← Builds

Build · Internal

HomeLab Security Dashboard

A homegrown SIEM that turns raw firewall noise into something a non-security person can actually read.

Local & private · CrowdSec + a security knowledge RAG · weekly automated analysis

Challenge

A live world map of attack origins against the HomeLab

My HomeLab runs CrowdSec, AdGuard Home, and fail2ban because people smarter than me recommended them. I could see things being blocked and had only a vague idea what any of it meant. Passing those alerts through a local model and getting plain-language summaries turned out to be an education: there is a constant, low-grade festival of automated snooping against anything public-facing, and some of it is interesting enough to want to understand properly. At my core I'm a UX designer, and I'd spent decades helping other people understand systems while barely understanding my own.

Build

The Security Intelligence dashboard — incident stats, threat intelligence, and a built-in analyst

Brains before apps. Before building any interface, I built a Security Knowledge RAG of nine corpus files covering CrowdSec operations, MITRE ATT&CK techniques mapped to my own traffic patterns, my infrastructure topology, and production scenario definitions, with Qwen reasoning over it locally on an RTX 3090 Ti. No cloud APIs. The SIEM on top translates raw CrowdSec alerts into something a non-security person can act on: where traffic originates, which services are being targeted, reputation scoring on attacking IPs, and plain-language descriptions of what each attack type actually means. A live feed tracks activity on a world map, and a hybrid report builder pairs five pre-defined report types with optional semantic context, the training wheels that are teaching me the vocabulary.

Outcome

A generated Threat Overview report with executive summary and charts

What I have now isn't a static security setup; it's a feedback loop. CrowdSec blocks threats, the pipeline captures what was blocked, the dashboard makes it visible, the RAG makes it understandable, and every Sunday morning Nucleus reviews the week, compares it against the last, extracts hardening recommendations, and writes a dated case study to my Obsidian vault. The first automated run found 599 incidents from 171 unique IPs across 31 countries and produced five tracked findings. I know a lot more about MITRE ATT&CK, IP reputation, and GeoIP enrichment than I did going in, and all of it makes me a more informed operator of the infrastructure I run.

The Stack

I build the systems with Claude as my pair, working the hard parts until something holds. From there, Qwen reasons over a purpose-built security corpus on hardware I own. Nothing here calls an external model API or bills by the token, which is much of the point: the analysis of my own infrastructure never leaves it.