This page is fed live from the Nebula, my homelab. An exporter on the lab side pushes an
allow-listed, sanitized snapshot to Cloudflare every five minutes. No hostnames, IPs or topology ever leave the house.
01 Lab
24/7 core up—
Core 30-day uptime—
Always-on core (Linux servers + pfSense firewall), monitored with Prometheus and node_exporter. On-demand machines are excluded by design.
02 Power
Drawing now—
Last 24h—
Metered with Shelly smart plugs.
03 Security
SIEM—
Agents reporting—
CISA KEV tracked—
KEV added 7d—
Wazuh SIEM with alert volume by severity, checked against CISA's Known Exploited Vulnerabilities catalog.
04 Network
WAN latency—
DNS queries 24h—
Blocked at DNS—
ResolverUnbound · DoT
pfSense firewall, segmented subnets, recursive Pi-hole/Unbound forwarding to Cloudflare over TLS.
How this page is built
Collect. Prometheus, Wazuh, Pi-hole and the CISA KEV feed are queried on the lab side.
Sanitize. A fixed schema is filled in, then a validator scans the result and refuses to publish anything that looks like an IP address, hostname or unexpected field. It fails closed.
Publish. The snapshot goes to Cloudflare KV with a token that can write that one store and nothing else.
Serve. A Cloudflare Worker serves this page with a strict CSP, HSTS and no third-party requests. If the lab goes dark, the page stays up and marks the data as stale instead of faking green.
Domain hardened with DNSSEC, CAA, null MX, SPF and DMARC p=reject.