The Stack
Infrastructure I designed, built, and personally operate.
Topology
Internet
│
▼
Edge Defense ── challenges/blocks hostile traffic before it reaches origin
│
├─────────────────────┬───────────────────────────┐
▼ ▼ ▼
SENTINEL Other public Network Automation Stack
deception grid, services isolated device fleet,
containment, (blog, sites) L3 point-to-point link,
self-healing no route to the internet
│
▼
Host Security Stack
file-integrity monitoring, blocklist pipeline, private ops dashboard
│
▼
Post-Quantum Cryptography Layer
ML-KEM-768 + X25519 hybrid, ML-DSA-65 — protects management channels stack-wide
│
▼
Encrypted Infrastructure Repos
git-crypt AES-256 — source and configuration for every piece above, at rest
│
▼
Zero-Trust Homelab (foundation)
Mac Mini + Oracle Cloud over WireGuard — no direct inbound on either node,
Cloudflare Tunnel is the only public entry pointEdge Defense fronts everything public. SENTINEL and the Network Automation Stack are separate: SENTINEL defends production services that are reachable from the internet, the automation stack manages a device fleet that isn't reachable from it at all. The host security stack, the cryptography layer, and the encrypted repos aren't separate boxes on this diagram so much as properties that cut across all of it. The homelab layer at the bottom is really the foundation everything else sits on, not the last stop.
The Stack
SENTINEL
An autonomous, quantum-safe defense platform — deception grid, behavioral containment, self-healing infrastructure, continuous pen-testing. The flagship piece; full writeup linked.
Read the full breakdown →Edge Defense
Automatic challenge-and-block for hostile traffic at the network edge, before it ever reaches origin infrastructure, plus continuous file-integrity scanning behind it.
PerimeterHost Security Stack
Continuous local file-integrity monitoring, automated threat-intel-fed IP blocking, a privacy-hardened network posture, and a private authenticated operations dashboard.
EndpointPost-Quantum Cryptography
ML-KEM-768 + ML-DSA-65 hybrid cryptography (NIST FIPS 203/204) protecting management channels stack-wide, ahead of the "harvest now, decrypt later" threat model.
CryptographyEncrypted Infrastructure Repos
Every site and service I run is version-controlled through git-crypt AES-256 encrypted repositories — source and configuration are never at rest in plaintext, even in private storage.
StorageNetwork Automation Stack
A Flask-based API gateway that turns an isolated fleet of network devices into RESTful endpoints — API-key auth, strict port allowlisting, L3 point-to-point isolation with no route to the public internet.
Read the full breakdown →Zero-Trust Homelab
The physical/cloud split this all runs on: a Mac Mini on-prem plus an Oracle Cloud free-tier node, joined over WireGuard, with Cloudflare Tunnel as the only public entry point — nothing accepts a direct inbound connection.
FoundationLayered Security Stack
The defense-in-depth reference this stack follows in practice — WireGuard, Snort, Wazuh, OSSEC, and DNS-level filtering as independent layers, not a single point of failure.
Read the full breakdown →Offensive Security Practice
The attacker-side reference I test my own defenses against — attack taxonomy, methodology, and a separate memory-safety/buffer-overflow deep dive.
Read the full breakdown →Edge Defense
The first layer nothing gets past without passing through: automatic bot and attack-pattern mitigation at the network edge, in front of every service I run. Hostile and automated traffic gets challenged or blocked before it ever reaches origin infrastructure — origin servers only ever see traffic that's already cleared that filter. Behind the edge, a continuous file-integrity scanner watches for unauthorized change across the properties it fronts, feeding the same behavioral pipeline SENTINEL uses.
Host Security Stack
On the host itself: continuous file-integrity monitoring against a known-good baseline, an automated IP-blocklist pipeline fed by threat-intelligence sources and enriched over time, a hardened network posture that null-routes known tracking and advertising infrastructure at the resolver level, and a private, authenticated operations dashboard for watching all of it — never exposed to the open internet. Thousands of hostile sources are on the permanent blocklist at this point, and the last full integrity sweep came back clean.
Post-Quantum Cryptography
Google's March 2026 warning — later echoed by Cloudflare and backed by a $2B U.S. government emergency program — put a working estimate on the table: large-scale quantum computers capable of breaking today's public-key cryptography could arrive by 2029. "Harvest now, decrypt later" makes that a today problem, not a 2029 problem: encrypted traffic captured now can simply be stored and broken retroactively once the hardware exists.
The cryptographic layer protecting management channels across this stack implements NIST FIPS 203/204 directly — ML-KEM-768 for post-quantum key encapsulation and ML-DSA-65 for post-quantum signatures, combined with classical X25519 in a hybrid construction so an attacker has to break both simultaneously, even if one falls first. Full technical detail — parameter sizes, the six-vector attack simulation, signature verification — is in the SENTINEL writeup.
Encrypted Infrastructure Repos
Source and configuration for every site and service I run live in git-crypt AES-256 encrypted repositories, synced automatically on a fixed interval with continuous integrity verification. The threat model isn't just "don't leak this publicly" — it's that even private version-control storage shouldn't hold plaintext infrastructure secrets. Keys are held locally, protected by a passphrase, never committed alongside the content they protect.
Zero-Trust Homelab
Everything above runs across two nodes: a Mac Mini on-prem and an Oracle Cloud free-tier instance, joined over a WireGuard mesh. Neither node accepts a direct inbound connection from the internet — the only public entry point for anything is a Cloudflare Tunnel, which means there's no port to scan in the first place, on either side. It's the same "assume breach, verify everything" posture as the rest of the stack, just applied at the network-topology level instead of the application level.