From b2574afb2c1a9ddcbd621fa712811052fa9234b9 Mon Sep 17 00:00:00 2001 From: echo6-autocommit Date: Sun, 14 Jun 2026 06:00:11 +0000 Subject: [PATCH] auto: docs sync 2026-06-14T06:00:11+00:00 Files changed: argus.ref docs/hardware/environment.md docs/services/services.md --- argus.ref | 310 +++++++++++++++++++++++++++++++++++ docs/hardware/environment.md | 4 +- docs/services/services.md | 1 + 3 files changed, 314 insertions(+), 1 deletion(-) create mode 100644 argus.ref diff --git a/argus.ref b/argus.ref new file mode 100644 index 0000000..b6b3124 --- /dev/null +++ b/argus.ref @@ -0,0 +1,310 @@ +# ARGUS - OSINT Intelligence Platform + +**Status:** Container provisioned, baseline installed, awaiting application deployment +**Last Updated:** 2026-06-14 + +--- + +## Overview + +ARGUS (Automated Reconnaissance & Gathering for Unified Situational-awareness) is an OSINT intelligence gathering platform combining SearXNG with local LLM analysis for automated threat intelligence collection and processing. + +**Architecture:** +- Search backend: SearXNG (self-hosted) +- Analysis: Local LLM models (no cloud APIs) +- Scopes: Local, regional, national, global threat levels +- Privacy-first: No PII collection, focus on events/trends/policies + +--- + +## Container Specifications + +| Property | Value | +|----------|-------| +| **CTID** | 103 | +| **Hostname** | argus | +| **Host** | utility (192.168.1.241 / 100.64.0.5) | +| **Local IP** | 192.168.1.103 (static) | +| **Tailscale IP** | 100.64.0.25 | +| **Gateway** | 192.168.1.1 | +| **Container Type** | Privileged (unprivileged=0) | +| **Resources** | 4 cores, 8GB RAM, 30GB disk | +| **Storage** | local-lvm:vm-103-disk-0 | +| **Network** | vmbr0, eth0 | +| **Features** | nesting=1 (Docker support) | +| **Autostart** | Yes (onboot=1) | +| **OS** | Ubuntu 24.04 LTS | + +**Why privileged:** Required for /dev/net/tun access (Tailscale). Attempted unprivileged initially but tailscaled failed with "CreateTUN failed; /dev/net/tun does not exist". + +--- + +## Installed Software (Baseline) + +- **Docker:** 29.5.3 + docker-compose plugin +- **Tailscale:** 1.98.4 (registered with Headscale at vpn.echo6.co) +- **User:** zvx (uid=1000, groups: sudo, docker) +- **Common tools:** curl, wget, vim, htop, git, jq, net-tools, dnsutils, sshpass +- **SSH:** OpenSSH server (password auth enabled) + +--- + +## Tailscale Configuration + +**Headscale server:** https://vpn.echo6.co +**User:** echo6 (user ID 1) +**Tailscale IP:** 100.64.0.25 +**Registration:** `tailscale up --login-server=https://vpn.echo6.co --authkey= --ssh --accept-routes` + +**DNS Bootstrap Fix:** +Systemd drop-in at `/etc/systemd/system/tailscaled.service.d/dns-bootstrap.conf` ensures fallback DNS (1.1.1.1, 8.8.8.8) exists before tailscaled starts, preventing chicken-and-egg DNS resolution failures on reboot. + +```bash +[Service] +# Ensure fallback DNS exists before tailscaled starts +# Prevents chicken-and-egg DNS resolution failures on reboot +ExecStartPre=/bin/sh -c "echo nameserver 1.1.1.1 > /etc/resolv.conf; echo nameserver 8.8.8.8 >> /etc/resolv.conf" +``` + +--- + +## Network Configuration + +**Static IP:** Configured via Proxmox (`pct set 103 -net0 name=eth0,bridge=vmbr0,ip=192.168.1.103/24,gw=192.168.1.1`) + +**Container config** (`/etc/pve/lxc/103.conf`): +``` +arch: amd64 +cores: 4 +features: nesting=1 +hostname: argus +memory: 8192 +net0: name=eth0,bridge=vmbr0,hwaddr=BC:24:11:EA:8B:21,ip=192.168.1.103/24,gw=192.168.1.1,type=veth +onboot: 1 +ostype: ubuntu +rootfs: local-lvm:vm-103-disk-0,size=30G +swap: 512 +lxc.cgroup2.devices.allow: c 10:200 rwm +lxc.mount.entry: /dev/net dev/net none bind,create=dir +``` + +**TUN device:** Added manually via `lxc.cgroup2.devices.allow` and `lxc.mount.entry` to support Tailscale in privileged container. + +--- + +## Access Methods + +### SSH Access + +```bash +# Local network (static IP) +ssh zvx@192.168.1.103 + +# Tailscale VPN +ssh zvx@100.64.0.25 +ssh zvx@argus + +# With password (for sshpass workflows) +sshpass -p '7redditGold' ssh zvx@192.168.1.103 +``` + +**Credentials:** +- User: `zvx` +- Password: `7redditGold` +- Sudo: Enabled (no password prompt) + +### From Proxmox Host + +```bash +# Execute commands in container +pct exec 103 -- + +# Enter container shell +pct enter 103 + +# Container management +pct start 103 +pct stop 103 +pct reboot 103 +pct status 103 +``` + +--- + +## ARGUS Application Architecture (Planned) + +### Geographic Scope Hierarchy + +| Scope | Description | Update Frequency | +|-------|-------------|------------------| +| LOCAL | Idaho, immediate region | High | +| REGIONAL | Pacific Northwest, neighboring states | Medium | +| NATIONAL | US-wide threats, policy changes | Medium | +| GLOBAL | International, geopolitical | Low | + +### Data Storage + +- **Raw search results:** `data/raw/{scope}/{date}/` +- **Processed intel:** `data/processed/{scope}/` +- **Alerts:** `data/alerts/` +- **Timestamps:** All in UTC + +### Privacy Rules + +- No PII collection on individuals +- Focus on events, trends, policies — not people +- Scrub any inadvertent PII before storage +- Logs must not contain search queries with personal info + +### LLM Analysis + +- **Model hosting:** Local only (no cloud APIs) +- **Functions:** Summarization, threat classification, entity extraction, sentiment/threat scoring +- **Entities:** Locations, organizations (not individuals) + +--- + +## Provisioning History + +**2026-06-14 03:00 UTC** - Initial provisioning + +1. **First attempt (unprivileged):** Failed - tailscaled couldn't access /dev/net/tun +2. **Second attempt (privileged):** Success + - Created CT 103 with `--unprivileged 0` + - Installed baseline (apt update/upgrade, common tools, Docker, Tailscale) + - DNS fix required post-restart (resolv.conf reset to 100.100.100.100) + - Added DNS bootstrap systemd drop-in to prevent future DNS failures + - Configured static IP 192.168.1.103 (originally got .142 via DHCP) + - Added TUN device support via lxc.cgroup2 and lxc.mount.entry + +**Headscale registration:** +- Created preauth key via `docker exec headscale headscale preauthkeys create --user 1 --expiration 24h --reusable` +- Registered successfully after DNS fix +- Assigned Tailscale IP: 100.64.0.25 + +--- + +## Verification Checklist + +Run inside container to verify baseline: + +```bash +pct exec 103 -- bash -c ' +echo "=== CT Provisioning Check ===" +echo "" +echo "Hostname: $(hostname)" +echo "User zvx: $(id zvx 2>/dev/null && echo OK || echo MISSING)" +echo "sudo: $(sudo -l -U zvx 2>/dev/null | grep -q ALL && echo OK || echo MISSING)" +echo "sshpass: $(which sshpass >/dev/null 2>&1 && echo OK || echo MISSING)" +echo "SSH: $(systemctl is-active ssh)" +echo "Docker: $(docker --version 2>/dev/null || echo MISSING)" +echo "Tailscale: $(tailscale status --self 2>/dev/null | head -1 || echo NOT CONNECTED)" +echo "Tailscale IP: $(tailscale ip -4 2>/dev/null || echo N/A)" +echo "Local IP: $(hostname -I | awk \"{print \$1}\")" +' +``` + +**Expected output:** +``` +=== CT Provisioning Check === + +Hostname: argus +User zvx: uid=1000(zvx) gid=1000(zvx) groups=1000(zvx),27(sudo),990(docker) OK +sudo: OK +sshpass: OK +SSH: active +Docker: Docker version 29.5.3, build d1c06ef +Tailscale: 100.64.0.25 argus echo6 linux - +Tailscale IP: 100.64.0.25 +Local IP: 192.168.1.103 +``` + +--- + +## Known Issues & Resolutions + +### Issue: DNS resolution fails after container restart + +**Symptom:** `resolv.conf` gets reset to invalid nameserver (100.100.100.100), breaking apt and network connectivity. + +**Root cause:** LXC containers sometimes reset DNS on boot before networking is fully initialized. + +**Resolution:** Installed systemd drop-in (`/etc/systemd/system/tailscaled.service.d/dns-bootstrap.conf`) that sets fallback DNS before tailscaled starts. Prevents chicken-and-egg failure where Tailscale can't resolve vpn.echo6.co because DNS is broken. + +### Issue: Tailscaled fails with "/dev/net/tun does not exist" + +**Symptom:** Tailscaled crashes on startup with `CreateTUN("tailscale0") failed; /dev/net/tun does not exist`. + +**Root cause:** Unprivileged LXC containers don't have access to /dev/net/tun by default. + +**Resolution:** Recreated container as privileged (`--unprivileged 0`) and added TUN device to container config: +``` +lxc.cgroup2.devices.allow: c 10:200 rwm +lxc.mount.entry: /dev/net dev/net none bind,create=dir +``` + +--- + +## Next Steps (Application Deployment) + +1. **SearXNG deployment:** Docker container for self-hosted search aggregation +2. **LLM integration:** Local model for analysis (Ollama on cortex or self-hosted) +3. **Database:** SQLite for processed intel, possibly Qdrant for vector search (cortex:6333 available) +4. **Scheduler:** Cron or systemd timers for automated collection +5. **Web dashboard:** Flask/FastAPI for threat intel visualization +6. **Alerting:** Integration with Matrix/email for high-priority threats + +--- + +## Operational Notes + +- **Backup strategy:** TBD (Docker volumes + application data) +- **Log rotation:** TBD +- **Monitoring:** TBD (consider adding to WATCHTOWER ops dashboard) +- **Updates:** Standard Ubuntu + Docker update procedures +- **Resource scaling:** Can adjust cores/RAM via `pct set 103 -cores X -memory Y` (requires container restart) + +--- + +## Related Documentation + +- **CT provisioning:** `/home/zvx/projects/.ref/runbooks/ct-runbook.md` +- **ARGUS rules:** `~/.claude/rules/argus.md` +- **Environment:** `/home/zvx/projects/.ref/docs/hardware/environment.md` +- **Services:** `/home/zvx/projects/.ref/docs/services/services.md` +- **Headscale:** `/home/zvx/projects/.ref/docs/software/caddy.md` (dnsmasq split DNS) + +--- + +## Quick Command Reference + +```bash +# Container management (from Proxmox host) +pct start 103 +pct stop 103 +pct reboot 103 +pct enter 103 + +# SSH access +ssh zvx@192.168.1.103 +ssh zvx@argus # via Tailscale DNS + +# Check Tailscale status +pct exec 103 -- tailscale status +pct exec 103 -- tailscale ip -4 + +# Docker commands (as zvx user) +ssh zvx@argus "docker ps" +ssh zvx@argus "docker compose up -d" + +# View container config +cat /etc/pve/lxc/103.conf + +# Check resource usage +pct status 103 --verbose +``` + +--- + +**Provisioned by:** Claude Code +**Container ready for:** ARGUS application deployment diff --git a/docs/hardware/environment.md b/docs/hardware/environment.md index 39a7947..78c4f7c 100644 --- a/docs/hardware/environment.md +++ b/docs/hardware/environment.md @@ -101,6 +101,7 @@ Five nodes running Proxmox VE: | mesh-bridge | utility (CT 107) | 192.168.1.107 | 100.64.0.22 | Dual-tailscaled bridge (echo6 ↔ idahomesh) | | meshai | utility (CT 108) | 192.168.1.144 | 100.64.0.32 | MeshAI - LLM-powered Meshtastic assistant | | archivist | utility (CT 118) | 192.168.1.118 | — | Archivist knowledge pipeline | +| argus | utility (CT 103) | 192.168.1.103 | 100.64.0.25 | ARGUS - OSINT intelligence gathering platform | | peertube | media (CT 110) | 192.168.1.170 | 100.64.0.23 | PeerTube video streaming | ## IP Allocation Scheme @@ -118,7 +119,7 @@ Full details: `/home/zvx/projects/utility/ip-allocation.md` ## Headscale Node List -Current registered nodes (24 total): +Current registered nodes (25 total): | Node | Tailscale IP | Type | |------|-------------|------| @@ -142,6 +143,7 @@ Current registered nodes (24 total): | mesh-bridge | 100.64.0.22 | LXC | | peertube | 100.64.0.23 | LXC | | recon | 100.64.0.24 | VM | +| argus | 100.64.0.25 | LXC | | meshmonitor-dev | 100.64.0.27 | LXC | | gl-a1300 | 100.64.0.29 | Router | | bluefin | 100.64.0.30 | Desktop | diff --git a/docs/services/services.md b/docs/services/services.md index 7d15a0c..5ddbc60 100644 --- a/docs/services/services.md +++ b/docs/services/services.md @@ -13,6 +13,7 @@ | IdahoMesh Headscale | utility (CT 106) | 192.168.1.106:8080 | https://vpn.idahomesh.com | Meshtastic mesh VPN coordination | | mesh-bridge | utility (CT 107) | 192.168.1.107 | Internal | Dual-tailscaled bridge (echo6 ↔ idahomesh) | | MeshAI | utility (CT 108) | 192.168.1.144:4403 | Internal | LLM-powered Meshtastic assistant (Docker, Gemini Flash, Google grounding) | +| ARGUS | utility (CT 103) | 192.168.1.103 | Internal | OSINT intelligence gathering platform (Docker, SearXNG + local LLM analysis) | | Authentik | Contabo | 5.189.158.149:9000 | https://auth.echo6.co | SSO provider (Echo6 branded, custom CSS, dark theme) | | Forge | Contabo | 5.189.158.149 | https://forge.echo6.co | Git server | | Headscale | Contabo | 5.189.158.149 | https://vpn.echo6.co | Tailscale coordination (OIDC enabled) |