Noble AntwiCloud Security & Identity Engineer
Biira Bank · living architectureUpdated 4 November 2026

Biira Bank · enterprise security lab

One bank. Six networks. Every trust, drawn in light.

This is the lab as it stands today, rendered in code from the same data as its documentation. Scroll to walk through it, layer by layer.

12hosts built
7Wazuh agents
6VLANs

Click any building for its details

01 · Outside the walls

In from anywhere, without opening a door.

The admin laptop and phone reach the lab over a Tailscale WireGuard mesh, with pfSense as the subnet router. Since November 2026 connections are routed, not remade, so every log names the real device that connected.

WireGuardreal source IP in every log

02 · One wall

Default deny, on every interface.

pfSense 2.9.0 runs router-on-a-stick: one 802.1Q trunk carries six VLANs to a managed switch. Nothing crosses between networks unless a written rule says it may.

6 VLANs1 trunkpfSense 2.9.0

03 · One hypervisor, many guests

Each guest lands on its own network by tag.

PVE01 runs Proxmox VE on a trunk port. One VLAN-aware bridge places every virtual machine on the right network, and every guest is backed up nightly.

8 cores32 GBnightly backups

04 · Tier 0: identity and secrets

The keys to the bank, kept together.

DC01 holds the people. CA01 issues the passports. IDP01 signs people and programs in. VAULT01 holds the secrets. Each one proves itself with a certificate from the Biira Bank Root CA.

LDAPS onlyown root CAMFA for admins

05 · On the record

Every host reports to one place.

Seven agents ship their events to SIEM01, where Wazuh decodes each one and alerts on the few that matter. SCAN01 runs credentialed scans as an account that holds nothing on the domain.

7 agentsWazuh 4.14.7credentialed scans

06 · A machine with its own identity

The AI agent signs in like a person does.

The Ask-my-SIEM agent on APP01 proves who it is to Keycloak and gets a token that lives five minutes. Next, Vault will swap that token for a short-lived Wazuh credential, and the agent stops carrying a password at all.

5-minute tokensone off switchVault: next

07 · The attacker gets a room

Not the house.

KALI01 lives on its own network for attack practice. A written ruleset keeps it away from the domain controller and the firewall admin page, and a test proved it.

VLAN 30containment tested

08 · Still being built

A lab that keeps changing.

Gold dashed shapes are planned, not built: monitoring returns as MON01, automation as ANS01, and Vault starts handing the agent its secrets. When they land, this page redraws from the same data.

MON01ANS01Vault for the agent
Scroll · click any building
The same data, as a table

Every host in the estate

The 3D lab above is drawn from this list. When a host is built, renamed or retired, one line changes and the whole architecture redraws itself.

HostNetworkAddressRoleMonitoringCurrent buildState
ADM01VLAN 10 · Management192.168.10.3Admin laptopAgent 0022025built
PVE01VLAN 10 · Management192.168.10.6Proxmox VE hypervisorAgent 003May 2026built
LAB01VLAN 10 · Management192.168.10.4Practice hostNone yet2025built
ANS01VLAN 10 · Management192.168.10.2Ansible controllerNone yetNextplanned
SIEM01VLAN 20 · BlueTeam192.168.20.2Wazuh 4.14.7 managerWazuh managerSeptember 2026built
SCAN01VLAN 20 · BlueTeam192.168.20.3 · VM 104Greenbone scannerNone yetSeptember 2026built
KALI01VLAN 30 · RedTeam192.168.30.2 · VM 103Attack host, containedNone yetSeptember 2026built
APP01VLAN 40 · DevOps192.168.40.2Apps and the AI agentAgent 0052025built
DC01VLAN 50 · EnterpriseLAN192.168.50.2Active Directory, DNSTier 0Agent 001September 2026built
CA01VLAN 50 · EnterpriseLAN192.168.50.3 · VM 105Biira Bank Root CATier 0None yetOctober 2026built
IDP01VLAN 50 · EnterpriseLAN192.168.50.4 · VM 106Keycloak identity providerTier 0Agent 006October 2026built
VAULT01VLAN 50 · EnterpriseLAN192.168.50.5 · VM 107HashiCorp Vault 2.2.1Tier 0Agent 007November 2026built
WKS01VLAN 50 · EnterpriseLANDHCP · VM 100Windows 11 workstationAgent 004September 2026built
MON01VLAN 60 · Monitoring192.168.60.2 · VM 102Grafana and PrometheusNone yetNextplanned

12 hosts built, 2 planned, 7 Wazuh agents. Addresses are private lab addresses. Every host is documented in the enterprise security homelab case file and its repository ↗.