Personal explorations · Security monitoring · rules · operations
Rules decide. The model annotates.
A security monitor for my homelab where code sets every severity and silence counts as a finding.
Personal project · security monitoring
Rules sort, then the hour waits
Events arrive from every source and pass through fixed rules. Nothing here is urgent, so three MEDIUM findings collect into a batch. By design, a local model may add a note to that batch to make it easier to read.
The note can explain a level. It can never change one.
Serious goes straight to a person
A rule marks one sign-in event HIGH. It leaves at once, by email, without waiting for a batch and without passing near the model. The HIGH lane is locked: no model sits anywhere on that path.
Alerts fail open. A duplicate HIGH email is a nuisance; a missing one is the failure this exists to prevent.
Blind is not zero
One read fails. Argus records that source as BLIND, never as zero findings. Zero would look like a quiet hour. BLIND says the honest thing: nobody looked.
A dashboard that turns a failed read into a reassuring 0 is worse than no dashboard.
Someone watches the watcher
The brain inside the cluster stops checking in. A small sentry running off site notices the silence and sends an email itself. A monitor that only ran at home would go quiet exactly when home is the problem.
While the brain is silent, every count is unknown, so the figure shows a question mark, not a zero.
A sketch of the principles behind Argus, my homelab’s security monitor. Every event shown is synthetic; real rules and sources are deliberately left out.
Signals everywhere, nobody watching
Security signal in my homelab existed in pieces: logs, metrics, the sign-in gate, cloud accounts. Nothing watched all of it, connected it, or told me when something mattered. Argus is the system I built to do that.
Its first phase has been live since September 2026. The rest arrives in phases, each one behind its own decision record.
Severity is code
Deterministic rules are the only place a severity is set. A HIGH finding goes straight to email. MEDIUM findings are batched. By design, a local model may annotate a batch to make it easier to read, but it can never raise or lower a level, and it never sits in the HIGH path.
The model helps me read. It does not decide what is urgent.
Blind is not zero
When a source cannot be read, Argus reports it as blind. A failed read never turns into a reassuring zero. “No failed sign-ins” and “could not read the sign-ins” lead to very different nights.
Who watches the watcher
A small sentry runs off-site. If the monitor at home goes quiet, the sentry notices and emails me directly. Silence is treated as a finding.
Alerts fail open, actions fail closed
An alert that might be a duplicate is still worth sending. An action that cannot be recorded is not worth taking. Containment is limited to a few reversible, rule-chosen actions, and each one is proven in shadow mode before it may act.
Rehearse before launch
A launch rehearsal found one path where an alert about the monitor itself could be lost. Launch waited until it was fixed.
A monitor earns trust by being honest about what it cannot see.
Let’s talk ↗