Live Running k3s + CrowdSec on phantomlab.boo

My homelab. Automated. Always evolving.

Docker, Ansible, Terraform, Kubernetes — managed as code and deployed privately via Tailscale. No public ports. No compromises.

phantomlab.boo — bring-up
$ docker compose up -d traefikreverse proxy · TLS socket-proxyread-only docker.sock crowdsecIDS engine prometheusmetrics scrape lokilog aggregation grafanadashboards portainercontainer mgmt ✔ 7 services healthy · phantomlab.boo
Built with
Docker Ansible Terraform k3s Tailscale
Architecture

One repo. Everything automated.

Terraform provisions the networks and volumes. Compose runs the containers. Ansible configures everything. Packer builds the golden images. Traefik handles routing and TLS. It all comes up in order with a single command.

See the bring-up order
Stack

Pro tooling. Zero cloud bills.

Full observability. Out of the box.

Prometheus scrapes every service. Grafana Alloy ships logs to Loki. Grafana dashboards everything. Node Exporter and cAdvisor cover the host and containers. No blind spots.

Grafana dashboard
phantomlab.boo · overview live CPU 23% MEMORY 41% CONTAINERS 7 up prometheus · http_request_rate

Security baked in at every layer.

CrowdSec reads Traefik access logs and bans bad IPs inline via the bouncer middleware. The Docker socket is read-only via socket-proxy. Secrets never touch git — gitleaks, trivy, and checkov run before every commit.

Security overview
traefik · access log crowdsec · 2 bans 203.0.113.42 GET / 200 45.79.142.11 POST /login 403 · banned 198.51.100.9 GET /grafana 200 185.220.101.4 GET /.env 403 · banned 192.0.2.55 GET /portainer 200 bouncer middleware · inline ban on 100% of HTTPS traffic
What's Running

Seven services. Four VMs. One k3s cluster.

Docker Services

7 running

Traefik, Portainer, Grafana, Prometheus, Loki, CrowdSec, and k3s — all containerised, all managed with Compose.

VirtualBox VMs

4 running

Four VMs on host-only 192.168.56.0/24 — two Debian 13 Ansible targets and two Kali rolling pentest workstations.

Packer Golden Images

2 built

Fully automated OVA builds for debian-base and kali-base. Import, boot, get a hardened baseline. Reproducible every time.

Private by Design

secured

No public ports. Tailscale mesh for all access. Let's Encrypt TLS via DNS challenge. Norton CA trusted in WSL2 and containers.

All systems operational · phantomlab.boo
7
Docker services
4
VMs running
2
Golden OVAs
1
k3s cluster
Roadmap

Done. What's next.

"Observability stack complete — Prometheus, Loki, Alloy, Grafana. Full metrics and log aggregation across all services."

Status
Shipped

"CrowdSec IDS + Traefik bouncer live. Real-time IP banning on all HTTPS traffic based on access log analysis."

Status
Shipped

"Next up: local DNS with Pi-hole or AdGuard to replace per-service Netlify A records. CI/CD pipeline after that."

Status
In progress

Everything's running. Come see how.

A personal homelab built to learn, experiment, and break things safely. All IaC, all private, all documented.