Architecture Lab

As part of my ongoing effort to deepen my hands-on infrastructure and security skills beyond formal training, I deployed and hardened a self-managed Ubuntu Server 24.04 environment on a cloud VPS. The goal was not just to get services running, but to apply real security-first principles from the ground up, treating a home lab with the same rigor as a production environment.

Infrastructure Stack

• Operating System: Ubuntu Server 24.04 LTS, deployed on a cloud VPS
• Reverse Proxy: Nginx, handling TLS termination and routing traffic to multiple internally hosted services
• Certificate Management: Automated SSL/TLS via Let's Encrypt, with auto-renewal to ensure certificates never expire unnoticed
• Containerization: Docker-based service management for isolating and organizing multiple applications on a single host
• Monitoring: A dashboard-based monitoring stack to track system health and resource usage in real time
• PC Specs: Watercooled Be Quiet Silent Base 802, Ryzen 7 5800x3D, RTX 4070Ti 16Gb OC, 32GB DDR4 4000MTs, 2 x Crucial T710 4TB, MSI A1000GL PSU

Security & Hardening

Security was the primary focus of this project, not an afterthought. Key measures implemented:

• Minimal Firewall Policy: Using UFW, all inbound and outbound traffic is denied by default, with only explicitly required ports opened. No unnecessary services are exposed to the public internet.
• Brute-Force Protection: Fail2Ban actively monitors authentication logs and automatically bans IP addresses attempting repeated unauthorized access, mitigating both bot traffic and targeted brute-force attempts.
• Network Segmentation: Internal services communicate over private, internal IP ranges rather than being directly exposed, with only the reverse proxy acting as a controlled entry point to the outside world.
• Reverse Proxy as a Security Layer: Nginx not only handles routing but also acts as the single, hardened point of contact for external traffic, reducing the overall attack surface significantly.

Lessons Learned

This project reinforced a core principle I now apply to every system I build: security should be architected in layers, not bolted on afterward. Combining a minimal firewall policy, automated intrusion prevention, and strict network segmentation creates a defense-in-depth approach that mirrors enterprise-grade security concepts, just at a smaller, personal scale.

Going forward, I plan to expand this environment with identity-focused access controls and explore integrating Zero Trust principles more deeply, bridging the gap between home lab experimentation and enterprise cloud security architecture.