What the labs, the projects and this site are made of.
A uses page, kept current with the lab. If you are building something similar and want to compare notes, write to me.
The lab
Everything the case studies run on. It is deliberately modest hardware; the point is the design, not the spec sheet.
- Firewall
- pfSense on a dedicated box, holding the gateway on all six VLANs so every inter-segment packet is a firewall decision.
- Switching
- A TP-Link TL-SG108E managed switch carrying 802.1Q tags, with a second switch trunked to the hypervisor.
- Hypervisor
- Proxmox VE on an 8-core, 32 GiB machine with 2.67 TiB of storage, on a trunk port with a single VLAN-aware bridge. Nightly backups to a separate disk.
- Domain
- DC01, Windows Server 2025, the controller for the corp.biirabank.com forest with AD-integrated DNS. WKS01 is the first member workstation.
- SIEM
- SIEM01, Wazuh 4.14.7 on a dedicated 16 GB box after the original host died and forced a better topology. Three agents reporting: DC01, ADM01, PVE01.
- Observability
- MON01, Grafana and Prometheus, being rebuilt as a Proxmox guest now that its old hardware is the SIEM.
- Applications
- APP01 on the DevOps VLAN, Ubuntu 26.04 LTS, two web applications behind Tailscale Serve.
- Vulnerability scanning
- SCAN01, Greenbone Community Edition in containers on its own VM, with a scan identity that is a local administrator on member machines and nothing on the domain.
- Attack host
- KALI01 on its own VLAN with no standing path to anything else.
- Remote access
- Tailscale over WireGuard, with its ability to bypass per-interface rules recorded as an accepted risk rather than ignored.
- Secrets
- HashiCorp Vault, planned as VAULT01, its own Proxmox guest on the DevOps VLAN. Never on the same host as a web application.
- Automation
- Ansible with a dedicated service account, SSH ED25519 keys for Linux and WinRM for Windows. The controller, ANS01, is being rebuilt as a Proxmox guest.
Identity
The cloud half of the identity lab.
- Primary IdP
- Okta Workforce Identity, reached from AD through the Okta AD Agent over outbound HTTPS only. The first tenant was deleted for inactivity; the replacement is being built with Terraform so it can be replayed.
- Second directory
- Microsoft Entra ID, with hybrid sync and Microsoft 365 planned for the next phase.
- Test applications
- Dropbox Business over SAML 2.0 with provisioning; Box over SWA, to cover both protocol families.
- Public tier
- biirabank.com on Cloudflare Workers static assets, strict TLS, security headers and no client-side scripting. The bank needed a face the internet can reach.
Cloud and code
What the tooling projects are written with.
- Languages
- Python for anything with an API in it, PowerShell for anything with a domain in it, Bash for glue.
- Infrastructure as code
- Terraform for the posture-dashboard targets on AWS and Azure.
- Scanners
- Prowler for AWS, ScoutSuite for Azure.
- Containers
- Docker and Docker Compose; Kubernetes at the KCNA level.
- Monitoring in apps
- Prometheus metrics and Grafana dashboards, even for small services, because a service that cannot report on itself is not finished.
This site
For anyone who wants to build something similar.
- Framework
- Astro, static output, deployed to GitHub Pages by a GitHub Actions workflow on every push, on a domain registered at cost with Cloudflare.
- Type
- Instrument Serif for display, Inter for text, JetBrains Mono for anything that is data.
- Images
- Screenshots go in as PNG and come out as responsive WebP; the 1.3 MB Okta login page ships at 26 kB.
- Writing
- Markdown in a content collection with the original Jekyll URLs preserved, so nothing indexed broke in the rebuild.
- Assistant
- Claude Code, for the rebuild and for most of the documentation tooling in the lab repositories.