Security Audit Report

🛡️

Public Attack Surface: 100% Shielded SECURE

All 34 listening ports are strictly isolated by Docker iptables, Tailscale mesh, or localhost. 0 ports exposed directly to public internet.

🛑

Intrusion Shield & UFW Filter ACTIVE

Fail2ban active; 33,427 malicious automated reconnaissance probes dropped by UFW in the past 24 hours.

🔑

SSH Access & Identity Control 0 FAILURES

766 authorized Tailscale sessions authenticated in 24h. No brute-force anomalies detected.

🐳

Docker Workload Hardening ISOLATED

10 production containers active. Docker daemon TCP socket (2375/2376) is strictly restricted from external networks.

☁️

Cloudflare Zero Trust Ingress ONLINE

4 HA tunnel connections active (4 edge nodes); 0 exploit probes intercepted at Cloudflare edge in 7 days.

⚡

Host System Vitals STABLE

RAM 7% (2.0Gi/30Gi) • Load Avg: 4.90 • Disk: 70G/473G (16% used) • up 5 weeks, 22 hours, 11 minutes

Security Posture

SECURE

All controls active

Exposed Ports

34 monitored & shielded

UFW Blocks (24h)

33,427

Dropped scanning probes

SSH Failed (24h)

766 authorized logins

Containers

Docker daemon isolated

Tailscale Mesh

10 / 19

Encrypted mesh peers

CF Tunnel

ONLINE

HA edge nodes active

RAM / Load

7% / 4.90

Disk: 70G/473G

📡

Network Attack Surface & Listening Ports

34 Ports Monitored

✔

ufw-docker is ACTIVE: Docker bridge ports bound to 0.0.0.0 are intercepted by iptables DOCKER-USER chain and blocked from external ingress.

Listening Address	Service / Process	Security Classification
`127.0.0.1:37331`	agy-bin	Loopback 127.0.0.1
`127.0.0.1:6012`	cloudflared	Loopback 127.0.0.1
`100.80.139.9:22`	sshd	Tailscale Mesh
`10.0.0.1:22`	sshd	Private Network
`100.80.139.9:36486`	tailscaled	Tailscale Mesh
`127.0.0.1:40695`	agy-bin	Loopback 127.0.0.1
`127.0.0.1:24543`	moshi-hook	Loopback 127.0.0.1
`100.80.139.9:18443`	tailscaled	Tailscale Mesh
`127.0.0.1:22`	sshd	Loopback 127.0.0.1
`127.0.0.1:33177`	agy-bin	Loopback 127.0.0.1
`127.0.0.1:34315`	agy-bin	Loopback 127.0.0.1
`127.0.0.1:34513`	agy-bin	Loopback 127.0.0.1
`127.0.0.1:34115`	agy-bin	Loopback 127.0.0.1
`127.0.0.53%lo:53`	systemd-resolve	Loopback 127.0.0.1
`127.0.0.54:53`	systemd-resolve	Loopback 127.0.0.1
`0.0.0.0:8080`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`0.0.0.0:8000`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`100.80.139.9:8443`	tailscaled	Tailscale Mesh
`100.80.139.9:8317`	cli-proxy-api	Tailscale Mesh
`0.0.0.0:6001`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`0.0.0.0:6002`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`10.0.1.1:22`	sshd	Private Network
`0.0.0.0:443`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`0.0.0.0:80`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`[fd7a:115c:a1e0::533b:8b09]:8443`	tailscaled	Tailscale Mesh
`[fd7a:115c:a1e0::533b:8b09]:43591`	tailscaled	Tailscale Mesh
`[::]:8080`	docker-proxy	Docker Internal Bridge
`[::]:8000`	docker-proxy	Docker Internal Bridge
`[::]:6001`	docker-proxy	Docker Internal Bridge
`[::]:6002`	docker-proxy	Docker Internal Bridge
`[fd7a:115c:a1e0::533b:8b09]:22`	sshd	Tailscale Mesh
`[::]:443`	docker-proxy	Docker Internal Bridge
`[::]:80`	docker-proxy	Docker Internal Bridge
`[fd7a:115c:a1e0::533b:8b09]:18443`	tailscaled	Tailscale Mesh

🔐

SSH Authentication & Access Audit

0 Failures 766 Sessions

No Tailscale SSH sessions recorded in audit period.

⚙️

System Workload & Process Monitor

Top Consumers

⚠

High CPU (>50%):

User	PID	CPU	Command
9999	`987629`	300%	`/usr/local/bin/php`
9999	`987586`	117%	`/usr/local/bin/php`
9999	`987557`	109%	`/usr/local/bin/php`

✔

Memory Allocation Stable: No individual processes exceeding memory bounds.

☁️

Cloudflare Zero Trust Ingress Tunnel

0 Domains Routed

HA Tunnels

Edge Nodes

1692

Errors

Sessions

Active Edge PoPs: sin02, sin11, sin20, sin21

Ingress Hostname	Routing Security

✔

Zero Cloudflare Attack Anomalies: No exploit patterns detected in 7-day logs.

🛡️

UFW Threat Intelligence & Inbound Attacks (24h)

33,427 Intercepted Probes

Top Attacking Source IPs

2366 2001
   1553 2
   1453 10.0.1.9
    720 79.124.62.134
    709 79.124.62.230
    661 77.239.124.253
    533 79.124.62.126
    305 2604
    257 137.220.152.247
    182 142.93.183.218

Top Targeted Ports

🐳

Docker Container Fleet

10 Active Containers

✔

Docker Daemon Isolated: TCP socket (2375/2376) is not exposed to any network.

Container Name	Runtime Status	Port Mappings
coolify	Up 2 weeks (healthy)	`8000/tcp, 8443/tcp, 9000/tcp, 0.0.0.0:8000->8080/tcp, [::]:8000->8080/tcp`
coolify-db	Up 2 weeks (healthy)	`5432/tcp`
coolify-redis	Up 2 weeks (healthy)	`6379/tcp`
coolify-realtime	Up 2 weeks (healthy)	`0.0.0.0:6001-6002->6001-6002/tcp, [::]:6001-6002->6001-6002/tcp`
coolify-proxy	Up 2 weeks (healthy)	`0.0.0.0:80->80/tcp, [::]:80->80/tcp, 0.0.0.0:443->443/tcp, [::]:443->443/tcp, 0.0.0.0:8080->8080/tcp, [::]:8080->8080/tcp, 0.0.0.0:443->443/udp, [::]:443->443/udp`
so13t9jiakgbyzwp863dmvzu-103035573499	Up 2 weeks	`3000/tcp`
lijg3ncf0yp8on32jagmeg0y	Up 2 weeks (healthy)	`5432/tcp`
lkn2msiqhoymcuyaa64cnazj-065012572847	Up 2 weeks	`3000/tcp`
ithh2dbx1jyjl6dejr3mre1k	Up 2 weeks (healthy)	`5432/tcp`
enthri8p43s4atofatobcunp-232449789422	Up 2 weeks	`3000/tcp`

🌐

Tailscale Encrypted Mesh Network

10 / 19 Peers Online

Node Name	Tailscale IP	OS Platform	Status
ssdnode THIS MACHINE	`100.80.139.9`	linux	Online
appletv	`100.108.161.6`	tvOS	Online
box	`100.86.226.66`	linux	Online
contabo	`100.111.135.6`	linux	Online
glkvm	`100.123.198.85`	linux	Online
hkrouter	`100.66.31.7`	linux	Online
ipad13tv	`100.117.146.121`	iOS	Online
ipadpro	`100.65.224.43`	iOS	Online
iphoneair	`100.95.106.126`	iOS	Online
kitai	`100.97.4.90`	linux	Online
tencent	`100.109.227.19`	linux	Online
iphone-14-pro-max	`100.92.136.103`	iOS	Offline
kit	`100.66.166.71`	macOS	Offline
kitlegiongo	`100.67.231.89`	windows	Offline
kitmbp16	`100.123.239.87`	macOS	Offline
kits-macbook-air	`100.127.101.27`	macOS	Offline
macbookair-linux	`100.65.0.96`	linux	Offline
mobilerouter	`100.127.101.21`	linux	Offline
node	`100.97.174.121`	iOS	Offline
virtualkit	`100.88.89.61`	macOS	Offline

🧱

Firewall Access Control Policy (UFW • 12 Active Rules)

Policy Enforced ↓

Rule / Protocol	Action	Interface	Source Match	Rule Note
`41641/udp`	ALLOW	—	`Anywhere`
`22/tcp`	ALLOW	tailscale0	`Anywhere`	SSH via Tailscale only
`Anywhere`	ALLOW	tailscale0	`Anywhere`
`60000:61000/udp`	ALLOW	tailscale0	`Anywhere`	Mosh via Tailscale
`22/tcp`	ALLOW	docker0	`Anywhere`
`41642/udp`	ALLOW	—	`Anywhere`	Tailscale peer relay
`41641/udp (v6)`	ALLOW	—	`Anywhere (v6)`
`22/tcp (v6)`	ALLOW	tailscale0	`Anywhere (v6)`	SSH via Tailscale only
`Anywhere (v6)`	ALLOW	tailscale0	`Anywhere (v6)`
`60000:61000/udp (v6)`	ALLOW	tailscale0	`Anywhere (v6)`	Mosh via Tailscale
`22/tcp (v6)`	ALLOW	docker0	`Anywhere (v6)`
`41642/udp (v6)`	ALLOW	—	`Anywhere (v6)`	Tailscale peer relay

🗄️

Historical Security Audit Archives

114 Reports Preserved