Security Hardening & Network Segmentation Plan

Executive Summary

This plan transforms the Sanchez Home Network from a flat, trust-all architecture into a segmented, zero-trust infrastructure capable of safely hosting public web services while protecting sensitive internal systems.

Implementation Status Update (2026-02-18)

Threat Model

Critical Assets

Threat Actors

Previously Exposed Services (Now Being Fixed)

Vulnerability Status

Tracked vulnerabilities with current remediation status as of the 2026-02-15 lockdown.

Phase 0: Completed Hardening

Vaultwarden Isolation (Pre-Lockdown)

2026-02-15 Lockdown (Platform-Wide)

Phase 1: Infrastructure Hardening (2026-02-15) COMPLETE

Target Architecture

Why This Architecture?

Cloudflare One Integration Opportunities

Beyond the Tunnel and Access already in the plan, the Cloudflare One platform offers additional components that could replace or complement local tools:

Authentication & Authorization (Authelia)

Authorization Levels

Services Requiring Two-Factor

Configuration Design

Cloudflare Access + Authelia Dual-Layer Architecture

Cloudflare Access and Authelia serve complementary roles and can coexist without conflict:

Request Flow (Public Access)

Request Flow (LAN Access)

Key Design Points

• Cloudflare Access passes a signed JWT in Cf-Access-Jwt-Assertion header — Traefik/Authelia can optionally validate this to trust the edge identity
• Authelia handles all local .home access where Cloudflare has no visibility
• Both layers enforce independently: if Cloudflare Access is bypassed (e.g., direct IP access), Authelia still requires 2FA
• Cloudflare Access policies: restrict admin subdomains to specific email addresses (rodchemist@...)
• Configure in Phase 2 (Cloudflare consolidation) alongside Authelia deployment in Phase 1

Encryption Strategy

In Transit (All Connections Encrypted)

At Rest (Sensitive Data Encrypted)

LUKS Implementation

Target: Create an encrypted volume at /home/rod/_rod/_hosting/encrypted/ holding Vaultwarden DB, MariaDB data, Traefik certs, and .env credentials. Auto-unlock via systemd + TPM or passphrase keyslot at boot.

Network Segmentation

VLAN Design

ER605 ACL Rules (10 total, within 50-entry limit)

Host Firewall Rules

TinyDesk (DMZ) UFW

Default: DENY incoming, ALLOW outgoing
ALLOW 51820/udp FROM 10.0.20.2    # WireGuard from Rod-Server
ALLOW 22/tcp FROM 10.0.1.0/24      # SSH from Home LAN
DENY everything else inbound

Rod-Server (Internal) UFW

Default: DENY incoming, ALLOW outgoing
# WireGuard
ALLOW 51820/udp FROM 10.0.10.2           # WireGuard from TinyDesk
# Database access via WireGuard tunnel ONLY
ALLOW 3306/tcp FROM 10.0.99.1            # MariaDB
ALLOW 5432/tcp FROM 10.0.99.1            # PostgreSQL
ALLOW 6379/tcp FROM 10.0.99.1            # Redis
# LAN services
ALLOW 80,443/tcp FROM 10.0.1.0/24        # Traefik (*.home)
ALLOW 53 FROM 10.0.1.0/24                # Pi-hole DNS
ALLOW 22/tcp FROM 10.0.1.0/24            # SSH
ALLOW 8043 FROM 10.0.1.0/24              # Omada controller
# Docker internal
ALLOW FROM 172.16.0.0/12                  # Docker subnet (internal)
DENY everything else

IoT DNS Pinhole Risk

Docker Isolation

Network Segmentation (Target)

Docker Socket Protection

The Docker socket (/var/run/docker.sock) grants root-equivalent access. Currently exposed to Traefik, Portainer, and Dockge.

Mitigation: Dual Docker socket proxy architecture (tecnativa/docker-socket-proxy):

* Portainer requires EXEC=1; Dockge does not. Management proxy restricted to web_admin network only.

# Read-only proxy (Traefik)
docker-socket-proxy-ro:
  image: tecnativa/docker-socket-proxy
  environment:
    CONTAINERS: 1
    IMAGES: 0
    NETWORKS: 1
    SERVICES: 1
    POST: 0          # Read-only
  volumes:
    - /var/run/docker.sock:/var/run/docker.sock:ro
  networks:
    - socket_proxy

# Management proxy (Portainer + Dockge)
docker-socket-proxy-mgmt:
  image: tecnativa/docker-socket-proxy
  environment:
    CONTAINERS: 1
    IMAGES: 1
    NETWORKS: 1
    SERVICES: 1
    VOLUMES: 1
    POST: 1          # Write access for management
  volumes:
    - /var/run/docker.sock:/var/run/docker.sock:ro
  networks:
    - web_admin      # Only accessible from admin network

Known Limitations

Container Security Standards

• read_only: true + explicit tmpfs mounts
• security_opt: [no-new-privileges:true]
• cap_drop: [ALL] + explicit cap_add only when needed
• No privileged: true unless required (only Home Assistant)
• Specific Docker network per security tier (not default bridge)
• No published ports when behind Traefik

Intrusion Detection (CrowdSec)

Why CrowdSec

• Collaborative threat intelligence: Shares attack patterns with 200K+ installations
• Traefik bouncer plugin: Blocks malicious IPs at the reverse proxy level before reaching services
• Low resource usage: ~50MB RAM, Go binary
• Free for self-hosted: Community edition includes all detection capabilities
• Complements Authelia: CrowdSec blocks known-bad IPs; Authelia verifies identity

Kill Chain Detection (Mapped to Traefik Logs)

Traefik Hardening Middleware COMPLETE

All Traefik hardening middleware has been applied to dynamic.yml and traefik.yml as of 2026-02-15:

Rate Limiting (DoS / Brute Force)

auth-rate-limit:
  rateLimit:
    average: 5        # 5 requests/second sustained
    burst: 10         # allow spike of 10
    # Apply to login/auth endpoints

Request Size Limits (Buffer Overflow / DoS)

body-limit:
  buffering:
    maxRequestBodyBytes: 2097152    # 2MB max request body
    maxResponseBodyBytes: 10485760  # 10MB max response body
    memRequestBodyBytes: 1048576    # 1MB in-memory buffer
    memResponseBodyBytes: 1048576

Circuit Breaker (Exploitation Detection)

circuit-breaker:
  circuitBreaker:
    expression: "ResponseCodeRatio(500, 600, 0, 600) > 0.25"
    # Trips when >25% of responses are 5xx errors

Timeout Hardening (Slowloris Defense)

In traefik.yml static config:

serversTransport:
  forwardingTimeouts:
    dialTimeout: 5s
    responseHeaderTimeout: 30s
    idleConnTimeout: 30s

Secure Middleware Chain

secure-chain:
  chain:
    middlewares:
      - security-headers
      - auth-rate-limit
      - body-limit
      - circuit-breaker

TLS Hardening

tls:
  options:
    default:
      minVersion: VersionTLS12
      cipherSuites:
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
      sniStrict: true

Implementation Phases

Phase 0: Emergency Fixes COMPLETE

• Verify ER605 firmware patched (v2.3.3)
• Disable Vaultwarden signups
• Isolate Vaultwarden on dedicated Docker network
• Restrict admin panel to LAN-only
• Add rate limiting + security headers to Vaultwarden
• Enable read-only filesystem + no-new-privileges
• Add lan-only middleware to 19 admin routers (2026-02-15)
• Add cloudflare-only middleware to 18 public routers (2026-02-15)
• Add https-redirect middleware to all 47 HTTP routers (2026-02-15)
• Apply security-headers middleware to all 36+ HTTPS routers (2026-02-15)
• Fix cloudflare-real-ip plugin: populated trustedCIDRs with 15 Cloudflare IP ranges (2026-02-15)
• Restrict UFW DNS (port 53) to LAN-only (2026-02-15)
• Restrict UFW Omada ports (29810-29814) to LAN-only (2026-02-15)
• Populate DOCKER-USER iptables chain: DROP rules for 9 ports (2026-02-15)
• Create systemd service for DOCKER-USER persistence (2026-02-15)
• Move hardcoded VPN credentials to .env (2026-02-15)

Phase 1: Infrastructure Hardening COMPLETE

Traefik hardening middleware:

• Add auth-rate-limit middleware (avg: 5/s, burst: 10) to login endpoints (2026-02-15)
• Add body-limit middleware (maxRequestBodyBytes: 2MB) to all routers (2026-02-15)
• Add circuit-breaker middleware (trip at >25% 5xx) to all backends (2026-02-15)
• Configure serversTransport timeouts: dialTimeout 5s, responseHeaderTimeout 30s, idleConnTimeout 30s (2026-02-15)
• Create secure-chain middleware compositions (2026-02-15)
• Enforce TLS 1.2+ with ECDSA cipher suites and sniStrict: true (2026-02-15)

Database TLS (moved from Phase 3):

• Enable TLS on MariaDB: require_secure_transport=ON, cipher TLS_AES_256_GCM_SHA384 (2026-02-15)
• Enable TLS on PostgreSQL: TLSv1.3, cipher TLS_AES_256_GCM_SHA384, certs in persistent volume (2026-02-15)
• Verify all application connections use TLS: Nextcloud, n8n, crypto-predictor, Vaultwarden

Supply chain & DNS:

• Trivy container scanning: v0.69.1, weekly cron Sundays 3AM (2026-02-15)
• Pi-hole blocklists hardened: 1,442,496 gravity domains — 6 new C2/malware/phishing feeds from abuse.ch, NoTracking, RPiList (2026-02-15)
• Image digest pinning: 11 images pinned by SHA256 (8 hosting + 3 LibroSynth) — completed early, moved from Phase 2 (2026-02-15)

Authelia (2FA) — remaining:

• Deploy Authelia with TOTP two-factor
• Configure Traefik forwardAuth middleware pointing to Authelia
• Protect all admin panels with two_factor policy (see Section 5.2)
• Create Authelia user rodchemist with TOTP enrollment
• Test all protected routes from both LAN and internet

CrowdSec (IDS) — remaining:

• Deploy CrowdSec with Traefik bouncer plugin
• Configure kill chain detection scenarios (reconnaissance, exploitation, C2)
• Enable crowdsourced blocklists for preemptive IP blocking

Monitoring (Grafana) — remaining:

• Add Prometheus as Grafana data source (already scraping crypto-predictor)
• Add Loki as Grafana data source (deploy Loki + Promtail for Traefik/container logs)
• Create security dashboard: failed auth attempts, 4xx/5xx rates, CrowdSec bans
• Configure alert rules: brute force (>10 failed logins/5min), error spike (5xx > 25%), new container started, unusual outbound connections

Key Prometheus queries for security monitoring:

# DDoS / scanning spike detection
rate(traefik_entrypoint_requests_total[5m])

# Backend crash detection (exploitation indicator)
rate(http_requests_total{status="500"}[5m])

# Resource abuse (crypto-miner detection)
process_resident_memory_bytes
rate(node_cpu_seconds_total[5m])

Key Loki queries:

# Authelia brute force detection
{compose_service="authelia"} | logfmt | level="error"

# Traefik 4xx/5xx by source IP
{compose_service="traefik"} | json | DownstreamStatus >= 400

Phase 2: Cloudflare & Firewall IN PROGRESS

• Pin critical container images by digest (SHA256): 11 images pinned (8 hosting + 3 LibroSynth) — completed early in Phase 1 (2026-02-15)
• 10.0.1.5 cleanup: strip to cloudflared-only DMZ endpoint IN PROGRESS
• Configure Cloudflare Access for external admin access
• Disable cloudflared on Rod-Server
• Harden UFW on Rod-Server (LAN-only ingress)
• Remove ER605 port forwarding rules
• Enable UFW on TinyDesk (deny all inbound)
• Evaluate Cloudflare Browser-Rendered SSH as replacement for wetty Terminal containers (see Section 4.3)

Phase 3: Encryption & Tunnels PLANNED

• WireGuard tunnel between TinyDesk & Rod-Server
• LUKS encrypted volume for sensitive data
• Migrate Vaultwarden data to encrypted volume
• Migrate MariaDB data to encrypted volume
• Enable TLS on MariaDB connections → Completed in Phase 1 (TLS_AES_256_GCM_SHA384)
• Enable TLS on PostgreSQL connections → Completed in Phase 1 (TLSv1.3)
• Move .env and cert keys to encrypted volume
• Enable mTLS (mutual TLS) on database connections — client cert required, not just server cert

Phase 4: Network Segmentation & Monitoring PLANNED

VLANs:

• Create VLAN 10 (DMZ, 10.0.10.0/24) on ER605
• Create VLAN 20 (Infrastructure, 10.0.20.0/24) on ER605
• Create VLAN 30 (IoT, 10.0.30.0/24) on ER605
• Physical cabling to separate VLAN ports
• Configure 10 ACL rules on ER605 (see Section 7.2)

IoT VLAN 30 implementation:

• Create dedicated SSID Sanchez_IoT mapped to VLAN 30
• Enable AP Isolation / Client Isolation on IoT SSID
• Configure DHCP for VLAN 30 to hand out Pi-hole as sole DNS server
• Block IoT gateway admin access: DENY VLAN 30 → 10.0.30.1:80/443/22
• Implement strict egress filtering for IoT devices
• Deploy Avahi/mDNS reflector for HomeKit/Cast discovery across VLANs
• Route HA ↔ IoT via MQTT broker on Rod-Server

Monitoring:

• Centralized logging (Grafana + Loki) if not done in Phase 1
• Configure IoT behavioral baselines: alert on new external IP contact or traffic pattern deviation
• Configure alerting for security events

Docker isolation:

• Restructure Docker networks to /24 subnets (see Section 8.1)
• Deploy dual Docker socket proxies (see Section 8.2)

Phase 5: Ongoing Hardening PLANNED

• Automated encrypted backups (consider Cloudflare R2 for off-site — S3-compatible, zero egress fees)
• Authelia WebAuthn/FIDO2 support (hardware key)
• Evaluate Cloudflare WARP as alternative to Tailscale for inter-host SSH mesh (see Section 4.3)
• Regular ER605 firmware update checks
• Annual penetration test (self or third-party)
• Suricata NIDS deployment on WireGuard interface (wg0) — the DMZ↔Internal choke point catches non-HTTP attacks (DB buffer overflows, SSH exploits, data exfiltration) that CrowdSec's log-based detection misses
• Behavioral analytics on Authelia logs (impossible travel, abnormal access times)
• Deploy secondary Pi-hole on TinyDesk for IoT DNS (eliminates IoT→Infrastructure DNS pinhole — see Section 7.5)
• Evaluate Cloudflare Gateway as IoT DNS filter (edge-based, no local dependency)

Service Classification Matrix

CRITICAL (Highest Isolation)

HIGH (Two-Factor Required)

MEDIUM (One-Factor or Own Auth)

LOW (Public or Bypass)

Decision Log

Appendix A: Incident Response Playbook

Aligned with NIST SP 800-61 (Computer Security Incident Handling Guide) adapted for single-admin home infrastructure.

A.1 Preparation (Pre-Incident)

• Maintain offline backup of all .env credentials and Authelia TOTP seeds
• Keep printed copy of this playbook near the server
• Bookmark CrowdSec dashboard URL and Grafana security dashboard
• Pre-stage forensic tools: tcpdump, strace, lsof installed on host
• Maintain container image inventory (output of weekly Trivy scan)
• Recovery key for LUKS stored in secure location (printed, fireproof safe)

A.2 Identification (Is This an Incident?)

Indicators of Compromise (IoCs) to check:

A.3 Containment (Stop the Bleeding)

Immediate (< 5 minutes):

• Network isolation: sudo ufw default deny incoming && sudo ufw reload
• Preserve evidence: docker logs --since 48h [container] > /tmp/incident_$(date +%s).log
• Snapshot running state: docker ps -a > /tmp/containers_$(date +%s).txt && ss -tlnp > /tmp/listeners_$(date +%s).txt

Short-term (< 1 hour):

• Stop compromised container: docker stop [container] (do NOT docker rm — preserve for forensics)
• Block attacker IP: sudo ufw deny from [IP] and cscli decisions add --ip [IP] --duration 720h --reason "Manual incident response"
• Revoke active sessions: Restart Authelia container to invalidate all sessions
• Disconnect WAN (if active exfiltration): Unplug ER605 WAN cable as last resort

A.4 Eradication (Remove the Threat)

• Identify root cause: Vulnerable image? Compromised credentials? Unpatched service?
• Remove persistence: Check for webshells, unauthorized SSH keys, rogue cron jobs, modified container images
• Scan all container images: trivy image --severity HIGH,CRITICAL [image] for every running container
• Rotate ALL credentials: Generate new passwords for every entry in /home/rod/_rod/.env, update all services
• Regenerate Authelia session secrets and force TOTP re-enrollment
• Regenerate TLS certificates if private keys may have been exposed

A.5 Recovery (Restore Normal Operations)

• Rebuild from known-good images: docker compose pull && docker compose up -d
• Restore UFW: Re-enable incoming rules per standard configuration
• Verify services: Test all Traefik routes, confirm CrowdSec is running, check Authelia login
• Monitor closely: Watch Grafana security dashboard and CrowdSec alerts for 48-72 hours post-recovery
• Verify DOCKER-USER rules: sudo iptables -L DOCKER-USER -n --line-numbers

A.6 Lessons Learned & Notification (Post-Incident)

• Document timeline in _rod/INCIDENT_LOG.md: what happened, when detected, actions taken, root cause
• Notify affected users: If user data was compromised (Plex, Vaultwarden, Nextcloud shared with family/friends), notify them within 72 hours. Even for a home lab, there is an ethical (and potentially legal under PIPEDA/GDPR) obligation to disclose credential compromise to anyone whose data you host
• Update this plan: Add new detection rules based on the attack vector
• Update CrowdSec scenarios: If the attack pattern wasn't caught, create a custom scenario
• Review and tighten: Were there middleware gaps? Missing rate limits? Exposed endpoints?
• Schedule follow-up scan: Run Trivy + verify all credentials 1 week after incident
• Post-mortem: Formal root cause analysis — how did the breach happen, what controls failed, what changes prevent recurrence

A.7 Authelia Lockout Recovery

A.8 LUKS Emergency Decryption

sudo cryptsetup luksOpen /dev/mapper/encrypted-data recovery --key-file /path/to/recovery.key