Blog / Field Guide
Field Guide
The tools and ideas behind the write-ups, one entry each: what it is, why I use it, what it costs you, and the gotchas I hit. Posts link here on first mention, so you can read up without the post stopping to explain.
Platform
-
Raspberry Pi
A credit-card-sized Linux computer that sips power, which makes it the natural home for always-on services like DNS, a honeypot and an AI agent gateway.
-
systemd
Linux's service manager. It starts things at boot, restarts them when they crash, runs scheduled jobs, and keeps their logs.
-
NetworkManager (nmcli)
The tool that manages network connections on Raspberry Pi OS. I use its command line, nmcli, to give the Pi a static IP and stop the router overriding its DNS.
AI & agents
-
Hermes Agent
An open-source AI agent harness from Nous Research. It gives a language model tools, memory, a schedule and a Telegram presence, and it runs happily on a Raspberry Pi.
-
OpenRouter
One API key and one prepaid balance for hundreds of AI models from dozens of providers, with a hard spending cap you set per key.
-
DeepSeek
A family of low-cost, capable AI models. DeepSeek V4.1 Flash is cheap per token and built for tool calling, which suits an always-on agent on a budget.
-
Telegram bots
Telegram's free Bot API turns a chat into a control panel and an alert channel. I use one bot to talk to my agent and a separate one for security alerts.
Network & DNS
-
Tailscale
A WireGuard-based mesh VPN that lets your own devices reach the Pi from anywhere, without opening a single port on your router.
-
Pi-hole
A DNS sinkhole that blocks ads, trackers and known-malicious domains for every device on your network, including the ones you can't install anything on.
-
Unbound
A recursive, DNSSEC-validating DNS resolver. It looks names up by asking the internet's DNS servers directly, so no single company sees your whole browsing history.
-
DNSSEC
Digital signatures for DNS records. A validating resolver can prove an answer really came from the domain's owner and wasn't tampered with on the way.
-
DHCP
The protocol that hands every device its IP address, its gateway and, crucially for Pi-hole, which DNS server to use.
-
dig
The standard command-line tool for asking a DNS server a question and seeing exactly what it answered.
Detection & monitoring
-
OpenCanary
A lightweight open-source honeypot. It pretends to be FTP, SSH, Telnet, MySQL and a NAS login page, and logs everyone who touches them.
-
Grafana
A web interface for searching, graphing and alerting on data. In my stack it's where I hunt through logs and where the Telegram alerts come from.
-
Loki
Grafana's log database. It indexes only a few labels and scans compressed logs at query time, which is why it runs comfortably on a Raspberry Pi.
-
Grafana Alloy
The agent that reads log files on the Pi and ships them into Loki. It replaced the retired Promtail.
-
LogQL
Loki's query language. Pick log streams by label, filter lines, parse out fields, and turn matching lines into counts you can graph and alert on.
-
tcpdump
A command-line packet capture tool. When the network is doing something you can't explain, tcpdump shows you what's actually on the wire.
-
Nmap
The classic network scanner. I use it to attack my own honeypot and prove the alerting works end to end.
Concepts
-
Prompt injection
When text an AI reads contains instructions, and the AI follows them. It's the number one risk for any agent that has tools and reads things it didn't write.
-
SIEM
Security Information and Event Management: collect security logs in one place, search them, keep them, and alert on what matters.