HOME LAB
Pixel City Infrastructure
The physical backbone of Pixel City — a growing private lab for self-hosted services, security research, radio observation, creative tools, and virtualisation.
Innovation Labs
Pixel City Infrastructure
The physical backbone of Pixel City — a growing private lab for self-hosted services, security research, radio observation, creative tools, and virtualisation.
Overview
The lab started as a single machine running a few Docker containers and grew into a multi-machine platform with dedicated roles — a Kali box for security tooling and Docker services, a Proxmox node for virtualisation, a managed switch for network control, and more hardware in the pipeline.
Everything is built around controlled access and deliberate isolation. Vulnerable training systems stay separated from everyday devices, while dedicated WiFi, Bluetooth and radio hardware turn the lab into a practical wireless research platform.
It's not finished — it never will be. That's the point.
Hardware
Physical Machines
Specialist Hardware
Running Services
The lab runs a mixed collection of private Docker services, monitoring tools, radio pipelines and creative applications. Most stay local-only; this public list deliberately leaves out addresses, ports and deployment details.
Infrastructure
| Service | What it does | Status |
|---|---|---|
| Portainer CE | Docker management UI — all containers, stacks, volumes | Live |
| Nginx Proxy Manager | Reverse proxy — friendly hostnames + HTTPS | Live |
| Uptime Kuma | Service monitoring — uptime checks, alerts | Live |
| Homarr | Home lab dashboard — tiles linking to all services | Live |
| Gitea | Self-hosted Git server — private repos | Live |
| Dashdot | Live server stats — CPU, RAM, disk, network | Live |
| Prometheus + Grafana | Metrics collection, dashboards and long-term observability | Live |
| InfluxDB | Historical time-series storage for radio and aircraft observations | Live |
Security & Monitoring
| Service | What it does | Status |
|---|---|---|
| Kismet | On-demand wireless monitoring and device research | Standby |
| Ntopng | Live LAN traffic analysis — flows, bandwidth, protocols | Live |
| KaliDash | Remote control surface for authorised network, radio and security-lab workflows | Live |
| OWASP Juice Shop | Deliberately vulnerable web app — web security practice | Standby |
| DVWA | Damn Vulnerable Web App — SQL injection, XSS practice | Standby |
| Wazuh SIEM | Centralised security logs from all machines + alerting | Planned |
| T-Pot Honeypot | Decoy system — logs attack attempts in real time | Planned |
Radio & Observation
| System | What it does | Status |
|---|---|---|
| Pixel Radar | Custom aircraft radar with a synchronised aircraft workspace, trails, coverage, insights, alerts and receiver health | Live |
| ADS-B Receiver Stack | RSPdx receiver, Beast feed, decoding, live mapping and historical flight logging | Live |
| Radio Manager | Safely hands the shared receiver between aircraft and satellite workloads | Live |
| Weather Satellite Lab | Schedules passes, records reception attempts and returns the receiver to ADS-B afterwards | Testing |
| OpenWebRX | Browser-based wideband radio receiver for live signal exploration | On demand |
| RTL-TRNG | Turns radio noise into a physical entropy and passphrase experiment | Live |
| SÉANCE | Two-radio Bluetooth observatory for capture, presence, fingerprinting and controlled research | Live |
Self-Hosting
| Service | What it does | Status |
|---|---|---|
| Password Vault | Private self-hosted credential manager | Live |
| Whoogle | Private self-hosted Google search — no tracking | Live |
| Kavita | eBook / manga / comic / PDF reader and library | Live |
| Mealie | Recipe manager — import, organise, and plan meals | Live |
| AdventureLog | Travel tracker and trip planner | Live |
| BentoPDF | Privacy-first PDF toolkit — merge, split, compress, convert | Live |
| n8n | Workflow automation platform | Live |
| Nextcloud | Private file sync and personal cloud | Live |
| FreshRSS | Self-hosted RSS reading and filtering | Live |
| Memos | Lightweight private notes and quick capture | Live |
| The Depot | Local software and archive library | Live |
| The Bazaar | Personal marketplace watchlist and deal tracker | Live |
| Mind Dump Terminal | Private guided brain-dump and organisation tool | Live |
| Fandom Card Studio | Browser-based collectible card designer and renderer | Live |
| Crafty Controller | Minecraft server manager — Java Edition 1.21.4 vanilla | Live |
| Jellyfin | Media server — stream Sonarr/Radarr content | Planned |
| Immich | Google Photos replacement — auto-backup from phone | Planned |
| Paperless-ngx | Document scanning + OCR — searchable archive | Planned |
| Pi-hole | DNS ad-blocking for the whole network | Planned |
Virtualisation — Proxmox
The Proxmox node runs an isolated lab network on a separate internal bridge with no external access — a clean environment for attack and defence practice. Lab VMs can't reach the real LAN; they only talk to each other.
A Windows 10 VM on the main bridge handles general Windows testing with full internet access. The isolated lab currently holds a Metasploitable 2 target and a dedicated Kali attack VM.
The next major expansion is a full Active Directory lab — Windows Server domain controller, workstations with deliberate misconfigurations, and a Wazuh SIEM to see every attack from the blue side in real time.
Proxmox virtualisation
│
├── General test systems
│ Controlled network access
│
└── Isolated security range
Attacker workstation
Vulnerable targets
No route to home devices
Next
Active Directory practice range
Defensive monitoring
Repeatable attack/detection labs
Network Design
The network design is evolving toward stronger separation between administration, private services, research systems, everyday devices and deliberately vulnerable training targets. Exact addressing and firewall rules are intentionally not published.
Planned VLAN Layout
Network Design — Public View
Roadmap