Design: A Homelab Log-Offload Pipeline With Write-Never-Read Storage

Fluent Bit to TrueNAS with per-source datasets and retention, enforced so a compromised VM can add logs but never erase them.

2026-03-14#CyberDen

work: Jan 2026 · Design (partly built) · CyberDen, Logging, Storage, Architecture

Status, up front

This is a design writeup. The NAS hardware and TrueNAS are built and the disks are burn-in tested. The observability host has rsyslog in place. The full pipeline below isn't running end to end yet.

The problem

Security Onion, MISP, the domain controller and the victims all generate logs, and each one stores them locally on hypervisor disks sized for VMs, not retention. Logs from test runs never got cleaned up. Neither Proxmox nor Security Onion manages log lifecycle for you.

Pipeline

sources: syslog · journald · app logs · security logs · network devices
   ↓  rsyslog / journald on every host that produces logs
   ↓  Fluent Bit (lightweight edge collector + shipper)
   ↓  storage segment
TrueNAS (ZFS datasets per source class, retention by dataset)

All open source: Fluent Bit, rsyslog, TrueNAS SCALE. No Elastic cluster just for retention. Security Onion keeps its own indices for hunting.

The rule: ingest may write, never read or control

The storage tier holds everything an attacker would want to tamper with. So:

Ingest identities can append, and that's all. No read, no list, no delete, no admin.
Readers (analysis, SOC) get read-only access through a separate path.
Control (retention, snapshots, deletion) only from the management segment.
Enforce it at three layers: firewall (which segment can reach the share, on which port), share permissions, and ZFS dataset permissions.

A compromised victim VM can then add noise, but it can't erase the evidence of what it did.

Lifecycle

Logs are test-scoped, not eternal. Each dataset gets a retention window and snapshots, so cleanup is automatic instead of "remember to delete stuff".

Hardware notes

The NAS is a reused i3-4170 desktop board with a 300 W PSU, meant for intermittent use rather than 24/7. The drives were picked for the job (NAS-rated for bulk, a separate drive for log ingest) and SMART-tested before use. Mini-PC SO-DIMMs don't fit desktop boards, which matters when planning upgrades.

Sources: Centralized Log Offloading (25 Jan 2026), Ingest Storage Enforcement (28 Jan 2026), NAS Drive Recommendations (29 Jan 2026), Containerization on T320 (20 Apr 2026)