Projects

🏠 Self-hosted Linux infrastructure

Two Debian servers (Raspberry Pi 4) running 24/7. The goal: make services securely reachable from the internet without opening a single port on the router – and run them so that a failure gets noticed and can be fixed. This website runs on this infrastructure.

Setup

• Services: web server (nginx), password manager (Vaultwarden), DNS filter (AdGuard Home), file sharing, monitoring (Uptime Kuma, Netdata) – all as Docker containers, managed with Compose and Portainer.
• Access: published via Cloudflare Tunnel (Zero Trust) instead of port forwarding; remote administration via Tailscale with a subnet router into the home network.
• Second server: handles monitoring and receives the backups of the first server.

Security

• Key-only SSH, password and root login disabled; fail2ban against brute force.
• TLS ≥ 1.2, HSTS and security headers incl. Content Security Policy for the website.
• Public-facing container without root privileges, with a read-only file system and a process limit.
• Secrets (API tokens) kept separate from scripts in files readable only by the service user.

Backup & monitoring

• Bash script via cron: consistent database snapshot, archive of user data plus a system archive (configuration, crontabs, container inventory).
• The second server pulls the archives via read-only rsync access, verifies their integrity and rotates old versions.
• Notification on success or failure via messenger; Uptime Kuma raises an alarm if a backup does not run at all.
• Daily network inventory with nmap/ndiff – new devices or open ports are reported.

Lessons learned

A security review of my own infrastructure revealed, among other things, a publicly reachable service with too many privileges, backup files in the web root and a database in an ephemeral Docker volume. All fixed, documented and included in the backup concept – since then I deliberately verify changes from the outside.

🖥️ Proxmox VE test environment

Ongoing learning project: Proxmox VE as a VM under KVM (nested virtualisation) on my workstation – isolated from the rest of the network.

Done

• Installation, package repositories (no-subscription instead of enterprise) and updates incl. kernel change.
• Debian 13 template from the official cloud image, cloud-init with user and SSH key.
• VMs deployed from the CLI (qm clone) – ready in under a minute.

Next

• Backup and recovery with vzdump – including a real restore test.
• AD domain with Windows Server 2022 (DNS, DHCP, group policies).
• Configuring several Debian VMs consistently with Ansible.

🗺️ Final IHK project: IPAM/DDI proof of concept

The goal was to replace spreadsheet-based IP address tracking with centralised IP Address Management. I built an isolated lab domain and evaluated the DNS/DHCP integration of a DDI/IPAM solution.

Approach

• Lab domain: Windows Server 2022 with AD DS, DNS and DHCP.
• DDI/IPAM: set up DNS/DHCP integration and validated data quality.
• RBAC: role and permission model for admin, operations and read-only.
• Audit/reporting: traceable changes and exports (e.g. CSV/PDF).

Outcome

• End-to-end DNS/DHCP integration verified in the lab environment.
• Better transparency: leases, records, change history and reports instead of manual spreadsheets.
• Groundwork laid for pilot and operations (backup, updates, monitoring).

📡 Security lab

To protect systems well, I want to understand how attacks work: radio protocols, RFID/NFC and Wi-Fi security – exclusively in my own or explicitly authorised test environments.