Series
Home Lab
9 partsStanding the lab up and keeping a way back into it — the firewall rebuild underneath, VPNs and DNS, an inventory of what is really there, and a dashboard over the top.
- Debugging a Dead VMware NAT and Hardening My pfSense Containment Lab
- Implementing LaMetric TIME to Network
- Implementing LaMetric TIME to Network Part 2
- Self-Hosted WireGuard Through a Nested Firewall — and the Four-Layer Debug to Make It Work
- A Front Door for the Home Lab
- Two VPNs, One Phone: Consolidating Remote Access
- One DNS Filter, Three Clients That All Bypass It Differently
- Trying NetBox in My Home Lab
- Resolve and maintenance of the homelab server
Agents in the Lab
6 partsAI given real access to the infrastructure, and the controls built around it — one gateway for many models, traces of what an agent actually did, hash-chained evidence, and an approval gate it cannot talk its way past.
- Syncing Claude Code Across Devices with a Custom MCP Hub over Tailscale
- Implementing Langfuse to Monitor Claude Code
- A Self-Hosted Multi-LLM Gateway for My Homelab
- Auditing the AI Agent That Runs My Homelab
- Three Agents, One Approval Gate — Making Claude, Codex and Kimi Review Each Other
- The Council Gets a Front Door
Detection Engineering
5 partsLooking for trouble on purpose — the first vulnerability scan, rules written against the lab's own logs and metrics, and a map of what should be listening checked against what actually answers.
- Running OpenVAS in My Home Lab — Install, the Three Things That Broke, and the First Scan
- A Vulnerability Scan From Codex, a Container Upgrade From Claude Code
- A SOC for the homelab, built in the right order
- Integrating Kimi as a read-only AI security analyst for my homelab SOC
- A network digital twin: does my homelab still look the way I think it does?
Building the Blog
4 partsThe site itself as a project — a Hugo + Claude Code publishing pipeline, a move to Cloudflare Pages for real security headers, a hardened domain of its own, then a second agent and a leak gate between the lab and the repository.
Built With Claude
4 partsPrograms built end-to-end by directing Claude Code — from a one-sentence spec to a hardened, packaged tool.
Hardening Network
4 partsLocking the network down properly — segmentation, firewall rules and host hardening, every step proven rather than assumed.
Keeping It Running
4 partsThe unglamorous half — a backup proven by restoring it, a watchdog that found five days of silent failure, patching the half apt cannot see, and the week one directory move broke four things.
AAA
3 partsAuthentication, authorization, and accounting across the homelab — a self-hosted vault, then one identity provider with MFA everywhere, from web dashboards to the firewall's own login.
Watching the Lab
3 partsGiving the lab a way to say something is wrong — metrics first, then alerts that reach a phone, then the logs behind them. Dashboards you have to remember to check are not monitoring.
Build and Battle
2 partsThe TAFE capstone: a nine-zone SOC network designed and built as a group, then attacked and defended live over four fixed-role rounds, with every claim backed by a screenshot.
Game Modding
2 partsModding games with agents — reviving abandoned Single Player Tarkov mods on modern APIs, then a Witcher 3 pipeline where an agent builds, a gate checks the output, and a person installs. The catalogue is /mods/.
Apps With Claude Integration
1 partsClaude embedded inside the apps themselves rather than driven from a terminal next to them — starting with the note vault where everything else gets written down first.