# work-in-progress. (technical details & plans are likely to change soon as I continue working on this)
Note: Currently working on a post that details the history of this homelab project and a lot of my thinking/decision making during it
OPNsense
OpenWrt
# Note: lab photos coming soon!
Currently working on
practicing SIEM analysis with my own tooling/events/alerts
improving Grafana dashboards and lua parsers
vibecoded some initial ones to help me test logflow/parsing
configuring Grafana alerting
working on adding health monitoring dashboards (starting with fluent-bit to help diagnose logflow issues)
thoroughly going through SIEM service configurations to ensure full coverage
thoroughly going through fluent-bit log flow/parsing configuration
thoroughly going through/testing log rotation/ISM templates over time to ensure I’m getting the ~60-90 day collection window I want (with a smaller window for heavier stuff Suricata flow logs at ~7-14 days)
implementing second 9020 sff on ‘secserver’ VLAN to allow OpenVAS to run on schedules without fighting my opnesearch/wazuh vm’s for resources during scan, and provide room for further VMs
might need to wait til I can afford an SSD/more RAM for this one
will create another Grafana dashboard for this an integrate into existing agent/health monitoring setup
documenting “secserver” host configuration
documenting SIEM VM configurations
Future plans
Implement second 9010 SFF I purchased to use as a Zeek traffic analyzer (currently planning to do this with a mirrored port on my Opnsense 9010’s OPT interface)
Waiting until I can afford a Gigabit NIC for this
Will create another Grafana dashboard for this an integrate into existing agent/health monitoring setup
local CA/forced https for management web interfaces
Implement more MFA
Do more host hardening across all of my hosts
Confirm current 9020 SFF ‘secserver’ configurations VM isolations are definitely working correctly
Pentest everything I can and simulate as many attacks as possible until I feel more comfortable mentally modelling most attacks in the context of my lab/lan
Audit/test SIEM logging and create a routine process for auditing all services to ensure tehy’re truly represenatative of reality and there are no gaps in my coverage
Further enrich IP/DNS info with other forms of CTI
Write more documentation and recovery procedures
Add more redundancy where possible (when I can afford it) (A UPS will save me going through all the effort I just went to restore fluent-bit connections/opensearch indexes after a mains outage lol.)
Replace proxmox cluster with more modern hardware and lower power draw (when I can afford it).
Continue researching heads/coreboot and hardware keys to setup boot verification/auditing and hardware attestation for the t430p and 9010 SFF (I ideally want something that mirrors what my GrapheneOS phone does on my linux hosts as best I can and so far it’s looking relatively possible with my hardware)
After that I also want to have a go at redoing my current OPNsense configuration on OpenBSD with the goal being to reduce overall attack surface by removing the components I don’t need
Redo anything and everything that introduces os-level age verification with whatever alternative solutions I can find that are maintained by people who aren’t actively underminining the open ecosystem they owe their existence to, and the well-constructed ideals of their predecessors
