Back to projects

// PROJECT — Infrastructure

Security Home Lab

Solo design, build, and continuous operation

The home lab is where everything else on this site gets safer before it ships, and where I turn reading into reps. It grew directly out of hands-on infrastructure work — building out XCP-ng and Proxmox hosts and Rocky Linux 9 VMs professionally — recreated at home so I could break things on purpose without consequences.

The hub is a Proxmox VE hypervisor running a small fleet of purpose-built VMs: hardened Rocky Linux 9 servers that stand in for production targets, a Kali Linux attack box, and disposable victim machines for testing exploitation and detection. Everything security-relevant runs on an isolated virtual network segmented away from the household LAN, and nothing in the lab is ever exposed to the internet. The workflow that makes it valuable is snapshots: capture a clean state, attack or misconfigure the target, study what happened, roll back, repeat. It turns hours-long rebuild cycles into minutes and makes genuinely destructive practice cheap.

The lab runs two standing programs. First, a vulnerability-management cycle: Nessus scans across the VM fleet, triaging findings, patching or hardening, and rescanning — the same discover-prioritise-remediate loop I care about professionally, practised end to end. Second, it's the pre-release testing bench for my own products: ScamChecker and ForgeLift builds get poked at with Burp Suite from the attack box before users ever see them. And since committing to the CompTIA Security+ certification, the lab doubles as my study environment — each exam domain gets a practical counterpart here, because I'd rather demonstrate a concept in a terminal than memorise it from a page.

// Built With

Proxmox VEXCP-ngRocky Linux 9Kali LinuxNessusBurp Suite

// Highlights

  • Proxmox VE hypervisor running a purpose-built VM fleet: hardened Rocky Linux 9 servers as realistic targets, a Kali attack box, and disposable victim machines.
  • Snapshot-driven break-and-restore workflow — capture clean state, attack or misconfigure, study the result, roll back in minutes — making destructive practice cheap and repeatable.
  • Standing vulnerability-management program: scheduled Nessus scans, triage, remediation, and rescans across the fleet, practising the full discover-prioritise-fix loop.
  • Pre-release security bench for my own products — ScamChecker and ForgeLift builds get tested with Burp Suite from the attack box before they reach users.
  • Hands-on counterpart to CompTIA Security+ study: each exam domain gets a practical lab exercise rather than staying theory.
  • Built on the same virtualisation stack I've run professionally (Proxmox, XCP-ng, Rocky Linux 9), so lab habits transfer directly to production work.

Security Considerations

  • Strict isolation: lab networks are segmented from the household LAN, and no lab machine is ever exposed to the internet.
  • All offensive tooling is pointed exclusively at my own lab assets and my own applications — the lab exists precisely so that nothing else is ever a test target.
  • Golden-image snapshots and rollback hygiene mean compromised targets are destroyed and rebuilt, never trusted again.

Project Timeline

From Work to Home

Jun 2025

After building out XCP-ng and Proxmox hosts with Rocky Linux 9 VMs professionally, recreated the stack at home to keep practising without production constraints.

Proxmox Foundation

Aug 2025

Stood up the Proxmox VE host with VM templates for repeatable builds: hardened Rocky Linux 9 servers and an isolated virtual network segmented from the household LAN.

Attack & Defend Loop

Oct 2025

Added the Kali attack box and disposable victim VMs, and settled into the snapshot workflow: clean state, attack, study, roll back, repeat.

Vulnerability Management

Jan 2026

Made Nessus scanning a standing cycle across the fleet — triage, patch or harden, rescan — practising the same loop that matters in professional vulnerability management.

Product Testing Bench

Apr 2026

Turned the lab into the pre-release gate for my own apps: ScamChecker and ForgeLift builds now get a Burp Suite pass from the attack box before shipping.

Security+ Study Labs

Jun 2026

Committed to CompTIA Security+ and began mapping each exam domain to a hands-on lab exercise, using the fleet as the practical side of the study plan.