Best viewed on desktop for the full interactive experience.
—
Events
Source
Severity
Date
Severity
SourceEventTags
2026-06-30LowWrite-upProvisioning a Hardened Linux Virtual Machine on Proxmox2026-06-27CriticalProjectSelf-Hosted Portfolio Web Server2026-06-25CriticalLabBuilding a Zero Trust DMZ for a Self-Hosted Web Server2026-01-20LowProjectMinecraft Server Setup - Crafty Controller, Port Forwarding, and Dynamic DNS2025-04-02HighLabHome Lab VLAN Segmentation - Architecture Overview
Lab topology — abstract view
Internet
Public traffic
Cloudflare edge
DDoS · WAF · TLS
Zero Trust on /ghost/
Perimeter firewall
OPNsense
Default deny · VLAN segmented
Hypervisor
Proxmox PVE
Multiple VMs · Managed switch
Network segments
Management
Hypervisor · Firewall · UPS automation
Admin services
Internal DNS · PKI · Bastion · IAM
Database
Isolated data tier
Game servers
Crafty Controller · Game VMs
Wireless
Wireless clients — isolated
User
Wired workstations
Lab
Experimental workloads
DMZ
Public web server · Ghost CMS
All segments isolated by default. DMZ blocked from internal RFC1918 space. No inbound WAN ports exposed. Admin access via Zero Trust and bastion host only.
Site health check — chaselarocca.com
CONNECTIVITY
HTTPS (443/tcp)—
HTTP redirect (80→443)—
TLS / CERTIFICATE
TLS encryption—
Origin certificate—
Origin IP exposure—
SECURITY CONTROLS
Cloudflare tunnel—
Zero Trust on /ghost/—
Security headers—
APPLICATION
Ghost CMS—
Response time—
Firewall policy summary
RuleTrafficPolicyResult
WAN PERIMETER
Inbound — WANAny → Public IPNo open ports at WAN. All traffic handled by Cloudflare edge. Origin IP not advertised. Enforced
Admin panelAny → /ghost/Cloudflare Access — Zero Trust. Email authentication required before request reaches origin. Enforced
DMZ SEGMENT
DMZ → RFC1918OutboundBlock all private address space. No lateral movement path from public-facing segment to internal network. Enforced
DMZ → InternetOutboundPermit HTTPS (443), HTTP (80), DNS (53) to specific destinations only. All other outbound denied. Enforced
DMZ host firewallHost-levelUFW active on web server. Permits only SSH from management segment and tunnel process. Default deny. Enforced
MANAGEMENT ACCESS
Admin → DMZSSH inboundSSH permitted from management segment to web server only. Scoped to single host, key auth required. Enforced
