This article will go over how to configure an automated home lab using Proxmox, Packer, Ansible, Terraform and Vault for secrets. This could be used for malware analysis, a SOC lab, performing penetration tests against Windows AD environments and Linux servers, performing penetration tests against deliberately vulnerable web applications, setting up AD environments, testing operating systems, and much more.

- [[#Introduction to the home lab project]]

- [[#Configuring PfSense router with two interfaces (isolation & infrastructure)]]

- [[#Using Packer to automate template creation]]

- [[#Configuring VNC connection from the host to the jump-box & configuring RDP to connect from the jump-box to all other internal machines]]

- [[#Configuring Ansible for post-provisioning]]

- [[#Setting up Wazuh for security monitoring & SIEM server]]

- [[#Configuring a DHCP server for the isolation network]]

In order to get started, we need to set up a PfSense router, a Windows Server, and an Ubuntu desktop for the jump-box. If you already have a Packer template for the Ubuntu desktop then you can run that, otherwise it is just as easy to manually install an Ubuntu desktop to run Packer from. 

The jump-box will be used to run all of the Ansible, Terraform, and Packer scripts from. It will also be used to connect to the other machines in our cloud through RDP. 

## Configuring PfSense router with two interfaces (isolation & internet)

## Using Packer to automate template creation

Packer is going to be automating the provisioning of .iso images and creating a template after the provisioning is finished. The reason for this is to ensure that the OS is functioning correctly, the created template verifies that every feature that you have defined in the .pkr.hcl file is working on the newly created OS. Using Packer will save a lot of time if you ever need to quickly create a template in Proxmox from an .iso, you can edit your machines hardware from the .pkr.hcl file rather than doing so manually.

The jump-box will be responsible for running Packer, to [install Packer](https://developer.hashicorp.com/packer/tutorials/docker-get-started/get-started-install-cli) on the jump-box run these commands:

curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add -

sudo apt-add-repository "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main"

sudo apt-get update && sudo apt-get install packer

## Configuring VNC connection from the host to the jump-box & configuring RDP to connect from the jump-box to all other internal machines

I will be using TigerVNC to connect to the jump-box through VNC. To install TigerVNC go to the GitHub and download the latest source code `https://github.com/TigerVNC/tigervnc/releases`. 

Now run these commands to extract and run:

tar -xzvf "~/Downloads/Source code.tar.gz"

Inside the Proxmox shell, edit the configuration file containing the VM ID of the jump-box you are trying to connect to through VNC `nano /etc/pve/qemu-server/111.conf`. Now add this line to the top of the file, and replace the `PORT_NUMBER` with any port number you wish to connect through:

Then restart the `nfs-kernel-server` to save the changes, and also restart the jump-box itself:

Now go to TigerVNC from the host machine and connect through the port number on the same network that Proxmox is currently running. `192.168.1.169:<PORT_NUMBER>`. You should now have a remote VNC connection from your host to your jump-box and you can now access the Proxmox web GUI through your jump-box and RDP to any other machine from there as well.

From here, I will be using Remmina for an RDP connection to every other machine from the jump-box.

## Configuring Ansible for post-provisioning

Ansible will be used for post-provisioning groups of machines from the isolation network. This will be run from the jump-box, Install Ansible on Ubuntu with the following:

sudo apt install software-properties-common

sudo add-apt-repository --yes --update ppa:ansible/ansible

Now make sure the host you are running Ansible from, is able to ping a host on the isolation network. 

Edit the `/etc/ansible/hosts` file to create a group of hosts for Ansible to control. I have added a Windows Server 2019 host that I configured with a NIC on the isolation network.

Now navigate to `home-lab/Ansible` and run the command `ansible-playbook domain_controllers` and this will set up a DC on the Windows Server at `10.1.99.3` through Ansible.

I also want to set up some users, GPOs, and another admin, there is a script for this, so I will run `ansible-playbook domain_users.yml`. There are many more Ansible scripts you can run to automate the process of setting up environments, it is up to you what to run next. 

## Setting up Wazuh for security monitoring & SIEM server

I will be running Wazuh from an Ubuntu 22.04 machine, I have configured the netplan as such to assign a static address, both on the isolation and infrastructure network. This is what the `/etc/netplan/00-installer-config.yaml` file should look like:

Proxmox home lab

Webfirst is a web application development business that creates modern web applications with React and Next.js, as well as custom API integrations and applications for your business needs. I have built this website with Next.js using the new app router and Strapi headless CMS.

I have been working on this for about a year now, and this is the third iteration of the website, I finally decided to build it with Next.js and Strapi, because it is the easiest to setup for simple blogging + eCommerce applications and Next.js will improve SEO to get my website higher in Google search results. Webfirst does not just stop at Strapi and Next.js though, I can also implement custom API integrations with Node.js, and set up any database you need through either Amazon RDS, or a Railway instance, I prefer to set it up on Railway initially, until a website grows in traffic, because Amazon RDS will still charge, even if there are minuscule amounts of read or writes to the database.

![image](https://beren-obsidian-images.imgix.net/e6f02fc09e425ec8ca404226f100adfe.png)

Second iteration of webfirst.co.nz (https://web.archive.org/web/20220122011954/https://webfirst.co.nz/):

![image](https://beren-obsidian-images.imgix.net/d98922da690ac87b8c36aaf42548afaa.png)

Webfirst will make sure that your company ranks high in the Google search results, I haven't made the purchase yet, but I have tried out Semrush and Ahrefs for SEO research, I prefer Ahrefs, because it is a bit easier to use than Semrush and cheaper. I would also setup a Google business account, so that you will be seen when people are specifcally looking for businesses. 

Last iteration and live version of webfirst.co.nz:

![image](https://beren-obsidian-images.imgix.net/3307e5c33fa916533380f8efa2f7f971.png)

Small web development business I have tried to start. Built with Next.js, I have one client (firesidecandles.co.nz)

webfirst.co.nz - Web Development NZ

This is a crypto trading application made with Node.js, React, Redux, and MongoDB

Crypto trading application

firesidecandles.co.nz is an e-commerce website built with Next.js, Redux and Strapi as the CMS. 

Proxmox home lab

webfirst.co.nz - Web Development NZ

Crypto trading application

firesidecandles.co.nz - ecommerce