Personal Infrastructure · Ubuntu Server 24.04 · Hailuoto, Finland
BLACKROSE
LAB
lab.blackrose.fi

A publicly accessible home lab server running a hardened security stack on dedicated enterprise server hardware. Built for learning, experimentation, and demonstration of real-world infrastructure skills. Everything here is live.

24/7
Uptime target
Hardened Servers
KVM on HP ProLiant
SSL✓
Let's Encrypt
—
IPs tarpitted, all time
3 × Ubuntu
Hypervisor + guest VMs
Ubuntu 24.04 Docker Nginx fail2ban endlessh UFW Let's Encrypt Portainer KVM/QEMU Wazuh OpenVAS
← Back to portfolio Threat map

// Live Activity

Banned for vulnerability scanning
Live
Loading ban data...
— banned IPs —
Endlessh — SSH Tarpit
Live
Loading tarpit data...
— connections —
fail2ban — Current Activity
Live
Loading fail2ban data...
— events —
fail2ban — Historical Bans
Loading fail2ban data...
— events —
UFW — Historical Blocks
Loading UFW data...
— events —

// Infrastructure

◆
Hypervisor
Dedicated enterprise server hardware running Ubuntu 26.04.1 LTS with KVM/QEMU and libvirt. Runs virtualisation only — no services of its own, and not reachable from the internet.
◈
Public Service VM
Ubuntu 24.04 guest — this server, and the only guest reachable from the internet. Everything under Running Stack lives here.
◎
Security VM
Ubuntu 24.04 guest, internal only. Runs monitoring and vulnerability scanning for the rest of the infrastructure, kept apart from the public VM so that a compromise on the public side doesn't take the monitoring down with it.

// Running Stack

◈
Ubuntu Server 24.04
Base OS of the public VM, running as a KVM/QEMU guest on dedicated enterprise hardware. SSH with key-only authentication.
▦
Nginx + SSL
Reverse proxy serving all public-facing services. Let's Encrypt certificates via Certbot with automatic renewal. Routes the public subdomains.
⬡
Docker + Portainer
Container runtime for the service stack. Portainer provides the management UI. Compose-based orchestration.
◎
fail2ban
Intrusion prevention — watches SSH and web server logs and bans offending addresses automatically, including custom rules for probes the default ruleset misses.
◷
Endlessh
SSH tarpit that holds scanners in an endless fake banner exchange that never completes, wasting their time. Its catches show in the panel above.
▣
UFW Firewall
Host firewall with a default-deny policy: only the services that need to be public are reachable from the internet.
◐
Uptime Kuma
Self-hosted availability monitoring for every public service, with a public status page and alerting when a check fails.
◉
Wazuh SIEM
Open-source SIEM and host intrusion detection running on a separate, internal-only security VM. Collects and correlates logs from this server — file integrity monitoring, rule-based detection and vulnerability assessment.
◌
Greenbone / OpenVAS
Vulnerability scanner on the same internal security VM, scanning this infrastructure from a separate host rather than from itself. Tracks known CVEs, weak configurations and exposed services over time.
✦
Fiber Uplink
Symmetric fiber connection with a stable public address — no carrier NAT and no dynamic DNS workaround. Services are reachable directly, which is why the panels above show real inbound traffic.

// Tooling

⬢
black-recon
Reconnaissance and exposure-assessment tool, written from scratch in Go. It maps and assesses internet-facing infrastructures: my own, and targets decided. One binary with a web interface and three modules over a shared SQLite store, so what one module finds can feed the others.
Crawler. Web crawler with soft-404 calibration, so pages that answer "200 OK" to everything are not mistaken for real findings.
Reverse DNS. Reverse-DNS enumeration over address ranges with device classification, wildcard-PTR detection and chunked sweeps of large ranges.
Storage buckets. Finds publicly readable cloud storage across AWS, GCS, Azure and DigitalOcean, seeded from certificate-transparency logs (crt.sh). Object listings are retained and triaged.
Every run is gated by a time-boxed scope allowlist, and a target outside it is refused. Results are kept per run with sorting, geolocation, live progress streaming and CSV export. The tool runs on the internal side only under a hardened service unit and is never exposed to the internet.