echo6-docs/projects/argus.md

ARGUS - OSINT Intelligence Platform

Status: Container provisioned, baseline installed, awaiting application deployment Last Updated: 2026-06-14

---

Overview

ARGUS (Automated Reconnaissance & Gathering for Unified Situational-awareness) is an OSINT intelligence gathering platform combining SearXNG with local LLM analysis for automated threat intelligence collection and processing.

Architecture:

• Search backend: SearXNG (self-hosted)
• Analysis: Local LLM models (no cloud APIs)
• Scopes: Local, regional, national, global threat levels
• Privacy-first: No PII collection, focus on events/trends/policies

---

Container Specifications

Property	Value
CTID	103
Hostname	argus
Host	utility (192.168.1.241 / 100.64.0.5)
Local IP	192.168.1.103 (static)
Tailscale IP	100.64.0.25
Gateway	192.168.1.1
Container Type	Privileged (unprivileged=0)
Resources	4 cores, 8GB RAM, 30GB disk
Storage	local-lvm:vm-103-disk-0
Network	vmbr0, eth0
Features	nesting=1 (Docker support)
Autostart	Yes (onboot=1)
OS	Ubuntu 24.04 LTS

Why privileged: Required for /dev/net/tun access (Tailscale). Attempted unprivileged initially but tailscaled failed with "CreateTUN failed; /dev/net/tun does not exist".

---

Installed Software (Baseline)

• Docker: 29.5.3 + docker-compose plugin
• Tailscale: 1.98.4 (registered with Headscale at vpn.echo6.co)
• User: zvx (uid=1000, groups: sudo, docker)
• Common tools: curl, wget, vim, htop, git, jq, net-tools, dnsutils, sshpass
• SSH: OpenSSH server (password auth enabled)

---

Tailscale Configuration

Headscale server: https://vpn.echo6.co User: echo6 (user ID 1) Tailscale IP: 100.64.0.25 Registration: tailscale up --login-server=https://vpn.echo6.co --authkey=<key> --ssh --accept-routes

DNS Bootstrap Fix: Systemd drop-in at /etc/systemd/system/tailscaled.service.d/dns-bootstrap.conf ensures fallback DNS (1.1.1.1, 8.8.8.8) exists before tailscaled starts, preventing chicken-and-egg DNS resolution failures on reboot.

[Service]
# Ensure fallback DNS exists before tailscaled starts
# Prevents chicken-and-egg DNS resolution failures on reboot
ExecStartPre=/bin/sh -c "echo nameserver 1.1.1.1 > /etc/resolv.conf; echo nameserver 8.8.8.8 >> /etc/resolv.conf"

---

Network Configuration

Static IP: Configured via Proxmox (pct set 103 -net0 name=eth0,bridge=vmbr0,ip=192.168.1.103/24,gw=192.168.1.1)

Container config (/etc/pve/lxc/103.conf):

arch: amd64
cores: 4
features: nesting=1
hostname: argus
memory: 8192
net0: name=eth0,bridge=vmbr0,hwaddr=BC:24:11:EA:8B:21,ip=192.168.1.103/24,gw=192.168.1.1,type=veth
onboot: 1
ostype: ubuntu
rootfs: local-lvm:vm-103-disk-0,size=30G
swap: 512
lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net dev/net none bind,create=dir

TUN device: Added manually via lxc.cgroup2.devices.allow and lxc.mount.entry to support Tailscale in privileged container.

---

Access Methods

SSH Access

# Local network (static IP)
ssh zvx@192.168.1.103

# Tailscale VPN
ssh zvx@100.64.0.25
ssh zvx@argus

# With password (for sshpass workflows)
sshpass -p '7redditGold' ssh zvx@192.168.1.103

Credentials:

• User: zvx
• Password: 7redditGold
• Sudo: Enabled (no password prompt)

From Proxmox Host

# Execute commands in container
pct exec 103 -- <command>

# Enter container shell
pct enter 103

# Container management
pct start 103
pct stop 103
pct reboot 103
pct status 103

---

ARGUS Application Architecture (Planned)

Geographic Scope Hierarchy

Scope	Description	Update Frequency
LOCAL	Idaho, immediate region	High
REGIONAL	Pacific Northwest, neighboring states	Medium
NATIONAL	US-wide threats, policy changes	Medium
GLOBAL	International, geopolitical	Low

Data Storage

• Raw search results: data/raw/{scope}/{date}/
• Processed intel: data/processed/{scope}/
• Alerts: data/alerts/
• Timestamps: All in UTC

Privacy Rules

• No PII collection on individuals
• Focus on events, trends, policies — not people
• Scrub any inadvertent PII before storage
• Logs must not contain search queries with personal info

LLM Analysis

• Model hosting: Local only (no cloud APIs)
• Functions: Summarization, threat classification, entity extraction, sentiment/threat scoring
• Entities: Locations, organizations (not individuals)

---

Provisioning History

2026-06-14 03:00 UTC - Initial provisioning

1. First attempt (unprivileged): Failed - tailscaled couldn't access /dev/net/tun
2. Second attempt (privileged): Success
   • Created CT 103 with --unprivileged 0
   • Installed baseline (apt update/upgrade, common tools, Docker, Tailscale)
   • DNS fix required post-restart (resolv.conf reset to 100.100.100.100)
   • Added DNS bootstrap systemd drop-in to prevent future DNS failures
   • Configured static IP 192.168.1.103 (originally got .142 via DHCP)
   • Added TUN device support via lxc.cgroup2 and lxc.mount.entry

Headscale registration:

• Created preauth key via docker exec headscale headscale preauthkeys create --user 1 --expiration 24h --reusable
• Registered successfully after DNS fix
• Assigned Tailscale IP: 100.64.0.25

---

Verification Checklist

Run inside container to verify baseline:

pct exec 103 -- bash -c '
echo "=== CT Provisioning Check ==="
echo ""
echo "Hostname:     $(hostname)"
echo "User zvx:     $(id zvx 2>/dev/null && echo OK || echo MISSING)"
echo "sudo:         $(sudo -l -U zvx 2>/dev/null | grep -q ALL && echo OK || echo MISSING)"
echo "sshpass:      $(which sshpass >/dev/null 2>&1 && echo OK || echo MISSING)"
echo "SSH:          $(systemctl is-active ssh)"
echo "Docker:       $(docker --version 2>/dev/null || echo MISSING)"
echo "Tailscale:    $(tailscale status --self 2>/dev/null | head -1 || echo NOT CONNECTED)"
echo "Tailscale IP: $(tailscale ip -4 2>/dev/null || echo N/A)"
echo "Local IP:     $(hostname -I | awk \"{print \$1}\")"
'

Expected output:

=== CT Provisioning Check ===

Hostname:     argus
User zvx:     uid=1000(zvx) gid=1000(zvx) groups=1000(zvx),27(sudo),990(docker) OK
sudo:         OK
sshpass:      OK
SSH:          active
Docker:       Docker version 29.5.3, build d1c06ef
Tailscale:    100.64.0.25  argus              echo6  linux    -
Tailscale IP: 100.64.0.25
Local IP:     192.168.1.103

---

Known Issues & Resolutions

Issue: DNS resolution fails after container restart

Symptom: resolv.conf gets reset to invalid nameserver (100.100.100.100), breaking apt and network connectivity.

Root cause: LXC containers sometimes reset DNS on boot before networking is fully initialized.

Resolution: Installed systemd drop-in (/etc/systemd/system/tailscaled.service.d/dns-bootstrap.conf) that sets fallback DNS before tailscaled starts. Prevents chicken-and-egg failure where Tailscale can't resolve vpn.echo6.co because DNS is broken.

Issue: Tailscaled fails with "/dev/net/tun does not exist"

Symptom: Tailscaled crashes on startup with CreateTUN("tailscale0") failed; /dev/net/tun does not exist.

Root cause: Unprivileged LXC containers don't have access to /dev/net/tun by default.

Resolution: Recreated container as privileged (--unprivileged 0) and added TUN device to container config:

lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net dev/net none bind,create=dir

---

Next Steps (Application Deployment)

1. SearXNG deployment: Docker container for self-hosted search aggregation
2. LLM integration: Local model for analysis (Ollama on cortex or self-hosted)
3. Database: SQLite for processed intel, possibly Qdrant for vector search (cortex:6333 available)
4. Scheduler: Cron or systemd timers for automated collection
5. Web dashboard: Flask/FastAPI for threat intel visualization
6. Alerting: Integration with Matrix/email for high-priority threats

---

Operational Notes

• Backup strategy: TBD (Docker volumes + application data)
• Log rotation: TBD
• Monitoring: TBD (consider adding to WATCHTOWER ops dashboard)
• Updates: Standard Ubuntu + Docker update procedures
• Resource scaling: Can adjust cores/RAM via pct set 103 -cores X -memory Y (requires container restart)

---

Related Documentation

• CT provisioning: /home/zvx/projects/.ref/runbooks/ct-runbook.md
• ARGUS rules: ~/.claude/rules/argus.md
• Environment: /home/zvx/projects/.ref/docs/hardware/environment.md
• Services: /home/zvx/projects/.ref/docs/services/services.md
• Headscale: /home/zvx/projects/.ref/docs/software/caddy.md (dnsmasq split DNS)

---

Quick Command Reference

# Container management (from Proxmox host)
pct start 103
pct stop 103
pct reboot 103
pct enter 103

# SSH access
ssh zvx@192.168.1.103
ssh zvx@argus  # via Tailscale DNS

# Check Tailscale status
pct exec 103 -- tailscale status
pct exec 103 -- tailscale ip -4

# Docker commands (as zvx user)
ssh zvx@argus "docker ps"
ssh zvx@argus "docker compose up -d"

# View container config
cat /etc/pve/lxc/103.conf

# Check resource usage
pct status 103 --verbose

---

Provisioned by: Claude Code Container ready for: ARGUS application deployment