Architecture and Topology

Back to Home Lab Documentation Hub

Logical Topology

• Edge network ingress enters through TP-Link router and pfSense boundary.
• Management and server workloads are segmented to limit lateral movement.
• Domain services are centralized in Windows Server 2022 Active Directory.
• Linux services (RHEL 9, Apache, Nginx) are isolated for controlled exposure tests.

Design Principles

• Segmentation first: explicit trust boundaries between workloads.
• Least privilege: identity and policy assignments scoped by role.
• Observability by default: all critical hosts emit logs/metrics.
• Repeatability: infrastructure changes are documented and validated.

Validation Evidence

• Connectivity tests between permitted zones succeed.
• Blocked paths remain denied under firewall policy review.
• Service health and telemetry visible in monitoring stack.