https://networknet.nl/Recent content on Ivan Versluis — NetworknetHugoenhttps://networknet.nl/notes/zero-trust-network-policies/Sun, 06 Sep 2026 10:00:00 +0200https://networknet.nl/notes/zero-trust-network-policies/<h2 id="segmentation-as-a-learning-method">Segmentation as a learning method</h2> <p>Kubernetes makes it easy for workloads to communicate. That convenience also means a compromised workload may reach more services than its use case requires. I wanted my homelab namespaces to start from the opposite assumption: traffic is denied until a workload has an understood reason to send or receive it.</p> <p>This turns Zero Trust into an engineering practice. Each use case gets its own explicit network boundaries, and implementing those boundaries forces me to learn the real data flow rather than relying on an architecture diagram alone.</p>https://networknet.nl/notes/pihole-encrypted-dns/Sat, 05 Sep 2026 12:00:00 +0200https://networknet.nl/notes/pihole-encrypted-dns/<h2 id="start-with-the-questions-leaving-the-network">Start with the questions leaving the network</h2> <p>DNS is one of the clearest ways to understand what is happening on a home network. Almost every device resolves a name before it reaches a website, cloud service, update server or telemetry endpoint. When every client uses a different external resolver, that behavior remains fragmented and difficult to explain.</p> <p>My first objective is therefore simple: give LAN clients one local DNS entry point with Pi-hole. Centralizing resolution creates visibility before adding more advanced controls. It shows which clients are active, which domains they request, what is being blocked and where resolution fails.</p>https://networknet.nl/notes/iot-prometheus/Fri, 04 Sep 2026 12:00:00 +0200https://networknet.nl/notes/iot-prometheus/<p>A solar inverter on the local network, climate units behind a SaaS API and smart devices in a vendor cloud do not naturally belong in the same operational view. Prometheus exporters provide the translation layer: each integration handles its own protocol, authentication and data shape, then exposes metrics through the same HTTP contract.</p> <p>That separation keeps vendor-specific complexity at the edge. Prometheus only needs to scrape a predictable endpoint, while Grafana can work with stable names, labels and health signals. DSMR P1 energy-meter data joins the same wider home-metrics landscape.</p>