I encourage everyone working in IT, from junior engineers to senior architects, to build and maintain a personal lab. Solid theoretical resources matter, but hands-on practice is where ideas become operational knowledge.

I also run public-facing services. Unlike an isolated virtual machine, they make me accountable for availability, security, monitoring, and recovery, just like a production environment.

My lab has three main areas:

  • Public-facing infrastructure: authoritative DNS and this blog, distributed across several providers.
  • Networking lab: virtual topologies for testing routing, overlays, automation, and CI/CD workflows.
  • Home infrastructure: DNS resolution, network security, storage, backups, Git hosting, and monitoring.

Public-facing infrastructure

Authoritative DNS

I operate the authoritative DNS infrastructure for jvetter.net on three servers in different providers and regions:

  • ns1: BIND 9 primary hosted on OVHcloud in France.
  • ns2: Knot DNS secondary hosted by MikroVPS in Hungary.
  • ns3: Knot DNS secondary hosted on Microsoft Azure in the United States.

All three servers run Debian 13. Zone transfers and notifications are authenticated with TSIG.

The zone is signed automatically by BIND using:

  • ECDSA P-256 keys (ECDSAP256SHA256)
  • a one-year KSK lifetime and a 60-day ZSK lifetime
  • NSEC3
  • inline signing

Separating the authoritative servers across three providers gives the zone both software and geographic diversity.

Blog

  • URL: https://jvetter.net
  • Built with: Hugo and the PaperMod theme
  • Source and deployment: GitHub and Cloudflare Pages

The www hostname points directly to Cloudflare Pages. The apex domain cannot use a regular CNAME, so it points to an NGINX reverse proxy on my OVHcloud dedicated server, which redirects visitors to www.

sequenceDiagram
    participant Client as Web client
    participant DNS as jvetter.net authoritative DNS
    participant NGINX as NGINX at OVHcloud
    participant CF as Cloudflare Pages

    Client->>DNS: Resolve jvetter.net
    DNS-->>Client: Dedicated server address
    Client->>NGINX: HTTPS request
    NGINX-->>Client: 301 to https://www.jvetter.net
    Client->>DNS: Resolve www.jvetter.net
    DNS-->>Client: CNAME to jvetter-net.pages.dev
    Client->>CF: HTTPS request
    CF-->>Client: Static Hugo site

TLS and security

  • Let’s Encrypt wildcard certificates
  • automated renewal through Certbot and RFC 2136 DNS updates
  • HSTS, CSP, hardened HTTP headers, and security.txt (RFC 9116)

The certificate automation is described in Let’s Encrypt Certificate Renewal with RFC 2136.

Networking lab

My networking lab runs on a dedicated OVHcloud server with an Intel Xeon E3-1245 v2, 32 GB of RAM, and two 480 GB SSDs in software RAID.

It provides:

  • GNS3 for mixed-vendor labs
  • Containerlab for topology-as-code
  • Docker and KVM/QEMU
  • Arista cEOS, Juniper vJunos, and Linux containers
  • GitLab Runner for CI/CD experiments
  • WireGuard for remote access

Virtual appliances are not a substitute for line-rate data-plane testing, but they are ideal for validating control-plane behavior, routing policies, automation, and overlays such as VXLAN EVPN.

An example is my VXLAN EVPN lab, which deploys an Arista cEOS fabric with OSPF as the underlay and VXLAN with head-end replication as the overlay.

Home infrastructure

DNS resolver

A Raspberry Pi 3 Model B runs Knot Resolver for the home network, with:

  • DNSSEC validation
  • DNS-over-TLS
  • a local root-zone copy based on RFC 8806
  • RPZ-based filtering

Firewall

  • Hardware: Protectli Vault FW4B
  • Software: pfSense
  • Role: perimeter firewall, routing, and network segmentation

NAS and self-hosted services

My Synology DS718+ has 16 GB of RAM and two 12 TB disks in SHR. It is the central storage and backup platform for the lab.

It also hosts:

  • Gitea with PostgreSQL for private Git repositories
  • Netdata for NAS monitoring and email alerts
  • DSM reverse proxies for the internal services
  • automated Let’s Encrypt certificates using RFC 2136
  • encrypted data and USB backup volumes

Monitoring and automation

  • Netdata monitors the dedicated server and NAS.
  • Ansible manages the common server baseline and DNS roles.
  • Azure Bicep defines the ns3 cloud infrastructure.
  • Unattended upgrades, UFW, fail2ban, and Chrony provide a consistent baseline on the public servers.
  • Infrastructure configuration and operational runbooks are version-controlled.

Lab inventory

Host Type Provider Main roles Cost
dd1 Dedicated server OVHcloud GNS3, Containerlab, CI runner, Netdata, web redirect ~€40/month
ns1 Cloud VM OVHcloud Primary authoritative DNS ~€4/month
ns2 VPS MikroVPS Secondary authoritative DNS ~€3/month
ns3 Cloud VM Microsoft Azure Secondary authoritative DNS ~$21/month
rasp Raspberry Pi 3B Self-hosted DNS resolver Upfront
nas Synology DS718+ Self-hosted Storage, backups, Gitea, Netdata Upfront
fw1 Protectli Vault FW4B Self-hosted pfSense firewall Upfront
jvetter.net Domain and email OVHcloud Domain registration and mail ~€13/year

The recurring infrastructure cost is approximately €65-70 per month, depending on the EUR/USD exchange rate, excluding electricity and one-time hardware purchases.

Next steps

  • extend monitoring to every public DNS server and the Raspberry Pi
  • complete automated, tested backups for all servers
  • increase Ansible coverage across the lab
  • experiment with SVCB/HTTPS records
  • operate a virtual BGP router, an ASN, and RPKI