I. Mission Statement & Laboratory Identity
The Samael.lu infrastructure portal serves as a dedicated, non-commercial technical workspace. This domain is architected to facilitate advanced research into high-availability networking and container orchestration within the unique digital landscape of the Grand Duchy of Luxembourg. Our lab prioritizes the exploration of Nginx configuration patterns, Docker lifecycle management, and the implementation of enterprise-grade security headers on high-performance, specialized hardware.
Maintaining a "Clean Internet" footprint is our primary goal. By self-hosting these services on a Visual Online (VO.lu) Regio 1000 fiber line, we ensure that our research into peering efficiency and latency remains locally anchored within the LU-CIX ecosystem. This site serves as a persistent static landing node while background services undergo iterative deployment, stress testing, and performance optimization for synchronous 1Gbps traffic.
II. Detailed Technical Architecture & Logic
The underlying architecture of the Samael.lu node is built upon a hybrid Linux environment. At the core, we utilize a specialized storage architecture running a modified Linux kernel, which hosts our Docker Community Edition engine. This allows for total resource isolation and the ability to spin up microservices in a "sandboxed" environment that prevents interference with the host operating system.
Edge Routing & Proxying
We leverage Nginx as our primary ingress controller. This ensures all incoming traffic is validated against custom security rules. This layer handles SSL termination and prevents unauthorized access to backend microservices.
Network Segmentation
Our network is logically divided using Virtual LANs (VLANs) and internal virtual switches. This provides a "Zero Trust" model where the web-facing node is isolated from the management plane, mitigating the risk of lateral movement.
Encryption & SSL/TLS
Every resource served under the Samael.lu domain is protected by TLS 1.3. We utilize the ACME protocol for automated certificate issuance via Let's Encrypt, ensuring a 100% encrypted traffic stream with 4096-bit RSA keys.
III. Laboratory Best Practices & Security Standards
To ensure this lab operates at the highest standard of internet safety, we adhere to the following security principles:
- Proactive Hardening: We utilize specialized security headers (HSTS, Content Security Policy, X-Frame-Options) to protect against common web vulnerabilities like Cross-Site Scripting (XSS) and Clickjacking.
- Resource Isolation: Each laboratory component runs in an unprivileged container, ensuring that even if one service is compromised, the rest of the infrastructure remains secure.
- Minimalist Footprint: We do not run unnecessary services. This landing page is static, meaning there is no backend database (like MySQL or PostgreSQL) exposed to the public internet, significantly reducing the attack surface.
- Encryption Standards: We have deprecated all insecure protocols (SSLv2, SSLv3, TLS 1.0, and TLS 1.1) to ensure only modern, secure clients can establish a connection with the Samael.lu node.
IV. Detailed Infrastructure Component Log
The Samael.lu lab is composed of several key modules that work in synergy. Below is a detailed breakdown of the components currently under observation:
| Component |
Role |
Documentation |
| Reverse Proxy |
Ingress Traffic Management |
Nginx stable branch optimized for low-latency header processing. |
| Docker Engine |
Container Runtime |
Community Edition (CE) managed via YAML orchestration files. |
| Virtual Switch |
L2/L3 Internal Routing |
Virtual interfaces optimized for the Visual Online Regio 1000 backbone. |
V. Project Roadmap: 2026-2027
The evolution of this lab is mapped out across several key technical milestones. Our current focus is on Layer 7 Application Security, but our roadmap includes the following expansions:
- Phase 1: Implementation of HSTS Preloading and custom security header auditing (Status: Complete).
- Phase 2: Integration of Prometheus and Grafana for real-time monitoring of Regio 1000 bandwidth utilization and packet loss analysis.
- Phase 3: Testing of Geo-fencing firewall rules to limit administrative access to specific Luxembourgish and European IP ranges.
- Phase 4: Deployment of a decentralized logging system for forensic analysis of automated scanning attempts and zero-day detection.
VI. Extended Networking Glossary
- Autonomous System (AS)
- A collection of connected Internet Protocol (IP) routing prefixes under the control of a single administrative entity. Visual Online operates under AS5578.
- BGP Peering
- The process by which separate Internet networks connect and exchange traffic. Samael.lu benefits from the robust peering of Visual Online at LU-CIX.
- Docker Containerization
- A standard unit of software that packages code and all its dependencies so the application runs reliably across different computing environments.
- HSTS (HTTP Strict Transport Security)
- A web security policy mechanism that protects websites against man-in-the-middle attacks such as protocol downgrade attacks.
- LU-CIX
- The Luxembourg Commercial Internet Exchange, a key physical infrastructure point where national and international internet service providers interconnect.
- Nginx Ingress
- A high-performance web server that acts as a load balancer and reverse proxy, crucial for managing traffic in modern microservice architectures.
- Regio 1000
- A fiber-to-the-home (FTTH) product tier in Luxembourg offering 1000 Mbps synchronous throughput, typically delivered over a high-capacity backbone.
- Virtual Switch (vSwitch)
- A software program that allows virtual machines and containers to communicate, used within our environment to route traffic securely.
VII. Administrative Terminal Logs
[SYS] NODE_ID: EDGE-01-LUX INITIALIZED
[NET] ISP: VISUAL ONLINE S.A. (AS5578)
[NET] BACKBONE: REGIO 1000 FIBER ACTIVE
[DOCKER] CONTAINER_HEALTH: 100% (UPTIME: 336h)
[CERT] SSL_STATUS: VALID (ENFORCING TLS 1.3 / HSTS)
[AUDIT] POLICY: GDPR COMPLIANT / NO USER DATA STORED
[STATUS] AWAITING NEXT ADMINISTRATIVE COMMAND...