The Vienna Fortress
Built a hardened Proxmox and Docker operations platform that combines layered security, real-time observability, reverse proxying, and automated container lifecycle management.
Core stack
Case Snapshot
Role
Infrastructure ownership: architecture, hardening, access model, monitoring, recovery path, and operating notes.
Scope
I built the stack on Proxmox 9.1 and Debian 13, then deployed Dockerized services for reverse proxying, DNS filtering, security detection, monitoring, status checks, log viewing, update automation, internal service discovery,...
Constraints
Security is layered instead of concentrated in one component: Pi-hole handles DNS filtering, CrowdSec provides detection and community threat intelligence, persistent host and Docker rules control ingress, Nginx Proxy Manager...
Result
Turned a generic private lab into a hardened internal platform with clearer operational boundaries
Architecture
Node
Admins and users consume services through Homepage and reverse-proxied entry points, while the dashboard layer surfaces service and virtualization state in one place.
Edge
A Proxmox 9.1 host runs a Debian 13 VM and Docker services including Nginx Proxy Manager, Pi-hole, CrowdSec, Netdata, Uptime Kuma, Dozzle, Watchtower, and Homepage.
Cloud
The core platform is local-first; public exposure is added through a separate VPS and Tailscale ingress path for selected services without opening local router ports.
Node
Admins and users consume services through Homepage and reverse-proxied entry points, while the dashboard layer surfaces service and virtualization state in one place.
Edge
A Proxmox 9.1 host runs a Debian 13 VM and Docker services including Nginx Proxy Manager, Pi-hole, CrowdSec, Netdata, Uptime Kuma, Dozzle, Watchtower, and Homepage.
Cloud
The core platform is local-first; public exposure is added through a separate VPS and Tailscale ingress path for selected services without opening local router ports.
Technical Diagrams
Architecture diagrams show the system boundary, runtime flow, and operational decisions in a compact review format.
Private Infrastructure and Operations Platform
The Vienna Fortress architecture shows the split between public admin/user entry, the public VPS edge, the private Tailscale transport, and the Proxmox/Debian Docker runtime where web, analytics, security, observability, operations, and backup services are separated.
What the diagram shows
- Public exposure is concentrated at the VPS edge instead of the home router
- Runtime traffic and operational traffic are shown as separate flows
- The private runtime groups services by responsibility: web, analytics, security, observability, operations, and backups
Technical Decisions
- Layered security with Pi-hole DNS filtering, persistent ingress rules, and CrowdSec detection
- Reverse-proxied service access through Nginx Proxy Manager
- Private runtime foundation for Elkaza.at static hosting and first-party Plausible analytics
- Netdata, Uptime Kuma, and Dozzle for metrics, uptime checks, and live container logs
- Stabilized a React-based Proxmox API integration for dashboard visibility
Challenges
- Deploying individual tools is easy; building a secure and operable platform is harder. The environment needed layered protection, live health visibility, reliable log access, and a clean...
- Security is layered instead of concentrated in one component: Pi-hole handles DNS filtering, CrowdSec provides detection and community threat intelligence, persistent host and Docker rules...
- Netdata, Uptime Kuma, and Dozzle provide metrics, health checks, and log visibility, while Watchtower automates the container update lifecycle and reduces manual drift across long-running...
Lessons Learned
- Turned a generic private lab into a hardened internal platform with clearer operational boundaries
- Added real-time visibility across service health, metrics, and logs
- Resolved a cross-layer integration mismatch between frontend code and the Proxmox API
- Reduced routine maintenance effort through automated container updates
Future Improvements
- Update diagrams when the architecture changes materially.
- Keep documentation concise: align README, architecture decisions, and screenshots.
Tech Stack
Related Project
Follow the adjacent case study to see how this project connects with the rest of the work.
Hardened Hybrid-Cloud Private Network
Phase 1 completed: designed a zero-trust private network across on-premises, cloud, and roaming endpoints with SSH hardening, DNS privacy, and secure remote transit.