Concrete drills and checklists you can run tonight. Nation-state grade, home-router budget.
13 dispatches · latest 18 SEP 2026
What gets filed here
Full archive →Defensive procedures, drills, configurations, checks and scripts you can run yourself, tonight, on your own gear.
Your containers stop being a free elevator to the host — and you can prove it with one deliberate test. Audit the raw /var/run/docker.sock mounts, front them with Tecnativa's socket proxy (pinned v0.5.0), then userns-remap or rootless for structural isolation.
One spare switch port, one Docker container, and you find out exactly who is scanning your network — and when they touch something that shouldn't exist. Built around Cowrie 3.x and CISA's Sep 16 cyber-decoys guidance.
Your cameras can't phone home or leak creds to the internet, and only your NVR can reach them — with four firewall rules on OPNsense (or UniFi) that take an afternoon. Verified against current docs, 2026-09-16.
No exposed edge port, no NAT hairpinning — Headscale gives you an encrypted WireGuard mesh to your whole lab from any device, with split DNS that actually resolves on mobile. v0.29 is a breaking release; here's how to land on v0.29.3 cleanly.
Two GL.iNet routers and a port forward turn any hotel or airport network into an encrypted pipe to your home LAN — your phone keeps its home IP, no third-party VPN subscription required.
Cameras on a no-internet VLAN, detection on hardware you already own, alerts out of your own HA instance — coverage without a subscription or a vendor watching your driveway.
Your servers trust one CA public key instead of a pile of authorized_keys files — and every credential expires on its own. OpenSSH has had this since 5.4; here's how to actually turn it on.
HA Cloud login attempts finally show the real attacker IP, and the Security dashboard gets active alerts + favorites — a weekend-afternoon setup that turns your smart home's security page from a static checklist into something that tells you what's on fire.
Your compromised host keeps its backup credentials but can't delete or rewrite history, because the repo only accepts appends from a second key. A $5 VPS, one restricted SSH key, and restic 0.19.x — ~2 hours for first setup.
Put Authentik's forward-auth check behind a single Caddy reverse proxy and every app on your lab gets login + MFA — even the ones with no SSO support at all.
Yesterday the DOJ bricked QTFY's botnet. Today: one afternoon of grep against your own DNS logs tells you whether your cameras and plugs were quietly routing a Chinese state actor's traffic. Here's the exact pipeline, verified against the live IOC CSVs.
A one-hour setup that checks, restores, and byte-compares your restic repo on a timer — so you find out your backups are broken on your schedule, not the attacker's.
You don't need enterprise gear to close most of the gaps the FSB router advisory calls out. Here's a concrete checklist you can run on your home edge tonight.