Selected projects

A closer look at the networks, infrastructure, recovery systems, and data platforms I run in my lab.

PROJECT 01

Virtualized infrastructure and high-speed network architecture

ProxmoxOPNsense10/25GbESR-IOV

Why I built it

I wanted one lab where I could work directly with routing, compute, storage, fast network paths, and recovery instead of treating them as separate demos.

What it runs

Proxmox VE hosts KVM and LXC workloads, while OPNsense handles routing and policy. The network uses VLANs, IPv4 and IPv6, DNS, VPN access, Caddy, Cloudflare, Mellanox/NVIDIA adapters, SR-IOV virtual functions, PCIe passthrough, and a BlueField DPU.

How I test it

My acceptance tooling checks hardware identity, VF assignments, bridges, OPNsense interfaces, offload behavior, connectivity, DNS, public routes, rollback access, and service health after a reboot.

10/25GbEIntegrated network fabric

80 / 80Monitoring targets healthy

667Acceptance tests recorded

Proxmox dashboard showing compute, memory, disk, and thermal status — Virtualization and infrastructure health dashboard.

Current state

The platform is source controlled and monitored, with documented rollback paths and repeatable checks after changes.

PROJECT 02

Kubernetes, observability, and recovery engineering

K3sCiliumArgo CDPBS

Why I built it

I wanted deployment, monitoring, backup, and recovery to work the same way across a mixed set of machines instead of depending on one-off fixes.

What it runs

The three-node K3s cluster uses Cilium with Hubble, Argo CD, Kyverno, and SOPS/Age. Recovery combines embedded-etcd snapshots, an encrypted control-plane bundle, Proxmox Backup Server, qdevice monitoring, and encrypted off-site artifacts. Prometheus and Grafana cover the cluster, backups, quorum, storage, and restore prerequisites.

How I test it

All 21 required gates passed. Three nodes were Ready, eight Argo applications were Synced and Healthy, five policies were ready in audit mode, policy denial was visible in Hubble, and Argo self-heal restored a deleted disposable workload.

21 / 21K3s gates passed

74 secWorker recovery

2 pathsControl-plane restores

Grafana dashboard with CPU, memory, disk, and uptime panels — Prometheus-backed infrastructure observability.

Current state

GitOps self-healing, policy enforcement, and two independent recovery paths have been exercised rather than only documented.

PROJECT 03

Detection-to-enforcement security integration

WazuhCrowdSecn8nGreenbone

Why I built it

I wanted the security tools in the lab to exchange useful evidence and take reversible action instead of operating as unrelated dashboards.

What it runs

Cowrie supplies isolated telemetry and Wazuh stores detections. A source-controlled service normalizes threat intelligence, n8n handles orchestration, CrowdSec owns decisions, OPNsense and Caddy enforce them, and Greenbone scans systems I own. Loki, Prometheus, Grafana, and Alertmanager expose health.

How I test it

Disposable traffic proved the full lifecycle: telemetry, proxy and firewall denial, alert receipt, decision removal, and restored access. Upgrade verification also checked 4,542 Wazuh rule IDs and nine registered agent identities.

4,542Rule IDs checked

2 layersEnforcement proved

0 residueResources reconciled

Sanitized Greenbone report for an owned scan target — Sanitized vulnerability-management report.

Current state

The control paths are authenticated and logged, and enforcement can be reversed without leaving stale decisions behind.

Open the live threat-intel feed

PROJECT 04

TNWxLab weather data and verification platform

PythonFastAPIData provenanceML platform

Why I built it

TNWxLab grew from a weather display into a regional data platform where I can test forecast corrections without losing track of when data actually became available.

What it runs

Adapters ingest NWS, HRRR, NBM, RTMA, MRMS, and USCRN data into versioned contracts. Immutable artifacts record source identity, valid time, availability time, units, checksums, and processing versions. Separate workers build matched cases and precomputed animation assets.

How I test it

The platform accumulated 1,754 matched precipitation cases across 20 dates and 13 wet events. Nine animated layers are served from precomputed assets, while API, source-adapter, timestamp, artifact-validity, and ML pipeline tests protect the data path.

1,754Matched cases

9Animated layers

483API and ML tests

Current state

Collection and verification run unattended, and the data is ready for chronological regional-model experiments and shadow evaluation.

Open TNWxLab