./tag

I build and defend the network I live on.

Hi, I'm Joseph Henry Cariazo. I work in IT, and I love building things, then self-hosting, automating and securing them. At home I run my network like a small enterprise: every system is patched, hardened, segmented, monitored and protected against outages, access follows zero-trust principles, and I get alerted to failures and anomalies.

See what runs in production Visit the lab
Home production network map Map of the home production network. Visitors reach Cloudflare, which forwards through an outbound tunnel to cloudflared in an isolated DMZ VLAN, where nginx serves the site. The internet connects to the OPNsense firewall with no inbound ports open. The firewall separates LAN, IoT, Servers and DMZ VLANs; Traefik on LAN serves internal services only. Internet Cloudflare edge visitors, HTTPS WAN: no inbound ports OPNsense firewall Suricata IDS, Unbound over DoT, Kea DHCP, Tailscale LAN IoT Servers DMZ Workstations UniFi 6+ AP Pi-hole DNS Traefik proxy Docker, 20 apps Tapo devices ESP32-S3 node OMV NAS Proxmox, Wazuh cloudflared nginx website visit counter tunnel, outbound only
Production today. Public traffic arrives only through an outbound tunnel into the DMZ, which can reach nothing else on the network.

In production

These run 24/7 and my household depends on them. Each is held to the same three rules.

Publishing with zero open ports

In production

This site. Public traffic arrives through an outbound Cloudflare Tunnel into a dedicated DMZ, where nginx serves the pages. Internal services sit behind a separate Traefik v3 proxy with one wildcard Let's Encrypt certificate, so LAN-only apps get trusted HTTPS without ever being exposed.

Secured by: no inbound firewall ports; a DMZ that can reach only DNS and Cloudflare; web containers with no network access at all; separate public and internal proxies; a strict Content-Security-Policy and a rate-limited counter API.

Cloudflare Tunnel, nginx, Traefik, Let's Encrypt, Docker, OPNsense

Segmented home network

In production

OPNsense on my own hardware splits the house into LAN, IoT, Servers and DMZ VLANs. DHCP runs on Kea, DNS is filtered by Pi-hole and resolved upstream over DNS-over-TLS, and Tailscale provides remote access.

Secured by: deny-by-default rules between VLANs, a DMZ for anything internet-facing, Suricata IDS, and Monit alerts to Slack.

OPNsense, VLANs, Suricata, Pi-hole, Unbound, Kea, Tailscale

Self-hosted services on Raspberry Pi

In production

Around twenty containers on Debian Trixie, deployed as Portainer stacks with one consistent data layout: UniFi controller, Jellyfin, Pi-hole and more, plus an OpenMediaVault NAS on a second Pi.

Secured by: services reachable only through Traefik, SMB limited to trusted VLANs, data kept on bind mounts for clean backups.

Docker, Portainer, Debian, OpenMediaVault, Samba, UniFi

Monitoring and asset discovery

In production

Uptime Kuma checks every service and certificate, and NetAlertX scans all VLANs for new devices.

Secured by: an unknown device on the network gets noticed instead of quietly joining it.

Uptime Kuma, NetAlertX

Presence-aware home automation

In production

Home Assistant turns lights off when nobody is home, using UniFi presence. An ESP32-S3 running ESPHome acts as a Bluetooth proxy, and alerts reach my phone through ntfy.

Secured by: smart devices isolated on their own VLAN, Home Assistant kept off the internet.

Home Assistant, ESPHome, ESP32-S3, ntfy

Whole-house audio

In production

Music Assistant with Squeezelite on the Pi 4 plays my Jellyfin library to a Bluetooth speaker, and Home Assistant controls it like any other device in the house.

Secured by: kept on the home network with no internet exposure, and controlled only through Home Assistant.

Music Assistant, Squeezelite, Jellyfin, Home Assistant

Virtualization and SIEM

Rebuilding

A Proxmox host runs my production virtual machines, including a Wazuh SIEM on Ubuntu Server 24.04 that collects logs from the hosts around it. Now and then I spin up a short-lived VM there to test a change before it goes live.

Secured by: central logging into Wazuh, and test VMs that are removed once the test is done.

Proxmox, Wazuh, Ubuntu Server

The hardware

In production

Physical devices, running 24/7 in my home.

  • Firewall appliance: OPNsense, 8 GB RAM, 4× gigabit ports, separate log disk
  • TP-Link TL-SG105PE: managed PoE switch carrying the tagged VLANs
  • UniFi 6+: Wi-Fi 6 access point
  • Raspberry Pi 5: 8 GB, NVMe, Docker host
  • Raspberry Pi 4: 4 GB, SATA SSD, OpenMediaVault NAS
  • Proxmox host: production VMs, including Wazuh
  • Windows desktop: VMware Workstation for the practice lab
  • ESP32-S3: ESPHome sensor node and Bluetooth proxy

The lab

Where I practice. Nothing here is load-bearing, so I can break it on purpose.

VMware Workstation practice lab

Always changing

Most of my hands-on learning happens in VMware Workstation on my Windows desktop: virtual networks and machines I can build, attack, break and rebuild without touching anything the household depends on. The attack simulations, detection rules and incident write-ups that come out of it are in my Cyber Defense Lab.

Kept apart by: lab VMs live on my desktop, away from the production servers, and get torn down when I'm done.

VMware Workstation, Windows, Linux VMs

Read the Cyber Defense Lab write-ups

On the workbench

Planned changes. Each gets tested before it touches production.

On GitHub

My professional portfolio, with detection engineering and SOC work from the lab, lives on GitHub.

Cyber Defense Lab: my portfolio Assumed-breach operations, Sigma, Wazuh and Splunk detections tested as code, and incident write-ups. dotslashtag.github.io/cyber-defense-lab All repositories My GitHub profile, with the code behind these projects. github.com/dotslashtag

Say hello

Running something similar, spotted a mistake, or want to compare notes? Say hello. For work, see my portfolio on GitHub.