The Lab · Oklahoma · one mini PC

Cybersecurity student.
Homelab operator.

Cybersecurity student and homelab tinkerer from Oklahoma. I got into self-hosting out of curiosity, it kind of snowballed, and now I have 23 containers, a media library, a VPN, and way too many late nights debugging DNS.

Explore the lab About me Live telemetry

Transcript

a real, sandboxed shell

❯ docker ps -q | wc -l

23 (live)

❯ pvesh get /nodes/Mothership/status

CPU 4% RAM 17.3/33GB

❯ qm list | grep running | wc -l

2 VMs running

❯ curl ifconfig.me # your public IP

216.73.217.68

this is a real shell — type help and hit ↵

❯█

your IP is shown only to you · not stored · see privacy

containers: 23live
proxmox cpu: 4%live
host ram: 17.3/33 GB
vms running: 2live
uptime: 24/7target

The lab, drawn

live · one square per running container

Schematic of the homelab: 23 containers running (live count) on ubuntu-docker-1 inside a Proxmox host, host CPU 4%, host RAM 17.3/33 GB, with Cloudflare, Tailscale and a VPN around it, and the media library on the host's second NVMe.

Machines:

Proxmox host "Mothership" (i5-8500), running two VMs:
ubuntu-docker-1 — 23 containers running · host CPU 4%, host RAM 17.3/33 GB
Home Assistant — MQTT, voice
Media disk — the host's second NVMe, 430 GB, attached to ubuntu-docker-1
Internet — the public side
Cloudflare — 0 open ports
Tailscale — subnet route
Pia vpn — gluetun · us

Links:

Internet to Cloudflare: HTTPS
Cloudflare to ubuntu-docker-1: tunnel (public traffic)
Tailscale to ubuntu-docker-1: WireGuard (private)
ubuntu-docker-1 to PIA VPN: VPN egress
ubuntu-docker-1 to the media disk: local virtual disk

public, via tunnelprivate / encryptedstorage1 square = 1 running container

Security tools

interactive · nothing is stored

Password strength

entropy · crack time · never leaves your browser

password to measure

IP reputation

Shodan InternetDB · public exposure record

IPv4 address to look up

sends the address you enter to Shodan when you press Check · privacy

Featured projects

the full record →

01Vaultwarden

Zero-Trust Access & Security

Vaultwarden, Nginx Proxy Manager, Cloudflare Tunnels, Tailscale subnet routing, and Fail2ban. Nothing public-facing has an open port.

VaultwardenCloudflare TunnelFail2banTailscale

02Jellyfin

Self-Hosted Media Stack

Jellyfin + full *arr stack with qBittorrent tunneled through Gluetun VPN, so nothing leaks if the tunnel drops.

JellyfinRadarrSonarrGluetunDocker

Tech stack

in the lab, at work, and while breaking things on purpose

Pentesting08

Kali Linux
nmap
gobuster
TryHackMe
CTF competitions
Flipper Zero
Pwnagotchi
Dual ESP32

Containers04

Docker
Docker Compose
Watchtower
Portainer

Networking05

DNS (AdGuard)
Reverse Proxy (NPM)
VPN (Gluetun/PIA)
Tailscale
Cloudflare Tunnels

Linux04

Ubuntu Server
systemd
iptables / DOCKER-USER
NFS / fstab

Security04

Fail2ban
Vaultwarden
Let's Encrypt
Zero-Trust Access

Monitoring01

Uptime Kuma

Self-Hosted AI04

Claude CLI pipelines
Directing AI to build things
FastAPI / Python stacks
cron automation

Cybersecurity student.Homelab operator.