Full-stack cybersecurity training platform — infrastructure, automation, AI, and real-world simulation
¶ Mission
The CRC Cyber Lab combines enterprise infrastructure, automation, AI, and real-world simulation into a single training platform. Every component is designed to deliver one outcome: students who can operate, not just pass tests.
¶ Infrastructure Architecture
¶ Physical Infrastructure
| Host | Role | IP (LAN) | Hardware |
|---|---|---|---|
| PVE1 | Primary Proxmox hypervisor | 192.168.1.90 | Production server, 256GB+ RAM |
| PVE2 | Secondary Proxmox hypervisor | 192.168.1.9 | Production server, 256GB+ RAM |
| Dreamwall | Edge firewall / router | 192.168.1.1 | Ubiquiti Dreamwall |
¶ Virtualization Platform
- Proxmox VE across two physical nodes
- 30+ virtual machines across the cluster
- High-density VM hosting for concurrent student pods
- Snapshot and rollback capability per VM
¶ Network Topology
| Network | Subnet | Purpose |
|---|---|---|
vmbr0 (Management LAN) |
192.168.1.0/24 | Infrastructure management |
pod01net – pod20net |
10.50.1.0/24 (shared) | Student lab networks |
vmbr50 (CDW VLAN) |
192.168.50.0/24 | Client Delivery Workbench |
¶ Key Infrastructure IPs
| IP | Host | Role |
|---|---|---|
| 192.168.1.90 | PVE1 | Primary hypervisor |
| 192.168.1.9 | PVE2 | Secondary hypervisor |
| 192.168.1.1 | Dreamwall | Edge firewall |
| 192.168.1.51 | crc-guac-gateway-01 | Guacamole (student access) |
| 192.168.1.55 | crc-proxy-gateway-01 | Nginx reverse proxy |
| 192.168.1.103 | crc-awx-k8s-01 | AWX automation server |
| 192.168.1.42 | crc-wiki-01 | Wiki.js (this wiki) |
| 192.168.1.61 | crc-ai-ide-01 | OpenHands + CyberLab Portal |
| 192.168.1.169 | crc-lms-001 | Learning Management System |
| 10.50.1.10 | DC01-P01 | Primary Domain Controller (VM 200) |
| 10.50.1.11 | DC02-P01 | Replica Domain Controller (VM 221) |
¶ Pod-Based Cyber Range
¶ Architecture
Each student operates in their own pod — an isolated workspace within a shared Active Directory domain. The shared domain model reduces infrastructure overhead while maintaining realistic enterprise scale.
Dreamwall Firewall
192.168.1.1
|
vmbr0 (192.168.1.0/24)
___________|___________|___________
| | | |
PVE1 PVE2 Wiki.js OpenHands
.1.90 .1.9 .1.42 .1.61
|
pod01net - pod20net (10.50.1.0/24)
|
_____|_____
| |
DC01 DC02
.1.10 <-> .1.11
|
[ AWX Automation Engine ]
(VM 103, 192.168.1.103)
¶ Isolation Model
- Shared Domain: All pods use
acs-p01.local— one AD domain, multiple isolated OUs - OU-Level Isolation: Each pod gets its own OU tree (
OU=PodXX,OU=CyberLab) - Per-Pod Delegation: Students can only manage objects within their own OU
- Shared DCs: DC01-P01 (primary) and DC02-P01 (replica) serve all 20 pods
- DC-Only Labs: Labs execute on the DC itself — no per-pod workstation VMs needed
¶ Key Design Decisions
| Decision | Rationale |
|---|---|
| Shared domain, OU isolation | One directory on 2 DCs; per-student isolation is OU delegation plus a dedicated member server per pod |
| DC-only labs | Eliminates need for per-pod workstation VMs |
| Web-based access (Guacamole) | Zero client software — students need only a browser |
| Full automation (AWX) | Seed 20 pods in < 2 minutes, verify instantly |
¶ Lab Engine (CMMC Curriculum)
¶ Control Families
| Family | Code | Labs | Status |
|---|---|---|---|
| Access Control | AC | 12 |  Live |
| Identification & Authentication | IA | 12 | Live |
| Audit & Accountability | AU | 12 |  Coming Soon |
| System & Comms Protection | SC | 12 | Coming Soon |
| System & Info Integrity | SI | 12 | Coming Soon |
| Configuration Management | CM | 12 | Coming Soon |
View full Lab Families details
¶ Scenario-Based Learning
All labs simulate the fictional company ACS Consulting, giving students a consistent narrative:
- Real users, groups, and organizational structure
- Intentional misconfigurations seeded by automation
- Step-by-step remediation using enterprise tools
- Automated verification for every objective
¶ Tools Students Use
- Active Directory Users and Computers (ADUC) — user/group/OU management
- PowerShell — reporting, policy configuration, service inspection
- Task Scheduler — scheduled task review and remediation
- Group Policy Management — GPO analysis and configuration
- File Explorer & Notepad — evidence file creation
¶ The Juicebox (AWX Automation Engine)
The Juicebox is the automation and orchestration layer that turns static labs into a living system.
¶ Powered By
- AWX (open-source Ansible Tower) — enterprise automation platform on K3s (VM 103)
- Ansible Playbooks — one playbook per lab, per action (seed/verify/reset)
- WinRM — remote execution against Windows domain controllers
¶ Capabilities
| Function | Description |
|---|---|
| Seed | Deploy misconfigurations to all 20 pods in < 2 minutes |
| Verify | Check every remediation step — PASS/FAIL per objective |
| Reset | Restore pods to seed state for retries or next class |
| Progress Track | Per-student, per-lab completion tracking |
¶ Workflow
INSTRUCTOR AWX / ANSIBLE STUDENT POD
─────────── ───────────── ───────────
Launch seed job ──────────> Run seed playbook ─────────> Misconfigured
(FAIL state)
Student works on lab...
Launch verify job ─────────> Run verify playbook ────────> Check each item
PASS / FAIL
Launch reset job ─────────> Run reset playbook ────────> Back to seed state
¶ Open Range Environment
The Open Range is an unstructured learning environment for advanced students and exercises beyond the structured CMMC curriculum.
¶ Components
| Component | Purpose |
|---|---|
| Sandbox ACS Domain | Separate Active Directory domain for open-ended experimentation — students can break things without affecting the main lab environment |
| OWASP Juice Shop | Interactive web application hacking — practice OWASP Top 10 vulnerabilities in a safe environment |
| Pen Test Range | Network scanning, vulnerability assessment, exploit testing against intentionally vulnerable systems |
¶ Use Cases
- Red Team / Blue Team exercises in controlled environments
- Tool experimentation — Nmap, Burp Suite, Wireshark, Metasploit
- Offensive security practice without rigid instructions
- Capture the Flag (CTF) events and competitions
- Incident response drills with live attack scenarios
¶ Client Delivery Workbench (CDW)
The CDW is an isolated security assessment environment on PVE2 for conducting client engagements.
¶ CDW Infrastructure
| Component | IP | Purpose |
|---|---|---|
| crc-guac-gateway-02 | 192.168.50.10 | CDW access gateway (Guacamole) |
| crc-cdw-vpn-01 | 192.168.50.11 | WireGuard VPN gateway |
| crc-cdw-ops-01 | 192.168.50.12 | Kali Linux pentesting workstation |
| crc-cdw-scan-01 | 192.168.50.13 | OpenVAS vulnerability scanner |
| crc-cdw-monitor-01 | 192.168.50.14 | Wazuh 4.9.2 SIEM / monitoring |
| crc-cdw-win-01 | 192.168.50.15 | Windows tools (RSAT, Sysinternals) |
| crc-cdw-capture-01 | 192.168.50.16 | Packet capture (tcpdump/tshark) |
VLAN 50 (192.168.50.0/24) on vmbr50. See CDW Overview for full documentation.
¶ AI Integration Layer
¶ Current State
| Component | Status | Description |
|---|---|---|
| OpenHands AI IDE | Deployed |
Browser-based AI coding and operations environment on VM 105 (PVE2) |
| MCP Server | Deployed |
Model Context Protocol server — AI-to-AWX bridge for lab operations |
| CyberLab Portal | Deployed |
Next.js web portal for instructors and admins (Vercel) |
| DigitalRCC LabOps AI | Deployed (owner-only) |
Support-triage assistant and Direct Chat in the LabOps console, on its own host drcc-labops-01 (VM 100, PVE2) — see LabOps AI |
¶ Architecture
CyberLab Portal (Vercel)
|
|── OpenHands IDE (VM 105 on PVE2, iframe)
| |
| └── Sandbox Containers
| ├── VSCode Server
| ├── Chromium Browser
| └── Tool Preloading
|
└── MCP Server (VM 105)
|
└── AWX API Bridge
├── Pod Management
├── Lab Seeding
└── Status Queries
labops.drcc.digitalrcc.com (edge 192.168.1.55)
|
└── LabOps gateway (drcc-labops-01, VM 100 PVE2, :3100)
├── per-investigation agent container (isolated, default-deny egress)
├── run-scoped model proxy (sole holder of the provider key)
└── Supabase ai_* tables (runs, messages, events, tool actions, usage)
crc.ai on VM 105 is unchanged and independent: LabOps AI runs a private headless
runtime on its own host, and its write capabilities (AWX, GitHub, Wiki.js, support notes)
are all switched off.
¶ Future Roadmap
- AI-driven adaptive difficulty based on student performance
- Natural language lab operations ("seed pod 3 for AC lab 1")
- AI-assisted troubleshooting and hint system
- Personalized learning path recommendations
¶ User Experience
¶ Access Method
Students access the lab through Apache Guacamole (VM 100, 192.168.1.51), a browser-based remote desktop gateway:
- Open any web browser (Chrome, Firefox, Edge)
- Navigate to the Guacamole URL
- Log in with pod credentials
- Click the
PODXX-SRVconnection and sign in asstudentXX@acs-p01.local— full Windows Server desktop appears
No VPN, no RDP client, no software installation required.
Each student is issued exactly one connection, PODXX-SRV, pointing at their own pod member server (10.50.XX.20); DC01-P01/DC02-P01 serve the directory but host no student sessions. The pod firewall is
reached from a browser inside that desktop at http://10.51.XX.1, routed by
the boot-persistent pod-routing.service on VM 100 — see
Network & Firewall. There is no firewall tile in
Guacamole (guacd implements no http protocol).
¶ Monitoring and Portal Integration
Proxmox management (8006) is not exposed to the internet. A read-only poller on
pve1 (lab-status-poller, using an audit-only API token) publishes normalized
health outbound to https://my.digitalrcc.com, and the portal reads per-pod
progress server-side from the tracker's authenticated API. See
Lab Health Monitoring and
Portal Integration.
¶ What Students See
- Real Windows Server 2022 desktop
- Active Directory Users and Computers and GPMC, run locally and bound to DC01-P01/DC02-P01, with scoped MMC shortcuts
- Local administrator rights on their own server only
- PowerShell with access to AD cmdlets
- Task Scheduler with lab-relevant scheduled tasks
- Desktop shortcuts for their specific pod tools
¶ Lab Flow
| Time | Step |
|---|---|
| 0:00 | Open browser, log in to Guacamole |
| 0:01 | Click pod connection, get Windows desktop |
| 0:02 | Read lab scenario in student guide |
| 0:05 | Begin identifying the misconfiguration |
| 0:10 | Apply remediation using enterprise tools |
| 0:20 | Complete lab, create evidence files |
| 0:25 | Instructor runs verify — instant PASS/FAIL |
¶ Automation & Verification
¶ Ansible Verification Engine
Every lab objective is verified by Ansible playbooks that check the actual state of Active Directory, file system, services, and configurations.
| Check Type | Example |
|---|---|
| AD Object State | Is the account disabled? Is it in the correct OU? |
| Group Membership | Were unauthorized groups removed? |
| Password Policy | Does the fine-grained policy meet requirements? |
| File Evidence | Does the evidence file exist with correct content? |
| Service Config | Is the service account configured correctly? |
| GPO Settings | Are the correct policies applied? |
¶ Results Format
Pod03 — AC M1-L1 Results
========================
[PASS] Account disabled
[PASS] Groups removed
[PASS] Moved to Terminated OU
[PASS] Evidence file found
========================
Result: 4/4 PASSED
¶ Scalability Model
| Metric | Current | Near-Term | Future |
|---|---|---|---|
| Concurrent Pods | 20 | 50+ | 100+ |
| Students per Year | 200 | 500+ | 1,000+ |
| Hypervisor Nodes | 2 | 4 | Cluster |
| CMMC Families | 2 (AC, IA) | 4 | 6 |
| Total Labs | 24 | 48 | 72 |
| Remote Access | VPN-ready | Full remote | Multi-site |
¶ Scaling Strategy
- Add pods = scale students — linear, predictable growth
- Add nodes = scale capacity — Proxmox cluster expansion
- Shared domain architecture — minimal VM overhead per pod
- Automation handles provisioning — no manual setup bottleneck
- Remote access ready — students train from anywhere
¶ Future Roadmap
| Phase | Target | Description |
|---|---|---|
| AU Labs | Q3 2026 | Audit & Accountability — 12 labs |
| SC Labs | Q4 2026 | System & Communications Protection — 12 labs |
| SIEM Integration | Q4 2026 | Wazuh SIEM for log aggregation and alerting |
| SI Labs | Q1 2027 | System & Information Integrity — 12 labs |
| CM Labs | Q1 2027 | Configuration Management — 12 labs |
| Vulnerability Scanning | Q1 2027 | OpenVAS integration for automated vulnerability assessment |
| Certification Pathways | Q2 2027 | Map lab completion to CompTIA Security+, CySA+, CMMC-AB |
| Multi-Site | Q3 2027 | Federated lab delivery across partner institutions |
¶ Infrastructure Summary
| Component | Details |
|---|---|
| PVE1 (Primary) | Proxmox VE, 256GB+ RAM, hosts DCs + Guacamole + AWX + Wiki.js + LMS |
| PVE2 (Secondary) | Proxmox VE, 256GB+ RAM, hosts CDW zone + AI IDE + PBS |
| DC01-P01 | Primary Domain Controller, VM 200, Windows Server 2022, 4 vCPU / 16 GB |
| DC02-P01 | Replica Domain Controller, VM 221, Windows Server 2022 Eval |
| Guacamole | Apache Guacamole RDP gateway (VM 100, 192.168.1.51) |
| AWX | Ansible automation platform (VM 103, 192.168.1.103, K3s) |
| Wiki.js | Documentation wiki (VM 106, 192.168.1.42) |
| OpenHands | AI IDE + MCP server (VM 105 on PVE2, 192.168.1.61) |
| CyberLab Portal | Instructor/admin portal (Vercel + Next.js) |
| LMS | Learning Management System (VM 109, 192.168.1.169) |
| PBS | Proxmox Backup Server (VM 103 on PVE2, 192.168.1.227) |
| Dreamwall | Ubiquiti edge firewall and network backbone |
| Domain | acs-p01.local |
| Pod Networks | pod01net through pod20net (10.50.1.0/24) |
| CDW VLAN | vmbr50 (192.168.50.0/24) on PVE2 |
¶ Quick Links
| Resource | Link |
|---|---|
| CRC Cyber Lab Overview | High-level platform overview |
| Lab Families | CMMC curriculum details |
| Pod Infrastructure | Pod layout and student experience |
| AWX Automation | Seed, verify, and reset workflows |
| Domain Controllers | DC01 and DC02 configuration |
| OU Structure | Active Directory organizational units |
| VM Inventory | All virtual machines |
| Network & Firewall | Dreamwall, VLANs, routing |
| VM 105 - AI IDE | OpenHands deployment details |
| CDW Overview | Client Delivery Workbench |
TCecure CRC CyberLab — A full-stack cyber training platform combining infrastructure, automation, AI, and real-world simulation