sec-serv — Infrastructure Reference

Dedicated security host. Runs Wazuh SIEM/XDR and Velociraptor DFIR natively, with security, OSINT, identity, and utility services in Docker. Sits on the same LAN segment as home-serv.

Host

Kernel tuning

Set permanently via /etc/sysctl.d/:

• vm.swappiness=10
• vm.max_map_count=262144 — required by the Wazuh indexer

Journal timezone

This host logs in UTC; home-serv logs in local time (UTC−05:00). Correlating events across the two hosts requires accounting for the five-hour offset.

Network

Traffic flow

flowchart LR
    LAN[LAN clients 10.0.4.0/24]
    TS[Tailscale clients]
    CF[Cloudflare edge]
    CFD[cloudflared daemon]
    SVC[sec-serv services]

    LAN -->|direct LAN| SVC
    TS -->|Tailscale mesh| SVC
    CF -->|outbound QUIC tunnel| CFD
    CFD --> SVC

Three access paths reach this host: direct LAN, the Tailscale mesh, and the Cloudflare tunnel. The tunnel is outbound-only — no ports are forwarded at the perimeter.

Mesh

sec-serv is a member of a four-machine Tailscale mesh alongside home-serv, jeremy-pc, and jeremy-lt.

Exposure tiers

The majority of containerised services on this host bind to 127.0.0.1 and are reached exclusively through the tunnel. Wazuh components bind LAN-wide because agents connect over the local network.

Services

Security — native systemd

Wazuh is the SIEM/XDR plane. The indexer is OpenSearch 2.19.5 and stores all Wazuh data. The vulnerability-scanner module produces CVE data across all agent operating systems with a 60-minute feed interval. The inventory-harvester module ships package, process, network, hardware, service, browser-extension, user, group, hotfix, and protocol inventory into wazuh-states-inventory-* indexes.

Velociraptor is the DFIR and endpoint-hunting plane. Installed from a .deb package rather than Docker, with config at /etc/velociraptor/server.config.yaml. The admin GUI is tunnelled with noTLSVerify: true because it presents a self-signed certificate. Installer artifacts for client deployment — Linux .deb, Windows MSI, and raw binary — are kept at /home/jeremy/docker/stacks/velociraptor/.

Tor runs as a native systemd unit rather than inside any container, providing a SOCKS proxy for .onion reachability from SpiderFoot.

OSINT — Docker

SpiderFoot is built from source as the spiderfoot-local image, since the official Docker image is no longer publicly distributed. Source clone lives at stacks/spiderfoot/app/. It reaches .onion modules through the host Tor SOCKS proxy. Access is mediated at the tunnel edge — a documented risk acceptance rather than an application-layer control.

VIPERSHADOW is a dark web OSINT platform built in-house. Three containers: a FastAPI backend running Tor internally, an nginx frontend serving a built React/Vite application, and Selenium standalone-chromium for interactive handling of gated sites. Authentication is JWT-based. The stack is intentionally cold — started on demand through Dockge rather than running continuously.

ViperScan is an in-house scanning tool, single container, image built locally.

Endpoint management — Docker and native

MeshCentral serves plain HTTP in tlsOffload mode, with TLS terminated at the Cloudflare edge. This host runs both the MeshCentral server and a client agent enrolled against its own server.

Velociraptor provides a second endpoint-management plane alongside MeshCentral.

DNS filtering — Docker

Network-wide DNS ad and tracker filtering. The admin UI is tunnel-only; DNS binds to the LAN IP to serve local clients.

Password management — Docker

IT and utilities — Docker

ViperTools is an in-house developer, IT, and networking toolkit, four containers, image built locally.

Networking Toolbox provides offline networking utilities — DNS lookups, subnet math, TLS and HTTP diagnostics, port checks. Access is mediated at the tunnel edge rather than by application-layer authentication.

Dozzle runs in hub mode, aggregating container logs from both sec-serv and home-serv through the agent on home-serv port 7007.

Monitoring — Docker

Beszel is the hub for both servers. Scrutiny aggregates SMART data from local drives and receives home-serv telemetry from a collector cron on that host.

Stack management — Docker

Backup — native, pushes to home-serv

BBS is the primary backup path. Repository sec-serv-daily covers /etc, /home/jeremy/docker/stacks, /var/ossec, and /var/lib/wazuh-indexer.

ReaR produces bare-metal recovery images using BACKUP=RSYNC. It runs as root, so it authenticates from /root/.ssh rather than the jeremy user's key material — the root public key is present in jeremy@home-serv:~/.ssh/authorized_keys.

Cloudflare tunnel routes

Catch-all rule: http_status:404.

Host port map

Compose projects

Stacks live under /home/jeremy/docker/stacks/, managed through Dockge.

adguard/              beszel/               dockge/
dozzle/               meshcentral/          networking-toolbox/
scrutiny/             spiderfoot/           vaultwarden/
velociraptor/         viperden/             vipershadow/
viperscan/            web-check/            it-tools/

Two directories do not match their container names, and should be resolved authoritatively rather than by inference:

• it-tools/ holds the live ViperTools stack. Containers are named vipertools-*; the directory retains the original name from before the rebrand. There is no vipertools/ directory.
• viperden/ holds ViperDen, but its compose file lives in viperden/deploy/ rather than at the top level.

docker inspect <container> \
  --format '{{index .Config.Labels "com.docker.compose.project.working_dir"}}'

velociraptor/ is not a compose stack — it holds installer artifacts for client deployment. Wazuh and Velociraptor both run natively as systemd units and are not managed by Dockge.

Native systemd services

Wazuh agent deployment

Manager address selection follows endpoint mobility. Stationary endpoints — servers and desktops that never leave the network — connect over the LAN IP 10.0.4.110. Portable endpoints connect over the Tailscale IP so they continue reporting from any internet connection.

Five agents are enrolled across Ubuntu, Arch, and Windows 11, covering both servers and workstation endpoints.