Networking Zero Trust Security
Zero Trust Security Architecture
Complete guide to the Zero Trust security model, defense-in-depth enforcement layers, container microsegmentation, and request validation policies.
Zero Trust Security Layers Visual Diagram
Core Zero Trust Principles
1. Never Trust the Network Location
Physical connection to home Wi-Fi or LAN does not grant access privileges to internal homelab services. Every incoming connection is treated as originating from an untrusted public network.
2. Explicit Verification for Every Request
Access decisions require two-factor identity proof: - Device Identity: Validated via ephemeral WireGuard key pairs tied to approved hardware. - User Identity: Validated via SSO authentication with mandatory Multi-Factor Authentication (MFA).
3. Least Privilege & Blast Radius Minimization
If a single container or service is compromised, microsegmentation prevents lateral movement across host networks or adjacent container volumes:
- Containers run in isolated Docker bridges (172.18.0.0/16).
- Containers use unprivileged system users (PUID=1000, PGID=1000).
- Root filesystems are set to read-only where applicable.
4-Layer Defense-in-Depth Model
| Security Layer | Technology Stack | Security Function |
|---|---|---|
| Layer 1: Device Auth | Tailscale Device Keys + MFA SSO | Validates hardware signature & user credentials before tunnel creation |
| Layer 2: ACL Segmentation | Tailscale Tailnet ACL Policies | Restricts traffic flow between tagged groups (tag:server, tag:client) |
| Layer 3: Ingress Proxy | Nginx Proxy Manager (NPM) | Handles TLS termination, SNI matching, URL path filtering, and rate limiting |
| Layer 4: Container Isolation | Linux Namespaces & Cgroups | Restricts process capabilities, filesystem access, and system calls |