Public mirror of a private homelab focused on access control, observability, and security operations.
Interactive overview · GitHub profile
This repository is a sanitized public mirror of an internal homelab environment built on Windows 11, Docker Desktop, and WSL2.
Its purpose is to document the architecture, ingress model, observability stack, and security workflow of the environment without exposing private implementation details, runtime state, or sensitive configuration.
The security operations side of this environment was migrated off self-hosted tooling onto Microsoft Sentinel, Defender XDR, and Intune, deployed and validated entirely as code. See the Detection Engineering section below.
The emphasis is on system design and operational discipline rather than service count.
- centralized ingress and controlled exposure
- consistent authentication in front of sensitive services
- integrated metrics, logs, alerting, and security telemetry
- detections and cloud security config defined as code, validated in CI
- reduced secret sprawl and repeatable configuration workflows
- documentation that explains the structure and operating model of the platform
Edge and access
- Caddy
- Authelia
- Tailscale
Observability
- Prometheus
- Alertmanager
- Grafana
- Loki
- Promtail
- Blackbox Exporter
- Uptime Kuma
Security
- CrowdSec
- Microsoft Sentinel
- Microsoft Defender XDR / Defender for Endpoint
- Microsoft Intune
- Microsoft Defender for Cloud
- Trivy
- Renovate
Platform
- Infisical
- OpenTofu / Terraform
- Docker Compose
Detections are written as Sigma rules, checked into this repository's private counterpart, and compiled into Sentinel analytics rules and Defender custom detections through GitHub Actions:
- Sigma validation, a rules-in-sync check, Bicep build, and schema checks run on every pull request
- OIDC deploy to Azure on merge, with no stored cloud credentials
- main is branch-protected
Detections are continuously exercised, not just written once. An isolated, MDE-onboarded detonation-range VM runs Atomic Red Team techniques on a schedule, and a validation loop confirms via Defender advanced hunting that the matching detection actually fired, emitting an ATT&CK Navigator coverage layer after each run.
On its first run, that validation loop caught two real bugs: two custom detections filtered on AdditionalFields.TargetProcessName, a field that Defender leaves empty for the CreateRemoteThreadApiCall and OpenProcessApiCall action types — the target process is actually in FileName. Both detections would have silently never fired. Code review had missed it; the validation harness caught it on the first pass.
- index.html: GitHub Pages project page
- docker-compose.public.yml: representative Compose layout for the public-facing parts of the stack
- Caddyfile.public: scrubbed Caddy configuration showing ingress and authentication patterns
- DECISIONS.md: engineering tradeoffs behind the stack
- .env.example: scrubbed environment-variable reference for the public examples
- config: sample Authelia and Infisical bootstrap configuration
- docs/security-architecture.md: layered security model
- infra/terraform: external DNS and infrastructure metadata scaffold
- scripts: selected bootstrap, validation, and security workflow scripts
- tools/monitoring: monitoring examples with private and download-specific components removed
- artifacts/homepage-theme: sanitized dashboard design artifacts
The diagram reflects the public component model in this repository: edge enforcement and ingress, operator-facing services, observability, and separate security/control planes.
This repository is not intended to be a turnkey deployment source.
It is a curated public reference for:
- architecture
- ingress and authentication patterns
- monitoring and alerting layout
- security workflow examples
- Terraform/OpenTofu structure
- operator-facing documentation and scripts
The following are intentionally excluded:
- live secrets
- generated state
- exact runtime configuration from the private environment
- private hostnames, IP addresses, and internal-only service wiring
- GitHub Pages: https://asharahmed.github.io/homelab/