Security Operations Center

🛡️

Public Attack Surface: 100% Shielded SECURE

All 30 listening ports are strictly isolated by Docker iptables, Tailscale mesh, or localhost. 0 ports exposed directly to public internet.

🛑

Intrusion Shield & UFW Filter ACTIVE

Fail2ban active; 18,120 malicious automated reconnaissance probes dropped by UFW in the past 24 hours.

🔑

SSH Access & Identity Control 0 FAILURES

1,681 authorized Tailscale sessions authenticated in 24h. No brute-force anomalies detected.

🐳

Docker Workload Hardening ISOLATED

10 production containers active. Docker daemon TCP socket (2375/2376) is strictly restricted from external networks.

☁️

Cloudflare Zero Trust Ingress ONLINE

4 HA tunnel connections active (3 edge nodes); 61 exploit probes intercepted at Cloudflare edge in 7 days.

⚡

Host System Vitals STABLE

RAM 7% (2.0Gi/30Gi) • Load Avg: 8.39 • Disk: 62G/473G (14% used) • up 2 weeks, 4 days, 22 hours, 56 minutes

Security Posture

SECURE

All controls active

Exposed Ports

30 monitored & shielded

UFW Blocks (24h)

18,120

Dropped scanning probes

SSH Failed (24h)

1,681 authorized logins

Containers

Docker daemon isolated

Tailscale Mesh

11 / 18

Encrypted mesh peers

CF Tunnel

ONLINE

HA edge nodes active

RAM / Load

7% / 8.39

Disk: 62G/473G

📡

Network Attack Surface & Listening Ports

30 Ports Monitored

✔

ufw-docker is ACTIVE: Docker bridge ports bound to 0.0.0.0 are intercepted by iptables DOCKER-USER chain and blocked from external ingress.

Listening Address	Service / Process	Security Classification
`127.0.0.1:6012`	cloudflared	Loopback 127.0.0.1
`100.80.139.9:22`	sshd	Tailscale Mesh
`10.0.0.1:22`	sshd	Private Network
`127.0.0.1:39681`	agy-bin	Loopback 127.0.0.1
`100.80.139.9:36486`	tailscaled	Tailscale Mesh
`127.0.0.1:24543`	moshi-hook	Loopback 127.0.0.1
`100.80.139.9:18443`	tailscaled	Tailscale Mesh
`127.0.0.1:22`	sshd	Loopback 127.0.0.1
`127.0.0.53%lo:53`	systemd-resolve	Loopback 127.0.0.1
`127.0.0.1:34893`	agy-bin	Loopback 127.0.0.1
`127.0.0.54:53`	systemd-resolve	Loopback 127.0.0.1
`0.0.0.0:8080`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`0.0.0.0:8000`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`100.80.139.9:8443`	tailscaled	Tailscale Mesh
`100.80.139.9:8317`	cli-proxy-api	Tailscale Mesh
`0.0.0.0:6001`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`0.0.0.0:6002`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`10.0.1.1:22`	sshd	Private Network
`0.0.0.0:443`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`0.0.0.0:80`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`[fd7a:115c:a1e0::533b:8b09]:8443`	tailscaled	Tailscale Mesh
`[fd7a:115c:a1e0::533b:8b09]:43591`	tailscaled	Tailscale Mesh
`[::]:8080`	docker-proxy	Docker Internal Bridge
`[::]:8000`	docker-proxy	Docker Internal Bridge
`[::]:6001`	docker-proxy	Docker Internal Bridge
`[::]:6002`	docker-proxy	Docker Internal Bridge
`[fd7a:115c:a1e0::533b:8b09]:22`	sshd	Tailscale Mesh
`[::]:443`	docker-proxy	Docker Internal Bridge
`[::]:80`	docker-proxy	Docker Internal Bridge
`[fd7a:115c:a1e0::533b:8b09]:18443`	tailscaled	Tailscale Mesh

🔐

SSH Authentication & Access Audit

0 Failures 1,681 Sessions

🔒 Tailscale SSH Sessions (Recent)

Time	Client IP	Host	Tailscale User	Source Node
09/09 05:43	`100.123.239.87`	kitmbp16	tagged-devices	kitmbp16
09/09 05:45	`100.123.239.87`	kitmbp16	tagged-devices	kitmbp16
09/09 10:01	`100.123.239.87`	kitmbp16	tagged-devices	kitmbp16
09/09 12:36	`100.123.239.87`	kitmbp16	tagged-devices	kitmbp16
09/09 12:42	`100.123.239.87`	kitmbp16	tagged-devices	kitmbp16
09/09 12:45	`100.123.239.87`	kitmbp16	tagged-devices	kitmbp16
09/09 12:58	`100.123.239.87`	kitmbp16	tagged-devices	kitmbp16
09/09 15:19	`100.123.239.87`	kitmbp16	tagged-devices	kitmbp16

🔑 External / Host SSH Sessions

Time	Client IP	Host	Port
09/07 06:19	`10.0.0.2`	10.0.0.2	`47692`
09/07 06:25	`10.0.0.2`	10.0.0.2	`53134`
09/07 06:31	`10.0.0.2`	10.0.0.2	`33110`
09/07 06:37	`10.0.0.2`	10.0.0.2	`37992`
09/07 06:43	`10.0.0.2`	10.0.0.2	`53322`
09/07 06:49	`10.0.0.2`	10.0.0.2	`59920`
09/07 06:55	`10.0.0.2`	10.0.0.2	`42722`
09/07 07:01	`10.0.0.2`	10.0.0.2	`38526`

⚙️

System Workload & Process Monitor

Top Consumers

⚠

High CPU (>50%):

User	PID	CPU	Command
root	`1713216`	158%	`/root/.local/bin/agy-bin`
9999	`1750369`	114%	`/usr/local/bin/php`
9999	`1750384`	85.0%	`/bin/sh`

✔

Memory Allocation Stable: No individual processes exceeding memory bounds.

☁️

Cloudflare Zero Trust Ingress Tunnel

0 Domains Routed

HA Tunnels

Edge Nodes

Errors

Sessions

Active Edge PoPs: sin07, sin20, sin21

Ingress Hostname	Routing Security

⚠

Intercepted Exploits (7 Days): 61 attack signatures blocked at edge.

Exploit Signature	Intercepted Count
Other	59
App probe	1
AWS credential probe	1

🛡️

UFW Threat Intelligence & Inbound Attacks (24h)

18,120 Intercepted Probes

Top Attacking Source IPs

1897 10.0.0.3
   1477 2001
   1325 204.76.203.4
    615 2
    611 77.239.124.253
    517 10.0.1.9
    343 79.124.62.230
    312 79.124.62.134
    262 79.124.62.126
    175 2604

Top Targeted Ports

🐳

Docker Container Fleet

10 Active Containers

✔

Docker Daemon Isolated: TCP socket (2375/2376) is not exposed to any network.

Container Name	Runtime Status	Port Mappings
coolify	Up 2 days (healthy)	`8000/tcp, 8443/tcp, 9000/tcp, 0.0.0.0:8000->8080/tcp, [::]:8000->8080/tcp`
coolify-db	Up 2 days (healthy)	`5432/tcp`
coolify-redis	Up 2 days (healthy)	`6379/tcp`
coolify-realtime	Up 2 days (healthy)	`0.0.0.0:6001-6002->6001-6002/tcp, [::]:6001-6002->6001-6002/tcp`
coolify-proxy	Up 2 days (healthy)	`0.0.0.0:80->80/tcp, [::]:80->80/tcp, 0.0.0.0:443->443/tcp, [::]:443->443/tcp, 0.0.0.0:8080->8080/tcp, [::]:8080->8080/tcp, 0.0.0.0:443->443/udp, [::]:443->443/udp`
so13t9jiakgbyzwp863dmvzu-103035573499	Up 2 days	`3000/tcp`
lijg3ncf0yp8on32jagmeg0y	Up 2 days (healthy)	`5432/tcp`
lkn2msiqhoymcuyaa64cnazj-065012572847	Up 2 days	`3000/tcp`
ithh2dbx1jyjl6dejr3mre1k	Up 2 days (healthy)	`5432/tcp`
enthri8p43s4atofatobcunp-232449789422	Up 2 days	`3000/tcp`

🌐

Tailscale Encrypted Mesh Network

11 / 18 Peers Online

Node Name	Tailscale IP	OS Platform	Status
ssdnode THIS MACHINE	`100.80.139.9`	linux	Online
box	`100.86.226.66`	linux	Online
contabo	`100.111.135.6`	linux	Online
glkvm	`100.123.198.85`	linux	Online
hkrouter	`100.66.31.7`	linux	Online
ipad13tv	`100.117.146.121`	iOS	Online
ipadpro	`100.65.224.43`	iOS	Online
iphone-14-pro-max	`100.92.136.103`	iOS	Online
iphoneair	`100.95.106.126`	iOS	Online
kitai	`100.97.4.90`	linux	Online
kitmbp16	`100.123.239.87`	macOS	Online
tencent	`100.109.227.19`	linux	Online
appletv	`100.108.161.6`	tvOS	Offline
kit	`100.66.166.71`	macOS	Offline
kitlegiongo	`100.67.231.89`	windows	Offline
kits-macbook-air	`100.127.101.27`	macOS	Offline
mobilerouter	`100.127.101.21`	linux	Offline
node	`100.97.174.121`	iOS	Offline
virtualkit	`100.88.89.61`	macOS	Offline

🧱

Firewall Access Control Policy (UFW • 12 Active Rules)

Policy Enforced ↓

Rule / Protocol	Action	Interface	Source Match	Rule Note
`41641/udp`	ALLOW	—	`Anywhere`
`22/tcp`	ALLOW	tailscale0	`Anywhere`	SSH via Tailscale only
`Anywhere`	ALLOW	tailscale0	`Anywhere`
`60000:61000/udp`	ALLOW	tailscale0	`Anywhere`	Mosh via Tailscale
`22/tcp`	ALLOW	docker0	`Anywhere`
`41642/udp`	ALLOW	—	`Anywhere`	Tailscale peer relay
`41641/udp (v6)`	ALLOW	—	`Anywhere (v6)`
`22/tcp (v6)`	ALLOW	tailscale0	`Anywhere (v6)`	SSH via Tailscale only
`Anywhere (v6)`	ALLOW	tailscale0	`Anywhere (v6)`
`60000:61000/udp (v6)`	ALLOW	tailscale0	`Anywhere (v6)`	Mosh via Tailscale
`22/tcp (v6)`	ALLOW	docker0	`Anywhere (v6)`
`41642/udp (v6)`	ALLOW	—	`Anywhere (v6)`	Tailscale peer relay

🗄️

Historical Security Audit Archives

98 Reports Preserved