Alex Trandafir — building in the open. IAM, security engineering, homelab, and the road from HND to a career in identity.https://chapter87.net/https://chapter87.net/blog/auditing-my-own-home-network/https://chapter87.net/blog/auditing-my-own-home-network/I do security as a discipline, so I assumed my own home network was in decent shape. Then I actually scanned it like an attacker would. A smart display was handing out root shells to anyone on the Wi-Fi, and my "isolated" IoT devices were not isolated at all.Sun, 16 Aug 2026 00:00:00 GMThttps://chapter87.net/blog/building-a-verified-tails-usb/https://chapter87.net/blog/building-a-verified-tails-usb/Tails is an operating system that runs entirely from a USB stick, routes everything through Tor, and forgets everything when you unplug it. I built one properly — including the verification step most people skip, and the reason it matters.Tue, 28 Jul 2026 00:00:00 GMThttps://chapter87.net/blog/building-hermes-self-hosted-ai-agent/https://chapter87.net/blog/building-hermes-self-hosted-ai-agent/A personal AI agent living on my own VPS, reachable from my phone, that reads the live web, remembers context, survives provider outages, checks on my home network, and even edits its own code — built with security as the first constraint, not an afterthought.Sun, 16 Aug 2026 00:00:00 GMThttps://chapter87.net/blog/building-my-homelab-network/https://chapter87.net/blog/building-my-homelab-network/How I designed and wired a segmented home network with UniFi gear, a Raspberry Pi service node, Cat8 cabling, VLANs, and a real security posture — and the two problems that nearly broke it.Thu, 18 Jun 2026 00:00:00 GMThttps://chapter87.net/blog/esp8266-flight-radar-for-my-son/https://chapter87.net/blog/esp8266-flight-radar-for-my-son/My son wanted the tiny desk clock to show planes flying overhead like a radar screen. So I wrote custom firmware for its ESP8266 that pulls live flight data and draws a real scope. The bugs along the way were a great tour of embedded graphics.Thu, 09 Jul 2026 00:00:00 GMThttps://chapter87.net/blog/everything-i-tested-on-a-handheld-rf-multitool/https://chapter87.net/blog/everything-i-tested-on-a-handheld-rf-multitool/Deauth detection, BLE spam, sub-GHz replay, 2.4 GHz spectrum analysis, packet capture, and jamming research — all on a single open-source ESP32 device, all in my own lab. A field guide to what actually worked, what did not, and what the law says.Tue, 04 Aug 2026 00:00:00 GMThttps://chapter87.net/blog/hacking-a-vulnerable-android-app-androgoat/https://chapter87.net/blog/hacking-a-vulnerable-android-app-androgoat/I set up a real mobile pentest lab on my own phone against AndroGoat, an intentionally-insecure training app, and worked through the OWASP mobile classics: intercepting HTTPS, dumping secrets from exported components, and — the big one — running Frida on a phone I could not root.Thu, 16 Jul 2026 00:00:00 GMThttps://chapter87.net/blog/handheld-rf-tool-and-the-faraday-box/https://chapter87.net/blog/handheld-rf-tool-and-the-faraday-box/I built up an open-source ESP32 multi-radio device for learning about wireless security — legally, in a shielded setup. The most valuable result was a negative one: my shielded enclosure gave zero attenuation, and rigorous testing is the only reason I know that.Tue, 04 Aug 2026 00:00:00 GMThttps://chapter87.net/blog/home-servers-and-killing-sms-2fa/https://chapter87.net/blog/home-servers-and-killing-sms-2fa/A tour of the services I self-host on one NAS — photos, passwords, media, and backups — how they stay reachable without being exposed to the internet, and why I ripped out text-message two-factor auth in favour of authenticator codes.Tue, 21 Jul 2026 00:00:00 GMThttps://chapter87.net/blog/hybrid-identity-okta-entra-homelab/https://chapter87.net/blog/hybrid-identity-okta-entra-homelab/IAM job specs ask for hybrid identity and directory sync. Instead of just reading about it, I built the whole thing in a homelab — AD on-prem, synced up to both Entra ID and Okta, managed as code.Sat, 15 Aug 2026 00:00:00 GMThttps://chapter87.net/blog/iam-homelab-active-directory-keycloak/https://chapter87.net/blog/iam-homelab-active-directory-keycloak/Standing up Active Directory, Keycloak, Authentik and OpenLDAP on my own hypervisor, then automating the joiner/mover/leaver lifecycle the way an IAM team actually does it.Mon, 22 Jun 2026 00:00:00 GMThttps://chapter87.net/blog/iot-test-engineer-smart-alarm-uni/https://chapter87.net/blog/iot-test-engineer-smart-alarm-uni/A university brief cast me as the test engineer for an IoT security alarm. Instead of just building one, I designed, built, and evaluated three progressively smarter versions — and learned that testing an IoT device is a discipline of its own.Sun, 24 May 2026 00:00:00 GMThttps://chapter87.net/blog/isp-was-hijacking-my-dns/https://chapter87.net/blog/isp-was-hijacking-my-dns/My home DNS just stopped resolving. Chasing it down led somewhere I did not expect: my internet provider was intercepting DNS traffic transparently, so even queries I aimed at a public resolver were being answered by them. Here is how I found it and routed around it.Mon, 10 Aug 2026 00:00:00 GMThttps://chapter87.net/blog/leaving-windows-for-fedora-and-hardening-it/https://chapter87.net/blog/leaving-windows-for-fedora-and-hardening-it/Why I wiped Windows for Fedora as my daily driver, and the security hardening I did afterward — the wins, and one lesson that stung.Thu, 30 Jul 2026 00:00:00 GMThttps://chapter87.net/blog/m5stick-handheld-pentest-platform/https://chapter87.net/blog/m5stick-handheld-pentest-platform/The M5StickC Plus2 is a tiny ESP32 device you can clip to a keyring. Loaded with open-source security firmware it becomes a genuine, pocketable platform for learning Wi-Fi, RFID, sub-GHz and BadUSB techniques — used the way they are meant to be used: on your own kit and authorized engagements.Tue, 04 Aug 2026 00:00:00 GMThttps://chapter87.net/blog/pocket-hacking-lab-nethunter-termux/https://chapter87.net/blog/pocket-hacking-lab-nethunter-termux/No custom ROM, no tripped warranty fuse — just a locked Android phone running a full Linux userland, a suite of security tools, and even an AI coding agent, all in my pocket. Here is what is actually possible without rooting, and where the hard limits are.Thu, 23 Apr 2026 00:00:00 GMThttps://chapter87.net/blog/post-quantum-ssh-in-my-homelab/https://chapter87.net/blog/post-quantum-ssh-in-my-homelab/Why I turned on a hybrid post-quantum key exchange for SSH between my lab machines, what "harvest now, decrypt later" actually means, and the one config file that did it.Mon, 13 Jul 2026 00:00:00 GMThttps://chapter87.net/blog/raid-is-not-a-backup-321-homelab/https://chapter87.net/blog/raid-is-not-a-backup-321-homelab/I thought my homelab was backed up. Then I actually looked. The backup job was pointing at machines that no longer existed, the schedule never fired because the lab is usually powered off, and the one "second copy" was the same disk wearing a disguise. Here is how I rebuilt it properly.Mon, 27 Jul 2026 00:00:00 GMThttps://chapter87.net/blog/raspberry-pi-that-does-ten-jobs/https://chapter87.net/blog/raspberry-pi-that-does-ten-jobs/One small, cheap, low-power computer runs my DNS, blocks ads for the whole house, acts as a hardened jump host, bridges my network segments, and doubles as a wireless-audit node. Here is how I set it up and locked it down.Mon, 10 Aug 2026 00:00:00 GMThttps://chapter87.net/blog/round-lcd-imu-sensor-dashboard-esp32/https://chapter87.net/blog/round-lcd-imu-sensor-dashboard-esp32/A 1.28-inch round touchscreen, a 6-axis motion sensor, and an ESP32 — turned into a live gauge that reads real movement and temperature and renders it without a flicker. Small screen, surprisingly deep lessons.Fri, 05 Jun 2026 00:00:00 GMThttps://chapter87.net/blog/seeing-through-walls-with-wifi-csi/https://chapter87.net/blog/seeing-through-walls-with-wifi-csi/Wi-Fi signals bounce off and pass through everything in a room, including people. With an ESP32 and some open-source software, you can read those distortions and sense human presence and pose — no camera involved. I built a working node and dashboard.Tue, 12 May 2026 00:00:00 GMThttps://chapter87.net/blog/self-hosted-media-jellyfin-on-old-sticks/https://chapter87.net/blog/self-hosted-media-jellyfin-on-old-sticks/How I built a self-hosted Jellyfin media library on a small NAS and got it onto cheap, old, half-locked living-room streaming boxes.Thu, 06 Aug 2026 00:00:00 GMThttps://chapter87.net/blog/self-hosted-password-manager-vaultwarden/https://chapter87.net/blog/self-hosted-password-manager-vaultwarden/Every password I own lived in someone else’s cloud. I moved them to a Bitwarden-compatible server running on my own NAS, reachable only over my private mesh — never exposed to the internet — and kept the polished apps I already liked.Tue, 21 Jul 2026 00:00:00 GMThttps://chapter87.net/blog/self-hosted-photo-cloud-immich-truenas/https://chapter87.net/blog/self-hosted-photo-cloud-immich-truenas/Family photos are the one thing you never want to lose and never want leaked. So I stopped renting cloud storage and built my own — TrueNAS, ZFS encryption, and Immich — then spent an evening debugging why my wife could not log in.Thu, 30 Jul 2026 00:00:00 GMThttps://chapter87.net/blog/smart-bin-touchless-lid-arduino/https://chapter87.net/blog/smart-bin-touchless-lid-arduino/A university IoT project — an Arduino bin that opens its lid when you wave your hand near it. Simple on paper, but the servo browning out, the lid auto-cycling, and a flaky sensor each taught a real lesson about building things that touch the physical world.Thu, 26 Feb 2026 00:00:00 GMThttps://chapter87.net/blog/tailscale-zero-trust-mesh-no-open-ports/https://chapter87.net/blog/tailscale-zero-trust-mesh-no-open-ports/Port forwarding is how home labs get breached. I connect my laptop, servers, NAS, and phone with a mesh VPN instead — every device reachable from anywhere, nothing exposed to the internet. Here is the setup and the one mistake that quietly undermines it.Tue, 21 Jul 2026 00:00:00 GMThttps://chapter87.net/blog/talking-ai-camera-esp32/https://chapter87.net/blog/talking-ai-camera-esp32/A tiny ESP32-S3 with a camera and a speaker, wired up to a vision model, that you point at an object and it describes it out loud. Getting it to actually talk was the hard part — the memory management on a chip this small is unforgiving.Mon, 15 Jun 2026 00:00:00 GMThttps://chapter87.net/blog/ultrasonic-alarm-arduino-uni-lab/https://chapter87.net/blog/ultrasonic-alarm-arduino-uni-lab/A university electronics lab where I built a distance-based proximity alarm on an Arduino Uno, and spent most of my time learning that a "dead" HC-SR04 was really just wired backwards.Wed, 13 May 2026 00:00:00 GMThttps://chapter87.net/blog/unifi-network-setup-and-automating-the-api/https://chapter87.net/blog/unifi-network-setup-and-automating-the-api/How I built and run my home network on UniFi kit: adopting the gateway, switch and access point into one controller, carving it into VLAN zones with default-deny firewalling, and then automating the whole thing through the controller API instead of clicking around a dashboard.Sun, 19 Jul 2026 00:00:00 GMThttps://chapter87.net/blog/wifi-6e-adapter-rf-survey-own-airspace/https://chapter87.net/blog/wifi-6e-adapter-rf-survey-own-airspace/A Wi-Fi 6E adapter that can listen and inject, pointed at my own network for a proper audit. It found an open access point broadcasting inside my house for 54 hours, an IoT gadget on the wrong network, and a silent WPA3-to-WPA2 downgrade — all things I would never have seen without looking.Tue, 04 Aug 2026 00:00:00 GMThttps://chapter87.net/blog/wifi-injection-lab-pmf/https://chapter87.net/blog/wifi-injection-lab-pmf/Everyone demos the deauthentication attack on YouTube. I wanted to know whether it still works against a modern, correctly configured access point. So I set up a closed lab with my own kit and found out.Fri, 14 Aug 2026 00:00:00 GMT