- FirewallOpenBSD with pf: default deny, every rule named, every decision logged.
- NetworksEight networks, each with its own purpose and its own rules.
- Wi-FiOne access point, four networks, and a self-hosted controller with no cloud account.
- Kubernetes clusterFive Raspberry Pi CM5 boards on one carrier, run entirely from Git.
- SIEMOpenSearch on the cluster: every firewall decision, every Falco event and the web server's logs, searchable, with alerts.
- Home AssistantHome automation on its own Raspberry Pi, allowed into the IoT network and nothing more.
- Web serverThe cloud server this site runs on: outside the home network, with no way into it.
A homelab, end to end
One OpenBSD firewall, eight separated networks, every connection through a VPN with a kill switch, and a Raspberry Pi Kubernetes cluster that watches it all. Hover a network to trace its way out; click anything to see what runs there, and why.
Every box is a page: click one to see what runs there, and why.
Between networks, only these are allowed; everything else is blocked and logged. Hover or tap one to see it in the diagram.