Deployed the Wazuh manager, indexer and dashboard in Docker, with Linux and Windows agents shipping logs from the lab

Built custom decoders and rules mapped to MITRE ATT&CK, covering brute-force, privilege-escalation and file-integrity events

Created dashboards and alert pipelines for authentication failures, malware events and vulnerability findings

Validated detections with controlled attack simulations and tuned noisy rules to reduce false positives

Connected homelab nodes, cloud VMs and mobile devices over an encrypted mesh without exposing services to the internet

Implemented tag-based access controls so each device and user can reach only the services it needs

Advertised LAN subnets and used MagicDNS for stable internal names across the lab

Used Tailscale SSH and exit-node routing for encrypted remote access from anywhere

Self-hosted Passbolt with MariaDB, HTTPS and scheduled encrypted backups in Docker

Created user groups and permission matrices so credentials are shared only with the right lab identities

Enabled TOTP, strong password policies and audit logging for credential access

Tested backup restoration and account recovery to ensure secrets survive failures

Reverse proxy and TLS termination for every internal service, with private DNS names

Docker Compose stacks for monitoring, dashboards, file sync and other internal tools, managed as code

Segmented Docker networks, no public ports, and Tailscale-only access to admin interfaces

Scheduled volume backups, health checks and update automation to keep the stack reliable