Hardened Hybrid-Cloud Private Network
Phase 1 completed: designed a zero-trust private network across on-premises, cloud, and roaming endpoints with SSH hardening, DNS privacy, and secure remote transit.
Core stack
Case Snapshot
Role
Infrastructure ownership: architecture, hardening, access model, monitoring, recovery path, and operating notes.
Scope
I implemented a Tailscale-based private overlay connecting roaming workstations, a VPS, and a Debian VM on Proxmox. SSH was hardened around ED25519 keys and passwordless access, Pi-hole and Unbound provide private recursive DNS,...
Constraints
The design uses key-only SSH access with ED25519, disables password-based administration paths, avoids dependency on public DNS resolvers, and minimizes direct exposure. Private recursive DNS through Unbound and interface-aware...
Result
Removed password-based SSH administration from the environment
Architecture
Node
Roaming laptops and other client devices join the private overlay as authenticated nodes and use stable private addressing plus shared SSH aliases for consistent administration.
Edge
A Debian VM on a Proxmox host provides the private operations anchor: hardened SSH, Pi-hole, Unbound, exit-node capability, and the firewall rules that separate trusted overlay traffic from other interfaces.
Cloud
A VPS participates in the same private overlay, extending the network into the cloud without turning the management plane into a broadly exposed public surface.
Node
Roaming laptops and other client devices join the private overlay as authenticated nodes and use stable private addressing plus shared SSH aliases for consistent administration.
Edge
A Debian VM on a Proxmox host provides the private operations anchor: hardened SSH, Pi-hole, Unbound, exit-node capability, and the firewall rules that separate trusted overlay traffic from other interfaces.
Cloud
A VPS participates in the same private overlay, extending the network into the cloud without turning the management plane into a broadly exposed public surface.
Technical Diagrams
Architecture diagrams show the system boundary, runtime flow, and operational decisions in a compact review format.
Hardened Hybrid-Cloud Private Network
The network diagram shows roaming devices, Tailscale private overlay, the VPS cloud node, and the home lab runtime. It emphasizes key-only SSH, private DNS, interface-aware firewalling, exit-node routing, and planned segmentation without exposing management services directly to the public Internet.
What the diagram shows
- Management access is routed through authenticated private overlay nodes
- Pi-hole and Unbound keep DNS resolution under local control
- Planned IoT, guest, and detection layers are separated from the current verified baseline
Technical Decisions
- ED25519-based SSH hardening with passwordless administration
- Zero-trust Tailscale overlay across mobile workstations, cloud VPS, and private on-premises infrastructure
- Pi-hole with Unbound for full recursive DNS instead of third-party resolvers
- Exit-node routing and IP forwarding for encrypted transit on untrusted networks
- Interface-aware UFW policy allowing trusted overlay traffic while restricting other ingress
Challenges
- Distributed infrastructure across private lab systems, cloud servers, and travel devices quickly becomes hard to secure. Without key-only administration, private DNS, and consistent remote...
- The design uses key-only SSH access with ED25519, disables password-based administration paths, avoids dependency on public DNS resolvers, and minimizes direct exposure. Private recursive...
- Stable private IPs, shared SSH configuration, tuned IP forwarding for overlay traffic, and lightweight host monitoring with btop make the environment easier to operate across locations....
Lessons Learned
- Removed password-based SSH administration from the environment
- Established private, location-independent access across on-premises, cloud, and roaming endpoints
- Moved DNS resolution into a privacy-preserving local recursive path under direct control
- Built a stronger security and operations foundation for future self-hosted and edge services
Future Improvements
- Update diagrams when the architecture changes materially.
- Keep documentation concise: align README, architecture decisions, and screenshots.
Tech Stack
Related Project
Follow the adjacent case study to see how this project connects with the rest of the work.
The Vienna Fortress
Built a hardened Proxmox and Docker operations platform that combines layered security, real-time observability, reverse proxying, and automated container lifecycle management.