Category: Component Notes
-
Why Vaultwarden
Somebody has to hold the credentials this lab shares between more than one person, and the ones its own scripts and automation need to authenticate with. Vaultwarden is a self-hosted, Bitwarden-compatible server, and it runs on its own dedicated machine…
-
Why Wazuh
Something has to watch the machines themselves. Not the edge, where attackers arrive from the internet, but the hosts: files changing that should not change, packages with known vulnerabilities, logins that succeeded and should not have, a process doing something…
-
Why Loki
Every machine writes logs, and logs are useless on the machine that wrote them. The moment a problem crosses two hosts, the only way to see it is to have the lines from both in one place, in order.
-
Why Proxmox
Everything in this lab that is not a rented gateway runs as a virtual machine, and something has to run those machines. That job goes to Proxmox: an open source hypervisor platform that turns one physical server into many isolated…
-
Why Caddy
Every web request that reaches this lab from the internet arrives at a reverse proxy first. That proxy terminates the encrypted connection, works out which internal service the request is for, and forwards it there. It is also responsible for…
-
Why Rathole
The services in this lab run on machines at home, behind a consumer internet connection. Some of them need to be reachable from the public internet. The home network has no ports open to the internet and no port forwarding…
-
Why Authentik
An identity provider is the thing that knows who you are, so that eighteen other things do not have to. You log in once, to it, and every service in the lab accepts that login instead of maintaining its own…
-
Why Unbound
Every connection to anything starts with a name being turned into an address. In this lab that translation is done by two machines the lab owns, running Unbound, rather than by the internet provider’s resolver or by whatever the router…
-
Why Headscale
The machines in this lab are not all in the same place. Some are virtual machines at home, some are servers rented in other countries, and some are the devices people actually carry: laptops, phones and tablets, moving between home…
-
Why CrowdSec
Anything with a public address is attacked continuously, within minutes of existing, by software that is not interested in what it found. The rented gateways in this lab carry that traffic all day.