Show & Tell: Dammit Jim! I'm a UX Designer, Not a Firewaller!

At my core, I'm a UX designer. I've spent decades thinking about how people understand systems, and one evening last week, I realized I needed to understand my own much better. My HomeLab is running CrowdSec, AdGuard Home, and fail2ban because people smarter than me made some recommendations to help me keep things safe(r) at home. I saw that things were being blocked, and frankly, I had only a limited idea what any of it meant.

A little over a month ago, I set up Nucleus as my HomeLab orchestration agent, built on JC Grubbs' Nella (github.com/thegrubbsian/nella-bot), a security-first take on the autonomous agent frameworks that were making the rounds at the time. A lot of those agents had a habit of running too hot on API credits and taking instructions further than intended. Nella was built with guardrails first, and I rewired it to run on local GPU instead of external APIs, and christened it Nucleus, to match the cellular theme of the HomeLab.

With Nucleus up and running, and learning the ropes of our HomeLab, it started passing CrowdSec alerts through Qwen and sending me plain-language summaries when activity thresholds were met. That solved an immediate problem and started an education. Telegram notifications would come through like this:

After about a month of these digests, I understood something I passively always knew, however didn't really consider with as much weight as I do now. And I understood better why some of my friends in Cyber are, well, the way they are about Cyber. There is a constant, low-grade festival of snooping happening against anyone running public-facing infrastructure. Most of it isn't targeted; it's automated background noise. Some of it is more interesting than that, and that's what got me to sit up a little straighter and pay more attention to what is constantly happening around me.

Those interesting hits had me sitting down Friday evening and doing deep research into what I didn't fully understand yet, and by Sunday night I'd built a custom Security Information and Event Management (SIEM) system for myself. Or at least a very localized and light version of one; the real SIEMs used in real organizations have a lot more horsepower to them, for certain, and I did my level best to keep things following the same pattern: Informative, with constant learning for me as part of the theme.

Before building anything with an interface, I worked with Claude Code to build the intelligence layer first. I generally refer to this as "Brains Before Apps:" if the system can't reason about the data, a dashboard is just a prettier version of the same tables I couldn't read. This is a process I've put into place for nearly every application I've built; if there can be focused knowledge to augment the LLMs capability, I want to have it help make our outcomes sharper and with the right context.

We built a Security Knowledge RAG backed by nine corpus files covering CrowdSec operations, MITRE ATT&CK techniques mapped to HomeLab traffic patterns, our actual infrastructure topology, and CrowdSec scenario definitions pulled from production. The reasoning engine is Qwen 3.5 running locally on an RTX 3090 Ti. No cloud APIs. Every synthesis, every recommendation, every analysis runs on hardware in the HomeLab and doesn't hit the outside world or someone else's systems for any inference.

With the brains in place, the apps followed quickly.

The customized SIEM we built translates the raw CrowdSec alerts into something a non-security person can act on: geographic breakdowns of where traffic originates, which services are being targeted, reputation scoring on attacking IPs, and plain-language descriptions of what each attack type actually means. We built in a Live Feed to be able to track real-time activity on a world map and that allows for things I'd never considered before: I can watch http probes from Vietnam targeting a blog while SSH brute-force attempts from Brazil are attempting to hit a Git server.

It's fascinating and sobering in equal measure.

This was a lot, if not more than enough for "just me with my HomeLab" at home, where one typically has a HomeLab, after all. However, I have GPU access without token cost, and the notion of "custom dashboards from semantic query" has been on my mind for awhile, so I wanted to figure out if, or how, this might happen.

My instinct was to build a fully open-ended semantic query interface, and every time I sat down to define it I hit the same wall: I don't always know the right questions to ask. I'm not a security professional. So the Dashboard Builder became a hybrid: five pre-defined report types covering the analyses I found most valuable, with the option to add semantic context. The pre-defined options aren't a crutch (though they certainly made testing much easier). These are the training wheels that are teaching me the vocabulary.

I ended up with a Custom Report Builder, which isn't far from what a Custom Dashboard Builder would have been anyway. The Custom Reports are useful and I found myself still having questions, so once the report is generated, I can follow-up with free-text queries. That is: I can ask the reports questions about the reports to get clarification and/or more details; the report itself is a part of the conversation and not the final output.

To close the loop, we updated Nucleus to run the analysis automatically. Every Sunday at 5:30 AM, Nucleus reviews the last seven days of incidents, compares them against the previous week, extracts hardening recommendations, creates tracked findings, and writes a dated case study to our Obsidian vault. The first automated run found 599 incidents from 171 unique IPs across 31 countries and produced five actionable recommendations. All five became tracked findings.

What we have now isn't a static security setup. It's a feedback loop. CrowdSec blocks threats. The pipeline captures what was blocked. The dashboard makes it visible. The RAG makes it understandable. The report builder makes it analyzable. Nucleus makes it actionable. And the Obsidian case studies build a documented record of an evolving posture, not a snapshot of one, and that weekly record will allow us to analyze trends over time as Nucleus continues to evolve.

I know significantly more about MITRE ATT&CK techniques, IP reputation scoring, and GeoIP enrichment than I did on Friday evening. None of it is deep expertise by any stretch of the imagination, and I have even more respect for those fine folks in Cyber than I did before I gave this my weekend. All of it makes me a more informed operator of the infrastructure I run.

Did I overbuild this for my needs? Absolutely.

Would I do it again? Without hesitation.

This is not about attempting to build a final product; I'm learning, and I'm sure I've fallen short of what someone else would do (and I'm also sure I'm going to ask some of those folks for feedback so I can keep the systems protected). This is entirely for my own benefit and self-interest. And it's fun.