SELO Sentinel Stack
Open-source bash installer that combines Unbound (recursive DNSSEC resolver), Pi-hole (network-wide filtering), and WireGuard (VPN) into one hardened privacy gateway on Debian/Ubuntu.
Client: Open Source Project · Timeline: Active · Role: Solo developer — architecture, installer, hardening
Stack: Bash, Unbound, Pi-hole, WireGuard, DNSSEC, systemd, Privacy gateway, Idempotent installer, DNS + VPN + filtering
Problem
- DNS-leak prevention, network-wide ad/tracker filtering, and secure VPN access normally require three separate setups and a lot of manual config.
- Most installers assume cloud accounts or break the host when re-run on an existing system.
Approach
- Architected a layered gateway where all VPN traffic is forced through Pi-hole → Unbound, eliminating DNS leaks by design.
- Wrote an idempotent bash installer with auto interface detection, secure password generation, and QR-coded WireGuard client provisioning.
- Hardened post-install flow: credential summary, exportable mobile profiles, and DNSSEC-validated recursion — all from one script run.
Results
- Live deployment stats: 1.07B lifetime DNS queries served, 289M ads blocked (25.46% block rate), 27 TB of bandwidth saved.
- Single-command install on a fresh Debian/Ubuntu host — re-runnable without state corruption.
- Mobile clients onboard in seconds via exported WireGuard QR codes.
What you can verify
- Public GitHub repo with single-script install and documented prerequisites.
- Live analytics: 1.07B lifetime DNS queries served and a 25% ad block rate.
- Architecture documented: WireGuard → Pi-hole → Unbound, no DNS leaks.