// CASE STUDY — Infrastructure
Security Home Lab
Solo design, build, and continuous operation
An isolated Proxmox lab for vulnerability management, product testing, and Security+ practice. Rocky Linux targets, Kali tooling, and snapshots support repeatable exercises.
Problem
Security exercises need realistic targets and a repeatable recovery path away from production systems.
My Contribution
I built and operate the virtualisation host, lab VMs, isolated network, and attack-and-defend exercises.
Key Decisions
Segment the lab from the household LAN, use purpose-built targets, and take clean snapshots before destructive exercises.
Results
A reusable environment for Nessus scan-remediate-rescan cycles, pre-release application testing, and practical Security+ study.
Behind the Build
The home lab is where everything else on this site gets safer before it ships, and where I turn reading into reps. It grew directly out of hands-on infrastructure work — building out XCP-ng and Proxmox hosts and Rocky Linux 9 VMs professionally — recreated at home so I could break things on purpose without consequences.
The hub is a Proxmox VE hypervisor running a small fleet of purpose-built VMs: hardened Rocky Linux 9 servers that stand in for production targets, a Kali Linux attack box, and disposable victim machines for testing exploitation and detection. Everything security-relevant runs on an isolated virtual network segmented away from the household LAN, and nothing in the lab is ever exposed to the internet. The workflow that makes it valuable is snapshots: capture a clean state, attack or misconfigure the target, study what happened, roll back, repeat. It turns hours-long rebuild cycles into minutes and makes genuinely destructive practice cheap.
The lab runs two standing programs. First, a vulnerability-management cycle: Nessus scans across the VM fleet, triaging findings, patching or hardening, and rescanning — the same discover-prioritise-remediate loop I care about professionally, practised end to end. Second, it's the pre-release testing bench for my own products: ScamChecker and ForgeLift builds get poked at with Burp Suite from the attack box before users ever see them. And since committing to the CompTIA Security+ certification, the lab doubles as my study environment — each exam domain gets a practical counterpart here, because I'd rather demonstrate a concept in a terminal than memorise it from a page.
Built With
Highlights
- Proxmox VE hypervisor running a purpose-built VM fleet: hardened Rocky Linux 9 servers as realistic targets, a Kali attack box, and disposable victim machines.
- Snapshot-driven break-and-restore workflow — capture clean state, attack or misconfigure, study the result, roll back in minutes — making destructive practice cheap and repeatable.
- Standing vulnerability-management program: scheduled Nessus scans, triage, remediation, and rescans across the fleet, practising the full discover-prioritise-fix loop.
- Pre-release security bench for my own products — ScamChecker and ForgeLift builds get tested with Burp Suite from the attack box before they reach users.
- Hands-on counterpart to CompTIA Security+ study: each exam domain gets a practical lab exercise rather than staying theory.
- Built on the same virtualisation stack I've run professionally (Proxmox, XCP-ng, Rocky Linux 9), so lab habits transfer directly to production work.
Security Considerations
- Strict isolation: lab networks are segmented from the household LAN, and no lab machine is ever exposed to the internet.
- All offensive tooling is pointed exclusively at my own lab assets and my own applications — the lab exists precisely so that nothing else is ever a test target.
- Golden-image snapshots and rollback hygiene mean compromised targets are destroyed and rebuilt, never trusted again.
Development Timeline
From Work to Home
Jun 2025After building out XCP-ng and Proxmox hosts with Rocky Linux 9 VMs professionally, recreated the stack at home to keep practising without production constraints.
Proxmox Foundation
Aug 2025Stood up the Proxmox VE host with VM templates for repeatable builds: hardened Rocky Linux 9 servers and an isolated virtual network segmented from the household LAN.
Attack & Defend Loop
Oct 2025Added the Kali attack box and disposable victim VMs, and settled into the snapshot workflow: clean state, attack, study, roll back, repeat.
Vulnerability Management
Jan 2026Made Nessus scanning a standing cycle across the fleet — triage, patch or harden, rescan — practising the same loop that matters in professional vulnerability management.
Product Testing Bench
Apr 2026Turned the lab into the pre-release gate for my own apps: ScamChecker and ForgeLift builds now get a Burp Suite pass from the attack box before shipping.
Security+ Study Labs
Jun 2026Committed to CompTIA Security+ and began mapping each exam domain to a hands-on lab exercise, using the fleet as the practical side of the study plan.