Context. A lab you cannot rebuild is a liability. My Proxmox infrastructure is provisioned with Terraform and cloud-init, hosts Kubernetes, and is promoted with GitOps — destroy and recreate is a given, not a project.

Approach. A physical host running Proxmox, tightly segregated — dedicated networks per purpose: DMZ, lab, DN42, IPv6 tunnel. Services run in LXC and VMs: Git hosting, CI runners, a Kubernetes lab, monitoring (Prometheus/Grafana/Loki), DNS and the edge router announcing my ASN. Everything is versioned, with a centralized secret-management policy.

Result. A home datacenter that behaves like a small production site: alerting, backups, and runbooks. It is also the test bed for my experiments and professional tasks — check the notes to learn more.

Context. Years ago I spent my time in Cisco Packet Tracer, and got to experiment with BGP through Quagga. The teacher said it might be the last time in my career I'd touch it. In 2024 I registered my own ASN with the RIPE NCC — it reconnected every lesson I had gathered since. Leasing everything from one provider means never understanding how it all fits together; with my own network, I finally see exactly how everything is connected.

Approach. Two /48s announced from a 2a13:7fc0:1010::/44 allocation, RPKI ROAs signed, strict inbound/outbound filters, IPv6 transit via route64.org with Vultr as a second path.

Result. A real, routable network I fully control — the foundation for the next steps. Full details on the Network page.

Context. I keep offensive skills sharp with regular CTF training. Solving a box is only half the exercise — the other half is stopping it.

Approach. Every attack chain I practice gets mapped to a detection rule (Zeek/Suricata) and a hardening change in my lab. Write-ups follow a fixed format: Chain → Detection → Hardening → Lesson, published only for retired boxes.

Result. Training that compounds: offense skills stay current and the defensive playbook grows every session. Current focus is on the Now page.

Context. Day-job work, described in a way that respects my employer's confidentiality.

Approach. Security gates embedded at every pipeline stage: static analysis on merge requests, image scanning before promotion, IaC checks at plan time, and GitOps deploys through a single gate.

Result. Vulnerabilities caught in minutes instead of months — and a deployment path where the exception process, not the pipeline, is the special case. Details in the write-up.