Security

Build one controlled browser access path, test who is denied as carefully as who is allowed, and keep recovery independent of Cloudflare and your identity provider.

Build the host before the routers: choose a storage layout, preserve provider WAN connectivity, prepare isolated bridges, and prove emergency recovery.

Route only required workload subnets and keep host recovery outside the tunnel.

Build an isolated AD DS lab with integrated DNS, a second domain controller, validation checks, and a clear production boundary.

A staged design for synchronizing a small, deliberate set of identities and validating SSO, MFA, monitoring, and recovery before expanding scope.

Scope LAPS support access to one OU, keep read and rotation roles separate, and verify both successful decryption and denial outside the intended scope.

Harden Proxmox VE with datacenter firewalls, dynamic IPSets for trusted management networks, cluster-wide security, fail2ban for web UI brute-force protection, and firewall log auditing.

Learn to secure Proxmox API access using API tokens and fine-grained RBAC. Covers token creation, role-based permission separation, Terraform/Ansible integration, and audit logging — all without exposing root credentials.

Run containers without a root daemon. Migrate your homelab from Docker to Podman for true rootless operation, systemd-native container management, and drop-in docker CLI compatibility.

Practical guide to securing your container supply chain in the homelab: generate SBOMs with Syft, sign images with Cosign, scan for vulnerabilities with Grype, and enforce Docker Content Trust.