--- title: ARGUS - OSINT Intelligence Platform type: project tags: - recon aliases: [] related: - [[headscale-onboard-node]] - [[ip-allocation]] - [[caddy]] - [[ct-runbook]] - [[services]] updated: 2026-07-13 --- # ARGUS - OSINT Intelligence Platform **Status:** Container provisioned, baseline installed, awaiting application [[deployment]] **Last Updated:** 2026-06-14 --- ## Overview ARGUS (Automated Reconnaissance & Gathering for Unified Situational-awareness) is an OSINT intelligence gathering platform combining [[searxng]] with local LLM analysis for automated threat intelligence collection and processing. **Architecture:** - Search backend: [[searxng]] (self-hosted) - Analysis: Local LLM models (no cloud APIs) - Scopes: Local, regional, national, global threat levels - Privacy-first: No PII collection, focus on events/trends/policies --- ## Container Specifications | Property | Value | |----------|-------| | **CTID** | 103 | | **Hostname** | argus | | **Host** | Utility (192.168.1.241 / 100.64.0.5) | | **Local IP** | 192.168.1.103 (static) | | **Tailscale IP** | 100.64.0.25 | | **Gateway** | 192.168.1.1 | | **Container Type** | Privileged (unprivileged=0) | | **Resources** | 4 cores, 8GB RAM, 30GB disk | | **Storage** | local-lvm:vm-103-disk-0 | | **Network** | vmbr0, eth0 | | **Features** | nesting=1 (Docker support) | | **Autostart** | Yes (onboot=1) | | **OS** | Ubuntu 24.04 LTS | **Why privileged:** Required for /dev/net/tun access (Tailscale). Attempted unprivileged initially but tailscaled failed with "CreateTUN failed; /dev/net/tun does not exist". --- ## Installed Software (Baseline) - **Docker:** 29.5.3 + docker-compose plugin - **Tailscale:** 1.98.4 (registered with Headscale at vpn.echo6.co) - **User:** zvx (uid=1000, groups: sudo, docker) - **Common tools:** curl, wget, vim, htop, git, jq, net-tools, dnsutils, sshpass - **SSH:** OpenSSH server (password auth enabled) --- ## Tailscale Configuration **Headscale server:** https://vpn.echo6.co **User:** echo6 (user ID 1) **Tailscale IP:** 100.64.0.25 **Registration:** `tailscale up --login-server=https://vpn.echo6.co --authkey= --ssh --accept-routes` **[[dns]] Bootstrap Fix:** Systemd drop-in at `/etc/systemd/system/tailscaled.service.d/dns-bootstrap.conf` ensures fallback [[dns]] (1.1.1.1, 8.8.8.8) exists before tailscaled starts, preventing chicken-and-egg [[dns]] resolution failures on reboot. ```bash [Service] # Ensure fallback DNS exists before tailscaled starts # Prevents chicken-and-egg DNS resolution failures on reboot ExecStartPre=/bin/sh -c "echo nameserver 1.1.1.1 > /etc/resolv.conf; echo nameserver 8.8.8.8 >> /etc/resolv.conf" ``` --- ## Network Configuration **Static IP:** Configured via Proxmox (`pct set 103 -net0 name=eth0,bridge=vmbr0,ip=192.168.1.103/24,gw=192.168.1.1`) **Container config** (`/etc/pve/lxc/103.conf`): ``` arch: amd64 cores: 4 features: nesting=1 hostname: argus memory: 8192 net0: name=eth0,bridge=vmbr0,hwaddr=BC:24:11:EA:8B:21,ip=192.168.1.103/24,gw=192.168.1.1,type=veth onboot: 1 ostype: ubuntu rootfs: local-lvm:vm-103-disk-0,size=30G swap: 512 lxc.cgroup2.devices.allow: c 10:200 rwm lxc.mount.entry: /dev/net dev/net none bind,create=dir ``` **TUN device:** Added manually via `lxc.cgroup2.devices.allow` and `lxc.mount.entry` to support Tailscale in privileged container. --- ## Access Methods ### SSH Access ```bash # Local network (static IP) ssh zvx@192.168.1.103 # Tailscale VPN ssh zvx@100.64.0.25 ssh zvx@argus # With password (for sshpass workflows) sshpass -p '7redditGold' ssh zvx@192.168.1.103 ``` **Credentials:** - User: `zvx` - Password: `7redditGold` - Sudo: Enabled (no password prompt) ### From Proxmox Host ```bash # Execute commands in container pct exec 103 -- # Enter container shell pct enter 103 # Container management pct start 103 pct stop 103 pct reboot 103 pct status 103 ``` --- ## ARGUS Application Architecture (Planned) ### Geographic Scope Hierarchy | Scope | Description | Update Frequency | |-------|-------------|------------------| | LOCAL | Idaho, immediate region | High | | REGIONAL | Pacific Northwest, neighboring states | Medium | | NATIONAL | US-wide threats, policy changes | Medium | | GLOBAL | International, geopolitical | Low | ### Data Storage - **Raw search results:** `data/raw/{scope}/{date}/` - **Processed intel:** `data/processed/{scope}/` - **Alerts:** `data/alerts/` - **Timestamps:** All in UTC ### Privacy Rules - No PII collection on individuals - Focus on events, trends, policies — not people - Scrub any inadvertent PII before storage - Logs must not contain search queries with personal info ### LLM Analysis - **Model hosting:** Local only (no cloud APIs) - **Functions:** Summarization, threat classification, entity extraction, sentiment/threat scoring - **Entities:** Locations, organizations (not individuals) --- ## Provisioning History **2026-06-14 03:00 UTC** - Initial provisioning 1. **First attempt (unprivileged):** Failed - tailscaled couldn't access /dev/net/tun 2. **Second attempt (privileged):** Success - Created CT 103 with `--unprivileged 0` - Installed baseline (apt update/upgrade, common tools, Docker, Tailscale) - DNS fix required post-restart (resolv.conf reset to 100.100.100.100) - Added DNS bootstrap systemd drop-in to prevent future DNS failures - Configured static IP 192.168.1.103 (originally got .142 via DHCP) - Added TUN device support via lxc.cgroup2 and lxc.mount.entry **Headscale registration:** - Created preauth key via `docker exec headscale headscale preauthkeys create --user 1 --expiration 24h --reusable` - Registered successfully after DNS fix - Assigned Tailscale IP: 100.64.0.25 --- ## Verification Checklist Run inside container to verify baseline: ```bash pct exec 103 -- bash -c ' echo "=== CT Provisioning Check ===" echo "" echo "Hostname: $(hostname)" echo "User zvx: $(id zvx 2>/dev/null && echo OK || echo MISSING)" echo "sudo: $(sudo -l -U zvx 2>/dev/null | grep -q ALL && echo OK || echo MISSING)" echo "sshpass: $(which sshpass >/dev/null 2>&1 && echo OK || echo MISSING)" echo "SSH: $(systemctl is-active ssh)" echo "Docker: $(docker --version 2>/dev/null || echo MISSING)" echo "Tailscale: $(tailscale status --self 2>/dev/null | head -1 || echo NOT CONNECTED)" echo "Tailscale IP: $(tailscale ip -4 2>/dev/null || echo N/A)" echo "Local IP: $(hostname -I | awk \"{print \$1}\")" ' ``` **Expected output:** ``` === CT Provisioning Check === Hostname: argus User zvx: uid=1000(zvx) gid=1000(zvx) groups=1000(zvx),27(sudo),990(docker) OK sudo: OK sshpass: OK SSH: active Docker: Docker version 29.5.3, build d1c06ef Tailscale: 100.64.0.25 argus echo6 linux - Tailscale IP: 100.64.0.25 Local IP: 192.168.1.103 ``` --- ## Known Issues & Resolutions ### Issue: DNS resolution fails after container restart **Symptom:** `resolv.conf` gets reset to invalid nameserver (100.100.100.100), breaking apt and network connectivity. **Root cause:** LXC containers sometimes reset DNS on boot before networking is fully initialized. **Resolution:** Installed systemd drop-in (`/etc/systemd/system/tailscaled.service.d/dns-bootstrap.conf`) that sets fallback DNS before tailscaled starts. Prevents chicken-and-egg failure where Tailscale can't resolve vpn.echo6.co because DNS is broken. ### Issue: Tailscaled fails with "/dev/net/tun does not exist" **Symptom:** Tailscaled crashes on startup with `CreateTUN("tailscale0") failed; /dev/net/tun does not exist`. **Root cause:** Unprivileged LXC containers don't have access to /dev/net/tun by default. **Resolution:** Recreated container as privileged (`--unprivileged 0`) and added TUN device to container config: ``` lxc.cgroup2.devices.allow: c 10:200 rwm lxc.mount.entry: /dev/net dev/net none bind,create=dir ``` --- ## Next Steps (Application Deployment) 1. **[[searxng]] [[deployment]]:** Docker container for self-hosted search aggregation 2. **LLM integration:** Local model for analysis (Ollama on cortex or self-hosted) 3. **Database:** SQLite for processed intel, possibly Qdrant for vector search (cortex:6333 available) 4. **Scheduler:** Cron or systemd timers for automated collection 5. **Web dashboard:** Flask/FastAPI for threat intel visualization 6. **Alerting:** Integration with Matrix/email for high-priority threats --- ## Operational Notes - **Backup strategy:** TBD (Docker volumes + application data) - **Log rotation:** TBD - **Monitoring:** TBD (consider adding to WATCHTOWER ops dashboard) - **Updates:** Standard Ubuntu + Docker update procedures - **Resource scaling:** Can adjust cores/RAM via `pct set 103 -cores X -memory Y` (requires container restart) --- ## Related Documentation - **CT provisioning:** `/home/zvx/projects/.ref/runbooks/ct-runbook.md` - **ARGUS rules:** `~/.claude/rules/argus.md` - **[[environment]]:** `/home/zvx/projects/.ref/docs/hardware/environment.md` - **[[services]]:** `/home/zvx/projects/.ref/docs/services/services.md` - **Headscale:** `/home/zvx/projects/.ref/docs/software/caddy.md` (dnsmasq split DNS) --- ## Quick Command Reference ```bash # Container management (from Proxmox host) pct start 103 pct stop 103 pct reboot 103 pct enter 103 # SSH access ssh zvx@192.168.1.103 ssh zvx@argus # via Tailscale DNS # Check Tailscale status pct exec 103 -- tailscale status pct exec 103 -- tailscale ip -4 # Docker commands (as zvx user) ssh zvx@argus "docker ps" ssh zvx@argus "docker compose up -d" # View container config cat /etc/pve/lxc/103.conf # Check resource usage pct status 103 --verbose ``` --- **Provisioned by:** Claude Code **Container ready for:** ARGUS application [[deployment]]