https://jesusoseguera.dev/tags/infrastructure/Recent content in Infrastructure on Jesus OsegueraHugoen-usFri, 01 May 2026 00:00:00 +0000https://jesusoseguera.dev/projects/cowrie-honeypot/Fri, 01 May 2026 00:00:00 +0000https://jesusoseguera.dev/projects/cowrie-honeypot/Overview Deployed an SSH/Telnet honeypot (Cowrie) on a DigitalOcean droplet with Terraform and logged real attacker behavior for 5 days: 41,700 inbound connections, 15,400 login attempts, and 868 successful logins from 106 countries. Observed post-exploitation patterns feed the Falco runtime rules used on the EKS and homelab platforms, so those rules are grounded in traffic this honeypot actually saw. Technologies: Terraform, Docker, Cowrie, Promtail, Grafana Loki, Grafana Features GeoIP-enriched pipeline: Cowrie to Promtail to Loki to Grafana, with a live attack world-map dashboard Surfaced automated post-exploitation behavior, including OS fingerprinting (uname) and shell-history suppression Chose Grafana Loki over heavier aggregators that exceeded a 1GB RAM droplet budget (~$7-10/mo total) docs/ttp-to-runtime-rules.https://jesusoseguera.dev/projects/platform-engineering-homelab/Fri, 01 May 2026 00:00:00 +0000https://jesusoseguera.dev/projects/platform-engineering-homelab/Overview Reprovisioned a 10-VM Proxmox environment into a self-managed, highly available Kubernetes platform (3 control-plane + 3 worker nodes), driven from a single git clone through a GitLab CI pipeline. This is the layer managed Kubernetes hides: hypervisor, VM lifecycle, networking, and kubeadm bootstrap, with admission and runtime controls that cannot inherit a cloud provider baseline. Technologies: Terraform, Ansible, Proxmox VE, Kubernetes (kubeadm), ArgoCD, Cilium, HashiCorp Vault, Harbor, OPA Gatekeeper, Falco, Longhorn, kube-prometheus-stack, Loki, GitLab CI