Hades — Enterprise Cybersecurity and Infrastructure Lab

Project Overview

Hades is a self-designed, self-operated cybersecurity and infrastructure lab that combines physical and virtual systems: redundant physical infrastructure nodes, three Proxmox hypervisors, a separate bare-metal services host, and a separate network-attached storage system. It brings together centralized identity, security monitoring, vulnerability management, application hosting, network storage, and dedicated backup systems in a single segmented environment used to practice secure design, operations, and recovery.

Design Goals

The environment is built around a small set of goals that mirror enterprise security expectations.

• Enforce segmentation and least-privilege access between network zones.
• Centralize authentication and identity rather than managing local accounts.
• Provide continuous monitoring and vulnerability visibility across hosts.
• Keep core services highly available and recoverable after failure.
• Validate configuration and recovery through repeatable, automated checks.

Architecture

Hades is a mixed physical and virtual environment rather than a single virtualized stack. It combines dedicated physical infrastructure nodes, three Proxmox hypervisors, a separate bare-metal services host, and a separate network-attached storage system. Virtual machines and containers run only on the Proxmox hypervisors, while centralized security and infrastructure services are mapped to the systems that provide them. The diagram below is organized in layers and uses sanitized labels, omitting any specific hostnames, addressing, credentials, or configuration.

• Dedicated physical infrastructure nodes for core network services.
• Three Proxmox hypervisors hosting virtual machines and containers.
• A separate bare-metal application and services host.
• A separate network-attached storage system.
• Centralized security and infrastructure services mapped to their host systems.

Network Segmentation

UniFi network infrastructure provides the gateway, switching, and network segmentation. The environment is divided into four segments — Management, Services, Trusted, and IoT/Media — with controlled access between them. Security, application, and storage functions are logical service roles that run on the appropriate systems within these segments; they are not separate networks of their own. Remote access is handled through Tailscale rather than exposing services directly.

• Management segment for administrative access to infrastructure.
• Services segment for core and hosted services.
• Trusted segment for primary end-user devices.
• IoT/Media segment for less-trusted devices.
• Controlled access between segments, with secure remote access through Tailscale.

Centralized Identity

Identity and authentication are centralized with FreeIPA, providing LDAP, Kerberos, and PKI services. Consolidating identity reduces local account sprawl and supports consistent authentication across hosts and services.

• FreeIPA for centralized identity
• LDAP and Kerberos authentication
• PKI for certificate services

Monitoring and Vulnerability Management

Security telemetry is aggregated for monitoring and detection. Wazuh provides SIEM/XDR capability, centralized rsyslog collects logs, and customized UniFi decoders and detection rules improve visibility. Greenbone/OpenVAS performs vulnerability assessment across the environment.

• Wazuh SIEM/XDR for detection and response.
• Centralized rsyslog log collection.
• Customized UniFi decoders and detection rules.
• Greenbone/OpenVAS vulnerability assessment.

High Availability

Core infrastructure services are designed to tolerate failure. Redundant BIND9 DNS and Kea DHCP high availability keep name resolution and addressing available, while Keepalived provides service failover and Caddy handles reverse proxying for hosted services.

• Redundant BIND9 DNS.
• Kea DHCP high availability.
• Keepalived service failover.
• Caddy reverse proxy for Docker-hosted services.

Backup and Disaster Recovery

Dedicated backup infrastructure supports recovery from data loss or host failure. Proxmox Backup Server captures virtual-machine backups, restoration is tested rather than assumed, and UPS-aware shutdown coordination helps protect systems during power events.

• Proxmox Backup Server for VM backups.
• Tested virtual-machine restoration.
• Controlled failover and rollback procedures.
• UPS-aware shutdown coordination.

Automation and Validation

Operational consistency is maintained through automation. Bash and systemd drive configuration validation and automated health checks, helping confirm that services are running as intended and that changes have not introduced regressions.

• Configuration validation.
• Automated health checks.
• Scripted operational tasks with Bash and systemd.

Lessons Learned

Operating Hades reinforces that segmentation, centralized identity, and monitoring are most valuable when paired with tested recovery. Building and breaking the environment turns security concepts into practical operational experience across identity, detection, availability, and disaster recovery.