Homelab · security · infrastructure
Notes from building, breaking & running real systems.
Build logs, penetration-test write-ups and videos from a working homelab — every command, every wrong turn, and why each fix mattered.
SpencerLab shell — a guided tour of this site.
Type help to list commands.
Live lab telemetry
Real numbers from the homelab node serving this page, judged by the same HA agents that run in Aegis CloudOps.
Latest
The newest write-up off the bench.
Domainfolio: one app, a sale page for every domain
A self-hosted domain portfolio: every domain I own points at one Next.js app, which reads the Host header and renders that domain's for-sale page, with an offers inbox, per-domain visit stats and lease-to-own terms. It runs in Docker behind its own Cloudflare Tunnel, and the names are also listed on Afternic.
Now building
Projects in progress, with build logs updated as they move.
Domainfolio: one app, a sale page for every domain
A self-hosted domain portfolio: every domain I own points at one Next.js app, which reads the Host header and renders that domain's for-sale page, with an offers inbox, per-domain visit stats and lease-to-own terms. It runs in Docker behind its own Cloudflare Tunnel, and the names are also listed on Afternic.
Road to CISSP: building a study platform from fundamentals to CISSP
road2cissp.com: a React study platform with an AI tutor, interactive labs, a Security+ exam simulator and synced progress. The frontend is on Vercel and the FastAPI backend runs on a Fedora VM in this homelab, behind its own Cloudflare Tunnel.
A third Proxmox host, outside the cluster
A third machine running Proxmox VE as a standalone host, next to the two-node cluster rather than in it. It started with the Minecraft server and now also runs production for Aegis CloudOps and Fishing Rod Terminal, with production-first boot order and nightly backups to the Time Capsule.
Recent posts
Builds, repairs, pentests and assessments, newest first.
Every VM, every night: homelab backups to the Time Capsule
Nightly vzdump backups on all three Proxmox hosts, pushed to a Time Capsule on the LAN and pruned to four copies per guest. The pruning had never worked: one host's disk filled to 98.8% and every backup on it failed before the bug was found. Fixing it freed about 530 GB.
Market-readiness review: five billing and signup holes in my own SaaS
A pre-launch review of Aegis CloudOps and Fishing Rod Terminal found that signup could join any tenant or choose a paid plan, checkout granted plans for free without Stripe, pay-as-you-go unlocked paid features with no card, and two products could charge each other's prices. All five were fixed and verified live. None had been used.
The Great Migration: Aegis production comes home
The production API behind Aegis CloudOps and Fishing Rod Terminal moved off a DigitalOcean droplet and onto a VM in this homelab, behind its own Cloudflare Tunnel. The move, an exposed Kubernetes API found on the new box, an outage, and the claims that had to be corrected afterwards.
Cloud Migration Readiness: a 6R assessment inside Aegis
A new Aegis feature: upload a server inventory, or run a read-only Proxmox discovery script, and get a 6R call per workload, an end-of-support check, AWS sizing at list price, a readiness score and dependency-grouped move waves. Its first real test was the Proxmox host that had just taken production out of the cloud.
Road to CISSP: building a study platform from fundamentals to CISSP
road2cissp.com: a React study platform with an AI tutor, interactive labs, a Security+ exam simulator and synced progress. The frontend is on Vercel and the FastAPI backend runs on a Fedora VM in this homelab, behind its own Cloudflare Tunnel.
A third Proxmox host, outside the cluster
A third machine running Proxmox VE as a standalone host, next to the two-node cluster rather than in it. It started with the Minecraft server and now also runs production for Aegis CloudOps and Fishing Rod Terminal, with production-first boot order and nightly backups to the Time Capsule.
Videos
Build logs and walkthroughs on camera, self-hosted.
Activity
Publishes, build-log updates, deploys and agent verdicts.
-
deploy
Site updated — Update
- published
-
update
Domainfolio: one app, a sale page for every domain Domainfolio: lease-to-own terms per domain, Afternic listings, admin redirect fix.
-
update
Domainfolio: one app, a sale page for every domain Domainfolio v1 live: host-routed landers, catalog, offers inbox and admin.
- published
- published
-
update
A third Proxmox host, outside the cluster Nightly vzdump to the Time Capsule verified; production VM boots first after a host restart.
- published
Browse by topic
Build it, fix it, break it, judge it, run it.
Built
Infrastructure and systems stood up from scratch — servers, networks, sites, tooling.
9 postsRepaired
Things that broke, and how they were diagnosed and put back — with the dead ends kept in.
0 postsPentested
Offensive security on lab targets and authorized scope — methodology, tooling, and findings.
1 postAssessed
Posture reviews, audits, and risk assessments — what was measured and what it meant.
2 postsAdministered
The day-to-day of running systems — users, services, backups, monitoring, upkeep.
3 postsWho writes this?
A security- and infrastructure-focused engineer documenting a homelab in public.