Curriculum · grounded in your 2026-06-15 audit

Homelab Resilience & Security

From a working stack to a rock-solid one — and the vocabulary to run real infrastructure.

Done Lesson 1 · The 3-2-1 Rule RPO/RTO, backup vs redundancy, and your first working vzdump job. ✓ Nightly job created (all 13 guests) + test archive proven.
Done Lesson 2 · The Fire Drill Restore the Prowlarr archive to a throwaway guest, time it, tear it down. ✓ Restore drill run (vzrestore 114 OK) — RTO now measured.
Done Lesson 3 · Default-Deny at the Edge Host firewall now enabled/running (default-deny INPUT, management-set allows) and rpcbind removed. ✓ Findings B + E closed.
Start here Lesson 4 · Identity & Least Privilege Kill root password login, go key-only, add brute-force defence. (Findings C + G.)
Planned Lesson 5 · Blast Radius Why the privileged Transmission container is your biggest containment risk — and how to shrink it.
Planned Lesson 6 · Vulnerability Management Patch cadence, security-only auto-updates, reading CVEs. (174 pending, 42 security.)
Planned Lesson 7 · Observability & Capacity Single-disk risk, monitoring, and the capacity headroom problem on 4 cores.

Reference