BranchesTags

Latest commit

History

21 Commits

Folders and files

NameName
Last commit message
Last commit date
Backups
Backups
Hardening
Hardening
Logging
Logging
Networking
Networking
OPNSense
OPNSense
README.md
README.md

Repository files navigation

Network-setup

General documentation of my home network setup, including but not limited to

  • Services
  • Routing \ Firewalls \ Networking
  • Hardening
  • Logging
  • Backup

Services

Docker

  • Docker-CE engine currently running on two hosts - Mirai and Kakuzu
  • Docker-compose used to simplify deployment and updates

KVM

  • KVM used to host always running services on my always on powerhouse - Mirai

VMware vSphere portfolio

  • Running a full stack of vSphere for my own labbing purposes
  • ESXi, vCenter, vRealize Automation, NSX-T, vRealize Log Insight and more

OPNSense

  • Handles all Routing \ Firewalling

Routing \ Firewalling

All routing and firewalling happens on OPNSense

This includes but not limited to

  • GeoIP Blocking
  • Blocking of certain internal devices to reach internet
  • AD Blocking via DNSBL
  • BGP peering to NSX-T
  • DNS over TLS
  • DNS blocking of all rogue DNS devices

Networking

Internal networking is varied

  • Core Cluster is 2x HPE 5900AF
  • Distribution switch in attic is HPE 2530
  • Primary WLAN for internal devices is 3x Linksys Velop in bridge mode with meshing
  • Secondary WLAN including labbing is 3x MSM466 access points + 1x Cisco Aironet
  • Media Center (main living room) is TP-Link SG108
  • Office Lab is TP-Link SG108 POE
  • Not use mDNS for anything that can work with regular DNS
  • Wireguard implemented for all clients leaving the house

Hardening

Hardening is done by, but not limited to

  • Only allow publickey login to servers and devices (outside of lab networks)
  • All lab networks are firewalled off from production networks but can reach internet
  • MFA implemented on all services that support them (using Yubikey)
  • Limited number of open ports exposed online

Logging

Multiple services and devices have implemented logging in different ways

  • Network switches send syslogs to Graylog
  • All docker containers send syslogs to Graylog
  • All servers send syslogs to Graylog
  • Cronjobs send email reports to email for every run

Backup

Multiple methods of backups are implemented

  • OPNsense backs up its config once a day and uploads it to my Nextcloud instance
  • All docker containers and compose files are backed up every night (round robin between two cloud providers using rclone and crypt)
  • All personal files are backed up twice a week (round robin between two cloud providers using rclone and crypt)
  • TODO - Switch config automatic backup

Acknowledgments

Inspiration, Collaboration

  • Mstone
  • Tinkerer
  • Tediore
  • Skalavala
  • Pdobrian
  • Ndonegan

About

No description, website, or topics provided.

Resources

Readme
Activity

Stars

4 stars

Watchers

3 watching

Forks

0 forks
Report repository

Releases

Packages

Contributors

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content
BranchesTags

Latest commit

History

21 Commits

Folders and files

NameName
Last commit message
Last commit date
Backups
Backups
Hardening
Hardening
Logging
Logging
Networking
Networking
OPNSense
OPNSense
README.md
README.md

Repository files navigation

Network-setup

General documentation of my home network setup, including but not limited to

  • Services
  • Routing \ Firewalls \ Networking
  • Hardening
  • Logging
  • Backup

Services

Docker

  • Docker-CE engine currently running on two hosts - Mirai and Kakuzu
  • Docker-compose used to simplify deployment and updates

KVM

  • KVM used to host always running services on my always on powerhouse - Mirai

VMware vSphere portfolio

  • Running a full stack of vSphere for my own labbing purposes
  • ESXi, vCenter, vRealize Automation, NSX-T, vRealize Log Insight and more

OPNSense

  • Handles all Routing \ Firewalling

Routing \ Firewalling

All routing and firewalling happens on OPNSense

This includes but not limited to

  • GeoIP Blocking
  • Blocking of certain internal devices to reach internet
  • AD Blocking via DNSBL
  • BGP peering to NSX-T
  • DNS over TLS
  • DNS blocking of all rogue DNS devices

Networking

Internal networking is varied

  • Core Cluster is 2x HPE 5900AF
  • Distribution switch in attic is HPE 2530
  • Primary WLAN for internal devices is 3x Linksys Velop in bridge mode with meshing
  • Secondary WLAN including labbing is 3x MSM466 access points + 1x Cisco Aironet
  • Media Center (main living room) is TP-Link SG108
  • Office Lab is TP-Link SG108 POE
  • Not use mDNS for anything that can work with regular DNS
  • Wireguard implemented for all clients leaving the house

Hardening

Hardening is done by, but not limited to

  • Only allow publickey login to servers and devices (outside of lab networks)
  • All lab networks are firewalled off from production networks but can reach internet
  • MFA implemented on all services that support them (using Yubikey)
  • Limited number of open ports exposed online

Logging

Multiple services and devices have implemented logging in different ways

  • Network switches send syslogs to Graylog
  • All docker containers send syslogs to Graylog
  • All servers send syslogs to Graylog
  • Cronjobs send email reports to email for every run

Backup

Multiple methods of backups are implemented

  • OPNsense backs up its config once a day and uploads it to my Nextcloud instance
  • All docker containers and compose files are backed up every night (round robin between two cloud providers using rclone and crypt)
  • All personal files are backed up twice a week (round robin between two cloud providers using rclone and crypt)
  • TODO - Switch config automatic backup

Acknowledgments

Inspiration, Collaboration

  • Mstone
  • Tinkerer
  • Tediore
  • Skalavala
  • Pdobrian
  • Ndonegan

About

No description, website, or topics provided.

Resources

Readme
Activity

Stars

4 stars

Watchers

3 watching

Forks

0 forks
Report repository

Releases

Packages

Contributors

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
Skip to content
BranchesTags

Latest commit

History

21 Commits

Folders and files

NameName
Last commit message
Last commit date
Backups
Backups
Hardening
Hardening
Logging
Logging
Networking
Networking
OPNSense
OPNSense
README.md
README.md

Repository files navigation

Network-setup

General documentation of my home network setup, including but not limited to

  • Services
  • Routing \ Firewalls \ Networking
  • Hardening
  • Logging
  • Backup

Services

Docker

  • Docker-CE engine currently running on two hosts - Mirai and Kakuzu
  • Docker-compose used to simplify deployment and updates

KVM

  • KVM used to host always running services on my always on powerhouse - Mirai

VMware vSphere portfolio

  • Running a full stack of vSphere for my own labbing purposes
  • ESXi, vCenter, vRealize Automation, NSX-T, vRealize Log Insight and more

OPNSense

  • Handles all Routing \ Firewalling

Routing \ Firewalling

All routing and firewalling happens on OPNSense

This includes but not limited to

  • GeoIP Blocking
  • Blocking of certain internal devices to reach internet
  • AD Blocking via DNSBL
  • BGP peering to NSX-T
  • DNS over TLS
  • DNS blocking of all rogue DNS devices

Networking

Internal networking is varied

  • Core Cluster is 2x HPE 5900AF
  • Distribution switch in attic is HPE 2530
  • Primary WLAN for internal devices is 3x Linksys Velop in bridge mode with meshing
  • Secondary WLAN including labbing is 3x MSM466 access points + 1x Cisco Aironet
  • Media Center (main living room) is TP-Link SG108
  • Office Lab is TP-Link SG108 POE
  • Not use mDNS for anything that can work with regular DNS
  • Wireguard implemented for all clients leaving the house

Hardening

Hardening is done by, but not limited to

  • Only allow publickey login to servers and devices (outside of lab networks)
  • All lab networks are firewalled off from production networks but can reach internet
  • MFA implemented on all services that support them (using Yubikey)
  • Limited number of open ports exposed online

Logging

Multiple services and devices have implemented logging in different ways

  • Network switches send syslogs to Graylog
  • All docker containers send syslogs to Graylog
  • All servers send syslogs to Graylog
  • Cronjobs send email reports to email for every run

Backup

Multiple methods of backups are implemented

  • OPNsense backs up its config once a day and uploads it to my Nextcloud instance
  • All docker containers and compose files are backed up every night (round robin between two cloud providers using rclone and crypt)
  • All personal files are backed up twice a week (round robin between two cloud providers using rclone and crypt)
  • TODO - Switch config automatic backup

Acknowledgments

Inspiration, Collaboration

  • Mstone
  • Tinkerer
  • Tediore
  • Skalavala
  • Pdobrian
  • Ndonegan

About

No description, website, or topics provided.

Resources

Readme
Activity

Stars

4 stars

Watchers

3 watching

Forks

0 forks
Report repository

Releases

Packages

Contributors