med unes has published 1 tutorial.
Take a stock Debian SSH server and harden it the way you would in production: replace passwords with public-key auth, disable root login, add a TOTP second factor with PAM, and move off port 22, then prove it works by logging in, all inside the playground.
Services authenticate to each other with shared secrets that leak, never rotate, and cannot prove who is really calling. Here we build the alternative by hand: we verify a server the way a browser does, add mutual TLS bound to a specific identity, make certificates short-lived so a stolen one is worthless, then bootstrap it all with attestation and hardware-rooted keys. It is the model behind SPIFFE, built from openssl, MariaDB, SoftHSM2, and a TPM.
