Infrastructure · Security
A small homelab with a real threat model
Defense in depth for useful self-hosting, designed around private access, constrained failure domains, and recoverability.
Threat model
Remote access should not require making private services public.
The design assumes internet-originated scanning, stolen endpoint credentials, vulnerable applications, accidental administrator actions, and storage failure. It avoids treating a single firewall or password as the complete security boundary.
Architecture
Layer controls so one mistake is not the whole incident.
Private overlay network
Administrative and application access travels over authenticated private networking rather than inbound public ports.
Default-deny hosts
Host firewalls explicitly admit required traffic and keep management paths narrower than application access.
Least-privileged services
Applications run as dedicated non-administrative identities with resource limits and service-specific access.
Backups proved by restore
Encrypted scheduled backups are monitored, and a restore test verifies more than the existence of backup files.
Outcome
A maintainable security posture, not a maximalist one.
The resulting environment supports persistent private services, centralized storage, and remote administration without public application exposure. Automated security updates and recurring audits reduce routine maintenance, while documented recovery paths make failure less dramatic.
This case study is intentionally sanitized. Hostnames, addresses, firewall rules, service URLs, account names, and topology details are omitted.