Production-grade security posture on consumer hardware.
Proxmox-hosted homelab with Cloudflare Tunnel, Caddy reverse proxy, Wazuh SIEM, and Pi-hole DNS filtering.
Port forwarding exposes my WAN IP. Cloudflare Tunnel creates an outbound-only encrypted connection — my origin IP never appears in DNS, and Cloudflare absorbs DDoS before it reaches me.
Caddy's automatic certificate renewal via ACME meant zero manual cert management. Nginx gives more fine-grained control I don't need yet. If I move to a multi-tenant setup, I'll revisit.
Most homelabs add monitoring as an afterthought. I wanted to build alerting and log correlation as a first-class concern — both because it's the right security posture, and because operating Wazuh is directly transferable to professional SOC work.