I Built the Cloud Audit SIEM I Kept Wishing Existed
CAIB turns AWS, GCP, Azure, and Cloudflare audit logs into one self-hosted, testable detection system—and records the trade-offs instead of hiding them.
Read the field noteSystems nominal. Decisions questionable.
Production habits.
Home-lab consequences.
Architecture notes, failure reports, security trade-offs, and exact fixes from a home rack operated by a SecOps engineer who should know better.
- Approach
- Evidence first
- Stack
- Linux · Docker · ZFS
- Bias
- Simple > clever
01
View all writing →Latest field notes
The Website Was New. The CSS Was Four Months Old.
A production site passed its build, origin, route, header, and preview checks—then looked broken on mobile because immutable CDN caching preserved the previous stylesheet.
Read the field noteWhat Actually Runs in the Home Lab
A curated inventory of the services behind 76 running containers—what each group does, why it exists, and which pieces are temporary.
Read the field noteWhy the Lab Is Boring on Purpose
The design choices behind a two-host Docker home lab: leaving Kubernetes, centralizing ingress, separating state, treating sockets as root, and applying before committing.
Read the field note02
Explore the architecture →Inside the lab
Public-safe system mapTwo Docker hosts.
Two Docker hosts.
Several deliberate failure boundaries.
The compute, DNS, ingress, database, storage, monitoring, and backup design—without publishing addresses or turning the site into reconnaissance.
See how it fits together- 76
- running containers
- 2
- Docker hosts
- 3
- Patroni nodes
- 2
- recursive DNS paths
03
Operating principles
Healthy is not working
A green container is an alibi, not evidence. Verify application behavior and committed data.
Root access has many spellings
Docker sockets, automation tokens, and friendly dashboards all deserve the same suspicion.
Write down the regret
The useful lesson is usually the decision that looked reasonable five minutes before the incident.