Solution overview
In this lab you build the storage and access-control stack for a small application the way a production host would have it. Starting from three blank disks, you mirror two of them into a RAID 1 array with mdadm and prove the array keeps serving when a member fails. You place LVM on top so the volumes can grow live, then take a snapshot and roll a bad change back through it. Under the application's own data you create a LUKS-encrypted volume, add a second key and back up the header so a lost passphrase or a damaged header never costs you the data. With the storage in place you deploy the application as a systemd service and confine it with an AppArmor profile generated from its observed behavior, then fix a real denial in production without turning enforcement off. It is the course capstone: every storage and access-control skill from the module lands on one running service.