rules evaluate
🔔 Alertmanager
ntfy
📱 phone
🔎 investigate
Runs while the lab is up. The nightly shutdown is exactly why alert rules wait 10m before firing — so a morning boot isn't mistaken for an outage.