Dell PowerEdge · Proxmox VE
One rack, honestly described. This is the same hardware the capstone runs on. There is no second finished lab, and nothing here includes live addresses, credentials, or internal hostnames.
rack · 1 chassis
pve01
Proxmox VE host
vmbr
bridges + VLAN trunk
fw
pfSense edge
det
detonation segment
gold
golden templates
guest agent up · vlan isolated · templates hashed
Layout
topology · no live addresses
The management NIC stays off the detonation segment. You never want the interface you administer the host from sharing a broadcast domain with a machine you are deliberately infecting. Linux bridges on the host map guests to segments, and the vmbr3 role is the WAN side bridge, kept away from the detonation VLAN.
Detonation happens on an isolated VLAN with no internet route while a sample is running. Guests come from golden templates, so a rebuild is a clone rather than an install. Every provisioning run starts with an Ansible ping, then a QEMU guest agent check, because a VM answering ICMP does not mean the in guest command channel is ready.
Semaphore gives the playbooks a job UI so runs are repeatable instead of a shell history archaeology project, and Velociraptor provides endpoint visibility and artifact collection.
Checks
pfSense fronts the segment, VyOS handles gateway and DHCP roles, Zeek watches traffic, and FakeNet answers callbacks so a sample keeps behaving instead of stalling on a dead lookup. WinRM is deliberately not enabled on the malware VLAN, so orchestration never depends on the infected machine having a usable network path.
SHA-256 hashes are recorded for templates 3000 through 3013 before anything is detonated. After a rebuild, the hash comparison turns "I think it is clean" into "this matches the known good template." It is the least glamorous part of the rack and the part I would defend hardest in an interview.
Champlain systems administration and networking coursework is where the bridge, VLAN, and templating habits started. Write ups live in the course wiki.
Planned, not done
planned
Ansible Vault
Move the remaining secrets out of playbook variables.
planned
Management VLAN and 2FA
Separate management traffic and put two factor auth on the Proxmox UI.
planned
Rule based detection
Add signature rules alongside the behavioral score.
planned
Second host
More capacity so a rebuild does not compete with a running detonation.
Open to 2026 roles
Security operations, IT infrastructure, or systems and network administration. I reply the same day.