[ Installations · Facility Systems ]
Things I've built and still run, not things I built once and screenshotted.
A Model Context Protocol server exposing 24 Kali pentest tools over SSH, so an AI agent can drive offensive-security tooling with guardrails instead of a bare shell. This is the concrete artifact behind "AI x offensive security" — not a demo, a server that runs.
A six-stage collection pipeline (collect, normalize, enrich, score, dedupe, publish) that pulls from CISA KEV and NVD, scores CVEs with EPSS instead of raw CVSS severity, and publishes short per-niche digests instead of one unread firehose. Runs as a production service behind the homelab’s forward-auth.
A single-operator SOC built on a homelab budget: log collection and normalization, a SIEM, detections written and version-controlled as Sigma rules, hypothesis-driven threat hunting instead of alert-chasing, and SOAR playbooks that automate the 80% of response that doesn’t need a human. Documented end to end in the Blue Team Homelab series.
30+ self-hosted services across a 2-node Proxmox cluster, run solo: SSO-gated by default via forward-auth, one source of truth for monitoring, and systemd memory-guard discipline that exists because an unguarded service once OOM-crashed the VM. The Start Your AI Homelab series documents how to build the foundations; the two-years-in field note covers what actually broke.
A fleet of always-on bots and data pipelines operated for a private online community — webhook ingestion, scheduled pulls from rate-limited third-party APIs, and alerting with dedupe logic, kept running under real users who notice within minutes when something breaks. The point isn't what the bots say; it's that they say it 24/7 without a pager team behind them.