Overview

This page showcases the design and implementation of the ElliottSecurity enterprise cybersecurity homelab (Version 1 — complete).

The environment is a production-inspired lab that supports:

• Detection Engineering
• Threat Hunting
• Digital Forensics
• Incident Response
• Purple Team Exercises
• Infrastructure Automation
• Secure Remote Administration

Rather than functioning as a simple virtualization server, this environment is the foundation for technical work published on ElliottSecurity.

Homelab Version 1 is complete. Historical build milestones remain documented in Articles and KnowledgeOS; this page is the public showcase, not an active progress tracker.

---

Version 1 objectives (complete)

• Deploy Proxmox infrastructure (DCP-001 complete)
• Install OPNsense / internal networking / WiFi edge bridge (DCP-002 complete)
• Deploy Active Directory / DNS / DHCP (DCP-003 complete)
• Enable WireGuard remote access (DCP-003 complete)
• Build golden templates (Windows, Ubuntu, Kali, REMnux) (DCP-004 complete)
• Operate and harden Elastic Stack / Fleet telemetry (DCP-005 complete)
• GPO baselines against the OU model (user-reported complete)
• Malware incident-response playbook and worksheet (committed)

Detection engineering and threat hunting remain separate portfolio tracks — not Homelab DCP milestones. AD CS is not used in this lab.

---

Live Architecture (current)

Current documented path (high level):

Internet → Home edge → Hypervisor
  → Lab firewall / VPN
  → Identity services (AD / DNS / DHCP)
  → Elastic monitoring / Fleet
  → Lab and analysis workloads

Plane	Purpose
Lab network	Identity, infrastructure, monitoring, and lab guests
Firewall edge	Security boundary, routing, and remote VPN access
Edge bridge	Upstream connectivity without a dedicated Ethernet drop to the server

Domain: lab.elliottsecurity.net

Infrastructure overview

Vertical architecture diagram showing Internet to home router to ES-EDGE-01 WiFi bridge into Proxmox compute, with management network, internal lab services, and planned TrueNAS storage.

Network segmentation

Diagram of documented network planes: edge bridge and firewall protecting role-specific internal lab segments for identity, security, analysis, development, and lab workloads.

Service and access flow

Access flow from administrator or remote user through home network and ES-EDGE-01 to Proxmox management, with OPNsense protecting the internal lab and WireGuard providing remote access.

---

Planned Architecture

The following architecture is the planned Version 1 design. Components listed here are not claimed as deployed unless noted under Current Progress.

Infrastructure

• Proxmox VE ✅
• TrueNAS
• Docker
• GitHub Actions Runner

Networking

• OPNsense ✅ (operational)
• WiFi edge bridge ✅
• WireGuard VPN ✅ (verified)
• Additional VLAN segmentation ✅ (applicable workloads on role-specific segments)
• Internal lab network ✅

Security

• Elastic Security ✅ (intended collection scope complete; Essential endpoint protection on lab Windows policy)
• Sysmon ✅ (lab endpoint and domain-controller telemetry paths in place)
• Zeek
• Suricata

Identity

• Active Directory ✅ (lab.elliottsecurity.net)
• Windows Server domain controller ✅
• DNS ✅ / DHCP ✅
• Organizational-unit foundations ✅
• Group Policy ✅ (baseline reported implemented and working)

Offensive Systems

• Kali Linux ✅ (lab workload deployed)
• Atomic Red Team
• Purple Team exercises

Monitoring

• Elastic Stack / Fleet ✅ (threat-intel enrichment; auditing enabled; retention confirmed)
• Grafana
• Prometheus
• System health dashboards

Analysis

• REMnux ✅ (analysis capacity deployed)
• HTB/DFIR analysis guests ✅ (Windows and Linux)

Resilience and backup (planned)

Resilience diagram showing primary Proxmox workloads with partial known-good snapshots, storage capacity as a blocker for broader coverage, a dashed TrueNAS local backup target, and an unlabeled off-site replication box marked not documented.

---

Documentation Strategy

Each major component will receive its own engineering article covering:

• Design decisions
• Architecture diagrams
• Configuration walkthroughs
• Security considerations
• Lessons learned

This page is the canonical landing page for the homelab section and will link outward to those component articles as they are published.

---

Showcase status

Homelab Version 1: Complete (100%) · DCP-001–005 finished · Sustainment only

Capability snapshot

Capability	Status
WiFi Bridge	✅ Complete
OPNsense	✅ Complete
Internal Networking	✅ Complete
Network Segmentation	✅ Complete
Infrastructure Foundation	✅ Complete
Active Directory	✅ Complete
DNS / DHCP	✅ Complete
WireGuard VPN	✅ Complete
Golden Templates	✅ Complete
Elastic / Monitoring	✅ Complete
Analysis Workloads	✅ Complete
Malware Procedures	✅ Complete

Completed to date:

• Architecture and roadmap finalized for Version 1
• Publishing structure established on ElliottSecurity Platform
• Installed and hardened Proxmox VE (DCP-001)
• Built WiFi-to-Ethernet edge bridge and OPNsense routing with WireGuard (DCP-002/003)
• Brought Active Directory, DNS, and DHCP online (DCP-003)
• Established AD organizational foundations and privileged-account hardening
• Converted Windows, Ubuntu, Kali, and REMnux golden templates (DCP-004)
• Deployed lab endpoint, Kali, REMnux, and dedicated HTB/DFIR analysis workloads
• Brought an internal Elastic Stack online with Fleet-based Sysmon telemetry ingestion (DCP-005)
• Hardened monitoring access practices, enabled auditing, and added threat-intelligence enrichment
• Validated Observability and Security views for a Windows lab endpoint after time-sync remediation
• Captured known-good snapshots and completed the VM snapshot campaign
• Installed additional virtualization storage and confirmed the 2 TB host split
• Migrated applicable workloads onto role-specific network segments with reverse DNS
• Implemented hardened firewall policy with reusable aliases and VPN reachability across lab prefixes
• Confirmed Elastic lifecycle retention and closed disclosed credential hygiene
• Validated an initial adversary-emulation exercise against a lab endpoint with confirmed monitoring evidence
• Group Policy baseline reported implemented and working
• Inventory validation recorded (renames and additional security/attack/vulnerable guests)
• Malware incident-response playbook and worksheet committed

Related writeups: Identity and Remote Access Baseline · Golden Template Engineering · Telemetry Platform Progress · Observability Hardening and Reliability.

---

Infrastructure Inventory

Host role	Status
Edge bridge	Active
Lab firewall / VPN gateway	Operational (role-segment routing · hardened policy · aliases)
Domain controller (AD / DNS / DHCP)	Operational
Golden templates (Windows, Ubuntu, Kali, REMnux)	Complete · migrated to expanded storage
Security monitoring (Elastic / Fleet)	Operational (intended collection scope complete)
Lab, analysis, and HTB/DFIR workloads	Deployed on role-specific segments
Development / automation host	Deployed on development segment

Identity foundations, reusable images, expanded analysis capacity, role-specific segmentation, hardened firewall policy, centralized monitoring, Group Policy baseline, and malware IR procedures are in place. Enterprise Homelab Version 1 is complete; detections and hunts are tracked separately.

---

Future Articles

Dedicated documentation is planned for:

• Proxmox Cluster
• WireGuard Deployment
• OPNsense Configuration
• Active Directory
• Golden Templates
• Elastic Security
• Detection Engineering
• Threat Hunting
• Purple Team Operations
• Infrastructure Automation
• Backup & Disaster Recovery

Until those articles exist, treat this page as the index and source of truth for Version 1 scope and status.