Enterprise Home Lab

EXECUTIVE SUMMARY — Project RedForge is developing an enterprise home lab as a controlled environment for infrastructure administration, security engineering, monitoring, and incident-analysis practice. The current deliverable is the approved logical design and documentation system. It is not a representation of a completed production environment.

BUSINESS GOALS — The lab is intended to provide repeatable engineering scenarios, reduce risk through isolated testing, demonstrate traceable technical decision-making, and create a durable platform for future Active Directory, Splunk, vulnerability-management, automation, and threat-hunting projects.

ENVIRONMENT OVERVIEW — The target state uses a virtualized compute layer behind a policy-enforcing firewall. Dedicated VLANs separate management, servers, clients, security testing, and DMZ workloads. Identity, DNS, DHCP, certificate services, monitoring, and backup are introduced through phased change records.

OPERATING MODEL — Every capability moves through Planned, In Progress, Implemented, and Validated states. Implementation claims require configuration records and sanitized evidence; performance or reliability claims require recorded measurements. No such metrics are asserted in this report.

INFRASTRUCTURE COMPONENTS — PLANNED. A dedicated firewall, a Proxmox virtualization host, Windows Server and Linux guests, Windows 11 and Kali Linux endpoints, and a Splunk-based monitoring tier form the documented target platform. Hardware models and capacity values remain intentionally unspecified until procurement and validation are complete.

SERVER INVENTORY — PLANNED. DC01 is reserved for Active Directory Domain Services and DNS, MGMT01 for DHCP and administration, SIEM01 for Splunk, LNX01 for Linux services, and PKI01 for future certificate services. These names are design identifiers only and are not evidence of deployed systems.

SERVICES INVENTORY — PLANNED. Active Directory Domain Services, DNS, DHCP, centralized logging, SIEM analysis, backup, and administrative access are planned. Certificate services and hybrid-cloud connectivity remain future capabilities.

SECURITY STACK — IN PROGRESS. The design combines firewall policy enforcement, VLAN isolation, least-privilege administration, centralized identity, endpoint logging, Splunk analysis, backup controls, and documented trust boundaries. Product configuration and control validation remain pending.

MONITORING STACK — PLANNED. Windows Event Logs, Sysmon telemetry, Linux system logs, and firewall events will feed a centralized Splunk pipeline. No ingestion rate, retention, detection, or coverage metrics are asserted.

IDENTITY SERVICES — PLANNED. A single-forest Active Directory design will provide centralized authentication and policy management. Administrative tiers, service accounts, Group Policy, and recovery procedures require implementation and testing.

DNS — PLANNED. Active Directory-integrated DNS is the target for internal name resolution. Forwarding, scavenging, logging, and recovery settings remain to be validated.

DHCP — PLANNED. Centralized DHCP scopes will align with approved VLANs and reserve infrastructure addresses. Scope options, exclusions, failover, and lease policy remain undecided.

CERTIFICATE SERVICES — FUTURE. An offline-root and issuing-CA pattern is under consideration. No certificate authority or enterprise PKI is represented as deployed.

LOGGING PIPELINE — PLANNED. Endpoint and infrastructure telemetry will traverse controlled network paths to SIEM01, where parsing, retention, alerting, and access controls will be tested before operational use.

BACKUP AND DISASTER RECOVERY — PLANNED. The target strategy includes versioned configuration exports, scheduled virtual-machine backups, protected copies outside the primary datastore, documented recovery dependencies, and periodic restoration exercises. Recovery time and recovery point objectives remain undefined until workload criticality and measured restore performance are available.

REFERENCES — VERIFIED SOURCES. The report links to Microsoft, Netgate, Proxmox, and Splunk documentation used to frame the design. References inform the architecture; they do not constitute implementation evidence.