R-01
Network security
Can trust-zone segmentation meaningfully reduce lateral movement?
Examining zone boundaries, default-deny inter-zone policy, and the difference between logical separation and verified containment.
01 / Purpose
Security claims should be testable.
This collection connects principles such as least privilege, defense in depth, recoverability, and controlled administration to specific design choices in my homelab.
The notes distinguish what is implemented from what still needs stronger validation. Public versions omit exact addresses, firewall aliases, privileged commands, account names, and household-sensitive details.
02 / Notes
Current investigations
Three initial studies covering prevention, administration, and recovery.
R-02
Access control
What changes when remote administration is bounded by design?
Comparing unrestricted fleet access with a narrow control-node path, explicit playbook allowlists, and supervised remediation.
R-03
Resilience
When does availability become a security control?
Using a management-plane failure to study circular dependencies, alternate recovery paths, monitoring, and the remaining need for tested restores.
03 / Scope
What these notes do—and do not—prove
Evidence over labels
A control is described through its implementation and observable behavior, not through a tool name or an unsupported “enterprise-grade” claim.
Operational context
The environment has real users, dependencies, maintenance windows, and failure modes, but it is still a personal system rather than a corporate production network.
Sanitized publication
Enough detail is included to explain the reasoning while withholding information that would expose the live environment’s full attack surface.
Open limitations
Unverified assumptions and incomplete controls are recorded as next work rather than presented as finished security outcomes.
Related implementation evidence
See the system these notes examine.
The infrastructure case study covers the architecture, operating model, automation, observability, and known risks behind this research.