Security engineering portfolio project
ClinicGuard
A Docker-based simulated clinic network demonstrating segmentation, default-deny firewalling, TLS-protected synthetic EHR access, IDS monitoring, centralized logs, and automated security tests.
What it demonstrates
Network segmentation
Staff, guest, server, management, and attacker zones are represented by isolated Docker networks.
Default deny
nftables drops forwarded traffic by default and permits only the intended staff HTTPS boundary.
Detection and evidence
Suricata detects probes while Loki, Promtail, and Grafana centralize security and proxy logs.
Automated proof
pytest integration tests and an attacker simulation verify allowed and blocked paths in CI.
Technology stack
Runtime
Docker Desktop, Docker Compose, Linux containers, WSL2
Security
nftables, nginx, TLS, Suricata 7.0, dnsmasq
Observability
Loki 3.2.1, Promtail 3.2.1, Grafana 11.3.1
Testing
Python 3.12, pytest, POSIX shell, GitHub Actions
Project notes
- All EHR data is synthetic; this is not a healthcare product or HIPAA certification.
- Docker networks simulate routed segmentation and are not physical VLANs.
- The live Docker stack and Grafana dashboard run locally; GitHub Pages hosts this static project overview.