Workstreams

Phases

Phases scoped to Raven Praxis Infrastructure.

Phase A · Planning

Planning & Prerequisites

Confirm hardware, IP plan, licenses, and operator prerequisites before touching production.

In Progress
Progress50% · 2/4 tasks
Validation criteria
Inventory complete, 10.100.0.0/16 plan approved, hardware racked and powered.
Phase A2 · Network· depends on A

Switch Reconfigure — VLAN Plan

Reconfigure managed switch for V2/V3 VLAN plan and tagged trunk to OPNsense.

Not Started
Progress0% · 0/2 tasks
Validation criteria
All required VLANs present, trunk carries tagged frames, no untagged leakage.
Phase B · Network· depends on A2

OPNsense — Re-IP & VLAN Expansion

Deploy OPNsense 24.x, migrate to 10.100.0.0/16, create all VLAN interfaces + firewall rules.

Not Started
Progress0% · 0/4 tasks
Validation criteria
Default-deny inter-VLAN verified; home LAN unreachable from any student path.
Phase C · Virtualization· depends on B

Proxmox — Host Re-IP & SDN

Re-IP Proxmox host, configure SDN zones and VNets to align with new VLAN plan.

Not Started
Progress0% · 0/2 tasks
Validation criteria
Host reachable on mgmt VLAN; SDN VNets map cleanly to OPNsense VLANs.
Phase D · Security· depends on C

Bastion Build

Hardened Linux bastion with FIDO2/YubiKey sudo + sk-ed25519 keys.

Not Started
Progress0% · 0/3 tasks
Validation criteria
SSH requires FIDO2; PAM-U2F enforces sudo; break-glass documented and sealed.
Phase E · Shared Services· depends on C

AdGuard & Authentik — Core Services

Deploy AdGuard Home (DNS + blocklists) and Authentik (SSO/IdP).

Not Started
Progress0% · 0/2 tasks
Validation criteria
DNS queries logged; Authentik issues tokens; SSO applied to at least one app.
Phase F · Security· depends on B, E

Wazuh, Suricata IDS/IPS & Egress Filtering

Stand up Wazuh manager + agents; enable Suricata on OPNsense; configure egress aliases.

Not Started
Progress0% · 0/3 tasks
Validation criteria
OPNsense logs shipped to Wazuh; Suricata alerting; egress filter blocks disallowed CDNs.
Phase G · Backup· depends on C

PBS — Proxmox Backup Server

Deploy Shuttle PBS appliance, encrypted datastore, verify + prune schedule, offsite sync.

Not Started
Progress0% · 0/3 tasks
Validation criteria
Full backup + restore of a test VM within SLO; verify job green; offsite sync active.
Phase H · Remote Access· depends on D

Twingate — Remote Access (ZTNA)

Outbound-initiated ZTNA for operator remote administration. No inbound exposure.

Not Started
Progress0% · 0/2 tasks
Validation criteria
Operator can reach bastion from laptop; no listening ports on home WAN.
Phase I · Student Lab· depends on E, F

Guacamole — Student & Ops Access

Guacamole (students, browser-only) + Guacamole-ops (operator). SSO via Authentik.

Not Started
Progress0% · 0/2 tasks
Validation criteria
Student session opens pod VM via browser; no direct IP exposure; session recording verified.
Phase J · LMS· depends on E

LMS Stack — Moodle, Zammad, BookStack, Grafana

Deploy Moodle (LMS), Zammad (ticketing), BookStack (docs), Grafana (dashboards).

Not Started
Progress0% · 0/4 tasks
Validation criteria
Cohort enrolls in Moodle; ticket created in Zammad; runbook published in BookStack; Grafana panels live.
Phase K · Tooling· depends on I, J

Student-Visible Tooling Catalog (27 tools)

Provision Persistent/Trial/Demo tools per cohort track (SOC, Blue, Red).

Not Started
Progress0% · 0/3 tasks
Validation criteria
Track-specific tool tiers reachable from student pod; skipped tools documented with rationale.
Phase L · AI· depends on K

AI Workbench

Local LLM for ops; contained AI demos for students; curated AI-API egress.

Not Started
Progress0% · 0/1 tasks
Validation criteria
No model API keys in student-accessible VM; ops LLM answers a runbook query.
Phase M · Student Lab· depends on I

Pod Orchestration

Templated multi-VM pods, versioned, one-command teardown.

Not Started
Progress0% · 0/1 tasks
Validation criteria
Clone → assign → teardown of a 3–4 VM pod completes without manual steps.
Phase N · Validation· depends on K, L, M

End-to-End Validation & Red-Team Self-Test

Adversarial verification: home LAN unreachable, no inbound exposure, egress filter honest.

Not Started
Progress0% · 0/2 tasks
Validation criteria
Documented pass on every 'must not' in §1.2; red-team report signed off.
Phase O · Operations· depends on N

Documentation & Operational Readiness

Runbooks, change windows, DR drill schedule. No tribal knowledge.

Not Started
Progress0% · 0/2 tasks
Validation criteria
Runbooks in BookStack; DR restore rehearsed; on-call/rotation documented.