🛡️ Defense in Depth

Multi-Layer Security Architecture

01
🔥

VPS Perimeter

First line of defense at the public gateway. Traffic is filtered and analyzed before entering the tunnel.

→UFW Firewall
→CrowdSec IDS/IPS
→DDoS Protection
→Rate Limiting
→Fail2Ban
→Port Restrictions
02
🔐

Encrypted Transport

All traffic between VPS and homelab is encrypted end-to-end with modern protocols.

→Wireguard Tunnel
→TLS 1.3 (Traefik)
→Let's Encrypt SSL
→Certificate Pinning
→Perfect Forward Secrecy
→HSTS Headers
03
🌐

Network Isolation

Services are segmented into isolated networks with controlled communication paths.

→Docker Networks
→Service Segmentation
→Database Isolation
→VPN Gateway (Gluetun)
→DNS Filtering (Pi-hole)
→VLAN Separation
04
🔒

Application Security

Each service implements authentication and access controls appropriate to its function.

→Service Authentication
→2FA (where available)
→Access Control Lists
→Session Management
→API Key Rotation
→Security Headers
05
💾

Data Protection

Storage layer ensures data integrity and availability through redundancy and verification.

→BTRFS Checksumming
→RAID5 Redundancy
→Encrypted Backups
→Snapshot Management
→Data Scrubbing
→Off-site Backups
06
📊

Monitoring & Response

Continuous monitoring enables early threat detection and rapid incident response.

→Log Aggregation
→Intrusion Detection
→Performance Metrics
→Uptime Monitoring
→Alert Notifications
→Automated Updates

⚠️ Threat Model & Mitigations

DDoS Attacks
CrowdSec + CloudFlare DDoS protection on VPS. Rate limiting at multiple layers. Automatic IP banning.
Unauthorized Access
Zero-trust tunnel architecture. No direct port forwarding. All services behind authentication + 2FA.
Data Breaches
End-to-end encryption. Network isolation. Database access restricted. Credentials stored in Vaultwarden.
Man-in-the-Middle
TLS 1.3 with Let's Encrypt certificates. HSTS enforcement. Certificate pinning. Wireguard encryption.
Malware/Exploits
Container isolation. Regular updates via Watchtower. VPN for torrent traffic. Pi-hole DNS filtering.
Data Loss
RAID5 redundancy (2-disk failure tolerance). BTRFS checksums. Automated backups. Snapshot retention.