Overview

This project documents the design and implementation of the ElliottSecurity enterprise cybersecurity homelab (Version 1).

The objective is to build a production-inspired environment that supports:

• Detection Engineering
• Threat Hunting
• Digital Forensics
• Incident Response
• Purple Team Exercises
• Infrastructure Automation
• Secure Remote Administration

Rather than functioning as a simple virtualization server, this environment serves as the foundation for technical work published on ElliottSecurity.

The lab is built incrementally. Architecture planning is complete; implementation work is in progress and will be documented as each milestone is finished.

Live build status: Lab Progress (synced from KnowledgeOS).

---

Current Objectives

Near-term priorities:

• Deploy Proxmox infrastructure (DCP-001 complete)
• Install OPNsense / internal networking / WiFi edge bridge (DCP-002 complete)
• Deploy Active Directory / DNS / DHCP (DCP-003 complete)
• Enable WireGuard remote access (DCP-003 complete)
• Build golden templates (Windows, Ubuntu, Kali, REMnux) (DCP-004 complete)
• Operate and harden Elastic Stack / Fleet telemetry — DCP-005 in progress
• Continue role-specific network segmentation for lab workloads
• Complete Elastic storage configuration and broaden agent coverage
• Establish detection engineering workflows
• Publish architecture documentation

These objectives define the Version 1 roadmap. Completion status for each item will be updated as work lands.

---

Live Architecture (current)

Current documented path (high level):

Internet → Home edge → Hypervisor
  → Lab firewall / VPN
  → Identity services (AD / DNS / DHCP)
  → Elastic monitoring / Fleet
  → Lab and analysis workloads

Plane	Purpose
Lab network	Identity, infrastructure, monitoring, and lab guests
Firewall edge	Security boundary, routing, and remote VPN access
Edge bridge	Upstream connectivity without a dedicated Ethernet drop to the server

Domain: lab.elliottsecurity.net

Infrastructure overview

Vertical architecture diagram showing Internet to home router to ES-EDGE-01 WiFi bridge into Proxmox compute, with management network, internal lab services, and planned TrueNAS storage.

Network segmentation

Diagram of documented network planes: edge bridge and firewall protecting role-specific internal lab segments for identity, security, analysis, development, and lab workloads.

Service and access flow

Access flow from administrator or remote user through home network and ES-EDGE-01 to Proxmox management, with OPNsense protecting the internal lab and WireGuard providing remote access.

---

Planned Architecture

The following architecture is the planned Version 1 design. Components listed here are not claimed as deployed unless noted under Current Progress.

Infrastructure

• Proxmox VE ✅
• TrueNAS
• Docker
• GitHub Actions Runner

Networking

• OPNsense ✅ (operational)
• WiFi edge bridge ✅
• WireGuard VPN ✅ (verified)
• Additional VLAN segmentation 🟡 (role-specific migration advanced)
• Internal lab network ✅

Security

• Elastic Security 🟡 (internal stack hardened; Observability/Security validated)
• Sysmon 🟡 (endpoint telemetry validated)
• Zeek
• Suricata

Identity

• Active Directory ✅ (lab.elliottsecurity.net)
• Windows Server domain controller ✅
• DNS ✅ / DHCP ✅
• Organizational-unit foundations ✅
• Group Policy (next)

Offensive Systems

• Kali Linux ✅ (lab workload deployed)
• Atomic Red Team
• Purple Team exercises

Monitoring

• Elastic Stack / Fleet 🟡 (threat-intel enrichment; auditing enabled)
• Grafana
• Prometheus
• System health dashboards

Analysis

• REMnux ✅ (analysis capacity deployed)
• HTB/DFIR analysis guests ✅ (Windows and Linux)

Resilience and backup (planned)

Resilience diagram showing primary Proxmox workloads with partial known-good snapshots, storage capacity as a blocker for broader coverage, a dashed TrueNAS local backup target, and an unlabeled off-site replication box marked not documented.

---

Documentation Strategy

Each major component will receive its own engineering article covering:

• Design decisions
• Architecture diagrams
• Configuration walkthroughs
• Security considerations
• Lessons learned

This page is the canonical landing page for the homelab section and will link outward to those component articles as they are published.

---

Current Progress

Overall Progress: 70% · Current Milestone: DCP-005 · Phase: Monitoring / Telemetry

Progress indicators

Capability	Status
WiFi Bridge	✅ Complete
OPNsense	✅ Complete
Internal Networking	✅ Complete
Network Segmentation	🟡 In Progress
Infrastructure Foundation	✅ Complete
Active Directory	✅ Complete
DNS / DHCP	✅ Complete
WireGuard VPN	✅ Complete
Golden Templates	✅ Complete
Elastic / Monitoring	🟡 In Progress
Analysis Workloads	🟡 In Progress

Completed to date:

• Architecture and roadmap finalized for Version 1
• Publishing structure established on ElliottSecurity Platform
• Installed and hardened Proxmox VE (DCP-001)
• Built WiFi-to-Ethernet edge bridge and OPNsense routing with WireGuard (DCP-002/003)
• Brought Active Directory, DNS, and DHCP online (DCP-003)
• Established AD organizational foundations and privileged-account hardening
• Converted Windows, Ubuntu, Kali, and REMnux golden templates (DCP-004)
• Deployed lab endpoint, Kali, REMnux, and dedicated HTB/DFIR analysis workloads
• Brought an internal Elastic Stack online with Fleet-based Sysmon telemetry ingestion (DCP-005)
• Hardened monitoring access practices, enabled auditing, and added threat-intelligence enrichment
• Validated Observability and Security views for a Windows lab endpoint after time-sync remediation
• Captured known-good snapshots for critical monitoring and edge systems
• Installed additional virtualization storage and migrated golden templates
• Advanced role-specific network segmentation for security, analysis, development, lab, and identity workloads
• Updated internal name resolution and implemented hardened firewall policy
• Expanded Elastic storage capacity and validated service availability after infrastructure changes

Active milestone (DCP-005): complete Elastic storage configuration, broaden endpoint telemetry coverage, and validate first detections.

Canonical public tracker: Lab Progress. Related writeups: Identity and Remote Access Baseline · Golden Template Engineering · Telemetry Platform Progress · Observability Hardening and Reliability.

---

Infrastructure Inventory

Host role	Status
Edge bridge	Active
Lab firewall / VPN gateway	Operational (hardened policy)
Domain controller (AD / DNS / DHCP)	Operational
Golden templates (Windows, Ubuntu, Kali, REMnux)	Complete · migrated to expanded storage
Security monitoring (Elastic / Fleet)	In Progress (storage capacity expanded)
Lab, analysis, and HTB/DFIR workloads	Deployed · segmented networks
Development / automation host	Deployed

Identity foundations, reusable images, expanded analysis capacity, segmented networking, and a hardened Elastic observability path are in place. Storage configuration completion and detection validation are next.

---

Future Articles

Dedicated documentation is planned for:

• Proxmox Cluster
• WireGuard Deployment
• OPNsense Configuration
• Active Directory
• Golden Templates
• Elastic Security
• Detection Engineering
• Threat Hunting
• Purple Team Operations
• Infrastructure Automation
• Backup & Disaster Recovery

Until those articles exist, treat this page as the index and source of truth for Version 1 scope and status.