lab.trucnguyen.devPROD
ZERO-TRUST NETWORK DEFENSE ARCHITECTURE & ARMOR MATRIX

Zero-Trust Cyber Defense Perimeter

One guiding principle: “Never trust, always verify.” The Homelab and MaxStack infrastructure is protected by five defense layers, from the Cloudflare edge down to ed25519 hardware keys on every bare-metal server.

Security Posture Score99.6 / 100 (A+)

Five-Layer Defense-in-Depth

100% end-to-end encrypted
Layer 1: Perimeter[CLOUDFLARE SHIELD]Edge Ingress & Authenticated Origin Pull

All public web traffic is routed through the Cloudflare edge. The origin server (Aegis Prime) accepts only connections presenting a Cloudflare TLS client certificate, which makes it immune to direct IP scanning attacks.

Stack: Cloudflare Enterprise WAF, TLS 1.3 Strict, Origin CA, Geo-BlockingEnforcement: Ports 80/443 open only to Cloudflare Authenticated Origin IP ranges
STRICT
Layer 2: Overlay[WIREGUARD MESH]Tailscale Encrypted Zero-Trust Interconnect

A peer-to-peer full-mesh network encrypted with Curve25519. Nodes (Hyperion Sovereign, Aegis Prime, Vanguard Shield, Orion Workstation) communicate directly over UDP without opening any ports on the home modem.

Stack: Tailscale WireGuard, DERP Relay Fallback, Subnet Router ACLsEnforcement: 100% end-to-end encryption with automatic reconnection via NAT traversal
ENFORCED
Layer 3: Host Bastion[HARDENED BASTION]Host Armor & Fail2ban Automated Defense

All SSH accounts accept ed25519 hardware keys only; password authentication is fully disabled. Fail2ban automatically drops offending IPs at the UFW firewall after three anomalous connection attempts.

Stack: OpenSSH ed25519 Keys, UFW Default Deny, Fail2ban Jail, AppArmorEnforcement: Password Auth = Disabled, SSH Root Login = Prohibited
STRICT
Layer 4: DNS Fortress[ADGUARD SINKHOLE]AdGuard Home DNS-over-HTTPS Malware Sinkhole

Dedicated LXC 101 runs AdGuard Home as the DNS server for every device and container on the internal network, blocking more than 85,000 tracking, advertising, and malware domains.

Stack: AdGuard Home, DNS-over-HTTPS (DoH), Quad9 Upstream with DNSSECEnforcement: Blocks 18.4% of all queries as junk or malicious at the DNS resolution layer
ACTIVE
Layer 5: Identity[IDENTITY GATE]Centralized Login & TOTP 2FA

Centralized authentication for the Homelab Portal, with TOTP multi-factor authentication (RFC 6238), role-based access control (RBAC), and hardened sessions using HttpOnly strict cookies.

Stack: JWT RS256 Tokens, TOTP RFC 6238, Argon2id Password Hashing, RBACEnforcement: 2FA required for all Homelab administrative access
ENFORCED

Real-Time Security Threat Audit Feed

Live Telemetry Stream
TimeDefense SourceEventProtected TargetAction TakenResult
13:38:12Cloudflare WAFSQL Injection Probe Blocked (Rule 100018)lab.trucnguyen.devDROP 403BLOCKED
13:24:45Fail2ban Aegis PrimeSSH Brute Force attempt (IP 194.26.29.x)aegis-prime:2222BANNED (24h)BANNED
12:50:02AdGuard DNS WardTelemetry Tracker Queried (app-measurement.com)192.168.1.100 (Orion)SINKHOLE 0.0.0.0BLOCKED
11:15:30Tailscale ControlKey Rotation Handshake Completed (WireGuard)Hyperion Sovereign ↔ AegisAUTHORIZEDVERIFIED
09:04:19SSL MonitorLet's Encrypt Wildcard Certificate Verified (Valid 88 days)*.trucnguyen.devVALIDATEDACTIVE
TLS 1.3 / Strict SSL

All certificates are issued automatically through Let's Encrypt wildcard & Cloudflare Origin CA using ECDSA P-384. TLS 1.0/1.1 and legacy cipher suites are disabled.

SSH ed25519 Hardware Keys

Hardware-backed ed25519 signature keys for authentication. The default SSH port 22 is closed, and SSH access is restricted to the Tailscale VPN mesh.

Zero Open Modem Ports

The VNPT modem (bridge mode) and Xiaomi AX3000T router expose no NAT port forwards (zero open WAN ports). Every connection into the homelab goes through an encrypted tunnel.