Docker, Ansible, Terraform, Kubernetes — managed as code and deployed privately via Tailscale. No public ports. No compromises.
Terraform provisions the networks and volumes. Compose runs the containers. Ansible configures everything. Packer builds the golden images. Traefik handles routing and TLS. It all comes up in order with a single command.
See the bring-up orderPrometheus scrapes every service. Grafana Alloy ships logs to Loki. Grafana dashboards everything. Node Exporter and cAdvisor cover the host and containers. No blind spots.
Grafana dashboardCrowdSec reads Traefik access logs and bans bad IPs inline via the bouncer middleware. The Docker socket is read-only via socket-proxy. Secrets never touch git — gitleaks, trivy, and checkov run before every commit.
Security overviewTraefik, Portainer, Grafana, Prometheus, Loki, CrowdSec, and k3s — all containerised, all managed with Compose.
Four VMs on host-only 192.168.56.0/24 — two Debian 13 Ansible targets and two Kali rolling pentest workstations.
Fully automated OVA builds for debian-base and kali-base. Import, boot, get a hardened baseline. Reproducible every time.
No public ports. Tailscale mesh for all access. Let's Encrypt TLS via DNS challenge. Norton CA trusted in WSL2 and containers.
"Observability stack complete — Prometheus, Loki, Alloy, Grafana. Full metrics and log aggregation across all services."
"CrowdSec IDS + Traefik bouncer live. Real-time IP banning on all HTTPS traffic based on access log analysis."
"Next up: local DNS with Pi-hole or AdGuard to replace per-service Netlify A records. CI/CD pipeline after that."
A personal homelab built to learn, experiment, and break things safely. All IaC, all private, all documented.