Built and verified. This work is live and was checked against its plan.

ABD Labs Portfolio Routing

abdlabs.org serves a static HTTPS portfolio from the public host, with www redirected, TLS issued and renewal verified.

Overview

The first public ABD Labs milestone was to recover the domain and route it to a safe static portfolio surface. The site is intentionally separate from lab administration and from existing production services.

Problem

ABD Labs needed a public identity for verified Microsoft Enterprise Lab and technical portfolio work, but the public host also runs other important services. The public site had to be useful without increasing operational risk.

Constraints

  • Keep SSH, nginx, Tickly, PostgreSQL and current services reachable.
  • Do not expose RDP, SMB, LDAP, Kerberos, WinRM, DNS or hypervisor consoles.
  • Preserve existing Hostinger MX records for the domain mailbox.
  • Avoid firewall changes while only publishing a static portfolio.
  • Make the route reproducible and easy to replace with a fuller portfolio.

Approach

Create a dedicated nginx virtual host for abdlabs.org, serve static files from a scoped webroot, issue a Let's Encrypt certificate for both abdlabs.org and www.abdlabs.org, then verify redirects, HTTPS and renewal behavior before expanding the site content.

Key decisions

Use static hosting for the public portfolio.

Static output gives the public site fast delivery and a small operational surface. No database, admin panel or application runtime has to be exposed for the first portfolio version.

Alternatives considered

  • Deploy a full CMS.
  • Run a custom Node application behind nginx.
  • Keep a hand-written single HTML marker page indefinitely.

Make abdlabs.org the canonical route.

A single canonical domain keeps public links simple, while www.abdlabs.org can redirect permanently to the root domain.

Alternatives considered

  • Publish primarily on www.abdlabs.org.
  • Use portfolio.abdlabs.org before there is enough content to justify a subdomain.

Keep the lab administration namespace private by default.

The portfolio can prove work without publishing management surfaces. Any future VPN endpoint needs a separate design and explicit approval.

Alternatives considered

  • Publish direct lab service names in public DNS.
  • Use the portfolio host as a general lab gateway.

Result

Canonical route
200 OK
Redirect route
308
Certificate names
2
Firewall changes
0

ABD Labs now has a public proof layer that can grow into case studies while lab management remains private and existing host services stay isolated.

Learnings

  • A small static site is the right first public surface when the real value is evidence and documentation.
  • Portfolio routing should be verified independently from lab infrastructure so public publishing does not become a dependency of the lab.
  • DNS and TLS decisions need to preserve mail and existing production routes, not only make the new site load.

Implementation Notes

The route was built as a static public surface:

  • nginx owns the public virtual host;
  • the webroot is scoped to /var/www/abdlabs.org/public;
  • HTTP redirects to HTTPS;
  • www.abdlabs.org redirects to https://abdlabs.org;
  • the portfolio source is kept in Git under portfolio-site/;
  • generated Astro output is copied into the nginx webroot.

The nginx route was created without opening new firewall rules and without exposing any Windows or lab administration service.

Verification Commands

These checks were used during the routing and portfolio deployment work.

nginx -t

Expected result:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
curl -I https://abdlabs.org/
curl -I https://www.abdlabs.org/
curl -I http://abdlabs.org/

Observed behavior:

  • https://abdlabs.org/ returns 200;
  • https://www.abdlabs.org/ returns 308 to https://abdlabs.org/;
  • http://abdlabs.org/ returns 308 to https://abdlabs.org/.
certbot renew --dry-run --cert-name abdlabs.org --no-random-sleep-on-renew

Expected result: renewal simulation succeeds for the abdlabs.org certificate.

Existing nginx-backed services were also checked during the routing work to confirm the portfolio vhost did not interrupt current services.

Deployment Procedure

The Astro source is built locally:

cd /root/projects/microsoft-enterprise-lab/portfolio-site
npm run build

The generated static files are deployed from:

/root/projects/microsoft-enterprise-lab/portfolio-site/dist

to:

/var/www/abdlabs.org/public

Before replacing the previous site, the existing public webroot was copied to:

/var/www/abdlabs.org/backups/public-20260924T140727+0200

If a rollback is needed, the backup can be copied back into the public webroot.

Public And Private Boundary

This route is public:

  • static portfolio pages;
  • sanitized architecture notes;
  • case studies;
  • decision records;
  • robots and sitemap files.

These remain private by default:

  • RDP;
  • SMB;
  • LDAP or LDAPS;
  • Kerberos;
  • WinRM;
  • Windows Admin Center;
  • hypervisor consoles;
  • real tenant IDs, passwords, tokens, private keys and raw admin screenshots.

Current Source Of Truth

The live static output is served from /var/www/abdlabs.org/public.

The maintainable source now lives in the Microsoft Enterprise Lab repository under portfolio-site/, using Astro and MDX so future case studies can be added through Git-tracked content.

Follow-Up Evidence To Add

The next stronger version of this case study should include sanitized snippets from the nginx vhost, certificate metadata and a short rollback drill once the portfolio has changed a few more times.

All projects