What the labs, the projects and this site are made of.
A uses page, kept current with the lab. If you are building something similar and want to compare notes, write to me.
The lab
Everything the case studies run on. It is deliberately modest hardware; the point is the design, not the spec sheet.
- Firewall
- pfSense on a dedicated box, holding the gateway on all six VLANs so every inter-segment packet is a firewall decision.
- Switching
- A TP-Link TL-SG108E managed switch carrying 802.1Q tags, with a second switch trunked to the hypervisor.
- Hypervisor
- Proxmox VE on an 8-core, 32 GiB machine with 2.67 TiB of storage, on a trunk port with a single VLAN-aware bridge. Nightly backups to a separate disk.
- Domain
- DC01, Windows Server 2025, the domain controller for ad.biira.online with AD-integrated DNS.
- SIEM
- SIEM01, Wazuh 4.14 on a dedicated 16 GB box after the original host died and forced a better topology.
- Observability
- Grafana and Prometheus as a Proxmox guest.
- Attack host
- KALI01 on its own VLAN with no standing path to anything else.
- Remote access
- Tailscale over WireGuard, with its ability to bypass per-interface rules recorded as an accepted risk rather than ignored.
- Secrets
- HashiCorp Vault, staged on the DevOps VLAN.
- Automation
- Ansible with a dedicated service account, SSH ED25519 keys for Linux and WinRM for Windows.
Identity
The cloud half of the identity lab.
- Primary IdP
- Okta Workforce Identity, integrator tenant, branded at login.biira.online, reached from AD through the Okta AD Agent over outbound HTTPS only.
- Second directory
- Microsoft Entra ID, with hybrid sync and Microsoft 365 planned for the next phase.
- Test applications
- Dropbox Business over SAML 2.0 with provisioning; Box over SWA, to cover both protocol families.
Cloud and code
What the tooling projects are written with.
- Languages
- Python for anything with an API in it, PowerShell for anything with a domain in it, Bash for glue.
- Infrastructure as code
- Terraform for the posture-dashboard targets on AWS and Azure.
- Scanners
- Prowler for AWS, ScoutSuite for Azure.
- Containers
- Docker and Docker Compose; Kubernetes at the KCNA level.
- Monitoring in apps
- Prometheus metrics and Grafana dashboards, even for small services, because a service that cannot report on itself is not finished.
This site
For anyone who wants to build something similar.
- Framework
- Astro, static output, deployed to GitHub Pages by a GitHub Actions workflow on every push.
- Type
- Instrument Serif for display, Inter for text, JetBrains Mono for anything that is data.
- Images
- Screenshots go in as PNG and come out as responsive WebP; the 1.3 MB Okta login page ships at 26 kB.
- Writing
- Markdown in a content collection with the original Jekyll URLs preserved, so nothing indexed broke in the rebuild.
- Assistant
- Claude Code, for the rebuild and for most of the documentation tooling in the lab repositories.