What the machine is serving
Every project lives on the same Oracle Cloud ARM64 VM, behind one nginx reverse proxy with Let's Encrypt TLS. Here's the current manifest.
On the workbench
Security and networking work I run against this very server - the best way to learn is to harden, break and inspect a live machine.
Nginx Security Hardening
activeSecure headers, disabled unused modules and per-IP rate limiting on the reverse proxy in front of every site.
TLS 1.3 Handshake Analysis
activeCapturing and dissecting TLS 1.3 handshakes in Wireshark - key exchange and cipher negotiation up close.
OpenVPN Server
runningSelf-hosted VPN on the VM, testing split-tunnelling and kill-switch configurations.
DNS over HTTPS
in progressWeighing DoH vs DoT privacy tradeoffs and inspecting DNS leakage in browser traffic.
QUIC Protocol Capture
plannedAnalysing QUIC handshakes and comparing latency against a TCP + TLS baseline.
Wazuh SIEM
activeLog collection and alerting across the host - watching auth logs, nginx access and system events.
Commands worth keeping
nmap --script ssl-enum-ciphers -p 443 <host>
limit_req_zone $binary_remote_addr
zone=one:10m rate=10r/s;
ss -tulnp
certbot renew --dry-run