Building in the open.
Alex Trandafir — cybersecurity & identity engineering.
I'm a cybersecurity student working toward a career in Identity & Access Management. This is where I document what I build in my homelab — the wins, and the parts that broke. Real projects, honest write-ups, no buzzword bingo.
Latest posts
I ran a security audit on my own home network. It was humbling.
I do security as a discipline, so I assumed my own home network was in decent shape. Then I actually scanned it like an attacker would. A smart display was handing out root shells to anyone on the Wi-Fi, and my "isolated" IoT devices were not isolated at all.
Building Hermes: a self-hosted AI agent that runs my digital life
A personal AI agent living on my own VPS, reachable from my phone, that reads the live web, remembers context, survives provider outages, checks on my home network, and even edits its own code — built with security as the first constraint, not an afterthought.
Hybrid identity in a homelab: syncing on-prem AD to Okta and Entra
IAM job specs ask for hybrid identity and directory sync. Instead of just reading about it, I built the whole thing in a homelab — AD on-prem, synced up to both Entra ID and Okta, managed as code.
Do Wi-Fi deauth attacks still work? I tested it on my own network
Everyone demos the deauthentication attack on YouTube. I wanted to know whether it still works against a modern, correctly configured access point. So I set up a closed lab with my own kit and found out.
My ISP was quietly hijacking every DNS query in the house
My home DNS just stopped resolving. Chasing it down led somewhere I did not expect: my internet provider was intercepting DNS traffic transparently, so even queries I aimed at a public resolver were being answered by them. Here is how I found it and routed around it.
The Raspberry Pi doing ten jobs on my network
One small, cheap, low-power computer runs my DNS, blocks ads for the whole house, acts as a hardened jump host, bridges my network segments, and doubles as a wireless-audit node. Here is how I set it up and locked it down.
Running my own media server on hardware nobody wanted
How I built a self-hosted Jellyfin media library on a small NAS and got it onto cheap, old, half-locked living-room streaming boxes.
Every wireless attack I tested on one handheld RF multitool
Deauth detection, BLE spam, sub-GHz replay, 2.4 GHz spectrum analysis, packet capture, and jamming research — all on a single open-source ESP32 device, all in my own lab. A field guide to what actually worked, what did not, and what the law says.
A handheld RF research tool, and the day my Faraday box failed the test
I built up an open-source ESP32 multi-radio device for learning about wireless security — legally, in a shielded setup. The most valuable result was a negative one: my shielded enclosure gave zero attenuation, and rigorous testing is the only reason I know that.
Turning a keychain-sized gadget into a wireless security lab
The M5StickC Plus2 is a tiny ESP32 device you can clip to a keyring. Loaded with open-source security firmware it becomes a genuine, pocketable platform for learning Wi-Fi, RFID, sub-GHz and BadUSB techniques — used the way they are meant to be used: on your own kit and authorized engagements.
What a three-day RF survey of my own airspace turned up
A Wi-Fi 6E adapter that can listen and inject, pointed at my own network for a proper audit. It found an open access point broadcasting inside my house for 54 hours, an IoT gadget on the wrong network, and a silent WPA3-to-WPA2 downgrade — all things I would never have seen without looking.
Leaving Windows for Fedora, and hardening it
Why I wiped Windows for Fedora as my daily driver, and the security hardening I did afterward — the wins, and one lesson that stung.
I replaced Google Photos with a NAS I control
Family photos are the one thing you never want to lose and never want leaked. So I stopped renting cloud storage and built my own — TrueNAS, ZFS encryption, and Immich — then spent an evening debugging why my wife could not log in.
Building a verified Tails USB — an amnesic computer in your pocket
Tails is an operating system that runs entirely from a USB stick, routes everything through Tor, and forgets everything when you unplug it. I built one properly — including the verification step most people skip, and the reason it matters.
RAID is not a backup: the day I found my domain controller had none
I thought my homelab was backed up. Then I actually looked. The backup job was pointing at machines that no longer existed, the schedule never fired because the lab is usually powered off, and the one "second copy" was the same disk wearing a disguise. Here is how I rebuilt it properly.
The servers running in my house, and why I killed SMS 2FA
A tour of the services I self-host on one NAS — photos, passwords, media, and backups — how they stay reachable without being exposed to the internet, and why I ripped out text-message two-factor auth in favour of authenticator codes.
I host my own password manager now
Every password I own lived in someone else’s cloud. I moved them to a Bitwarden-compatible server running on my own NAS, reachable only over my private mesh — never exposed to the internet — and kept the polished apps I already liked.
How I reach every device I own without opening a single port
Port forwarding is how home labs get breached. I connect my laptop, servers, NAS, and phone with a mesh VPN instead — every device reachable from anywhere, nothing exposed to the internet. Here is the setup and the one mistake that quietly undermines it.
Setting up a UniFi network — and driving it from its own API
How I built and run my home network on UniFi kit: adopting the gateway, switch and access point into one controller, carving it into VLAN zones with default-deny firewalling, and then automating the whole thing through the controller API instead of clicking around a dashboard.
Breaking into a deliberately-vulnerable Android app, exercise by exercise
I set up a real mobile pentest lab on my own phone against AndroGoat, an intentionally-insecure training app, and worked through the OWASP mobile classics: intercepting HTTPS, dumping secrets from exported components, and — the big one — running Frida on a phone I could not root.
Post-quantum SSH in my home lab
Why I turned on a hybrid post-quantum key exchange for SSH between my lab machines, what "harvest now, decrypt later" actually means, and the one config file that did it.
A little flight radar for my son, built on a $5 clock
My son wanted the tiny desk clock to show planes flying overhead like a radar screen. So I wrote custom firmware for its ESP8266 that pulls live flight data and draws a real scope. The bugs along the way were a great tour of embedded graphics.
I built the identity infrastructure a real company runs — in my homelab
Standing up Active Directory, Keycloak, Authentik and OpenLDAP on my own hypervisor, then automating the joiner/mover/leaver lifecycle the way an IAM team actually does it.
Building my home lab network from scratch
How I designed and wired a segmented home network with UniFi gear, a Raspberry Pi service node, Cat8 cabling, VLANs, and a real security posture — and the two problems that nearly broke it.
I built a camera that looks at things and tells you what it sees
A tiny ESP32-S3 with a camera and a speaker, wired up to a vision model, that you point at an object and it describes it out loud. Getting it to actually talk was the hard part — the memory management on a chip this small is unforgiving.
A round smartwatch-style sensor dashboard on an ESP32
A 1.28-inch round touchscreen, a 6-axis motion sensor, and an ESP32 — turned into a live gauge that reads real movement and temperature and renders it without a flicker. Small screen, surprisingly deep lessons.
Playing IoT test engineer: evaluating a smart alarm through three iterations
A university brief cast me as the test engineer for an IoT security alarm. Instead of just building one, I designed, built, and evaluated three progressively smarter versions — and learned that testing an IoT device is a discipline of its own.
The sensor wasn't dead: debugging an ultrasonic alarm on an Arduino
A university electronics lab where I built a distance-based proximity alarm on an Arduino Uno, and spent most of my time learning that a "dead" HC-SR04 was really just wired backwards.
Seeing movement through walls with a $10 Wi-Fi chip
Wi-Fi signals bounce off and pass through everything in a room, including people. With an ESP32 and some open-source software, you can read those distortions and sense human presence and pose — no camera involved. I built a working node and dashboard.
Turning a stock Samsung into a pocket Linux hacking lab
No custom ROM, no tripped warranty fuse — just a locked Android phone running a full Linux userland, a suite of security tools, and even an AI coding agent, all in my pocket. Here is what is actually possible without rooting, and where the hard limits are.
The smart bin: a touchless lid, and the small bugs that teach you electronics
A university IoT project — an Arduino bin that opens its lid when you wave your hand near it. Simple on paper, but the servo browning out, the lid auto-cycling, and a flaky sensor each taught a real lesson about building things that touch the physical world.