Security Operations Center

🛡️

Public Attack Surface: 100% Shielded SECURE

All 32 listening ports are strictly isolated by Docker iptables, Tailscale mesh, or localhost. 0 ports exposed directly to public internet.

🛑

Intrusion Shield & UFW Filter ACTIVE

Fail2ban active; 33,940 malicious automated reconnaissance probes dropped by UFW in the past 24 hours.

🔑

SSH Access & Identity Control 0 FAILURES

279 authorized Tailscale sessions authenticated in 24h. No brute-force anomalies detected.

🐳

Docker Workload Hardening ISOLATED

10 production containers active. Docker daemon TCP socket (2375/2376) is strictly restricted from external networks.

☁️

Cloudflare Zero Trust Ingress ONLINE

4 HA tunnel connections active (3 edge nodes); 410 exploit probes intercepted at Cloudflare edge in 7 days.

⚡

Host System Vitals STABLE

RAM 7% (2.0Gi/30Gi) • Load Avg: 5.91 • Disk: 67G/473G (15% used) • up 4 weeks, 22 hours, 30 minutes

Security Posture

SECURE

All controls active

Exposed Ports

32 monitored & shielded

UFW Blocks (24h)

33,940

Dropped scanning probes

SSH Failed (24h)

279 authorized logins

Containers

Docker daemon isolated

Tailscale Mesh

11 / 19

Encrypted mesh peers

CF Tunnel

ONLINE

HA edge nodes active

RAM / Load

7% / 5.91

Disk: 67G/473G

📡

Network Attack Surface & Listening Ports

32 Ports Monitored

✔

ufw-docker is ACTIVE: Docker bridge ports bound to 0.0.0.0 are intercepted by iptables DOCKER-USER chain and blocked from external ingress.

Listening Address	Service / Process	Security Classification
`127.0.0.1:37331`	agy-bin	Loopback 127.0.0.1
`127.0.0.1:6012`	cloudflared	Loopback 127.0.0.1
`100.80.139.9:22`	sshd	Tailscale Mesh
`10.0.0.1:22`	sshd	Private Network
`100.80.139.9:36486`	tailscaled	Tailscale Mesh
`127.0.0.1:40695`	agy-bin	Loopback 127.0.0.1
`127.0.0.1:24543`	moshi-hook	Loopback 127.0.0.1
`100.80.139.9:18443`	tailscaled	Tailscale Mesh
`127.0.0.1:22`	sshd	Loopback 127.0.0.1
`127.0.0.1:34315`	agy-bin	Loopback 127.0.0.1
`127.0.0.1:34115`	agy-bin	Loopback 127.0.0.1
`127.0.0.53%lo:53`	systemd-resolve	Loopback 127.0.0.1
`127.0.0.54:53`	systemd-resolve	Loopback 127.0.0.1
`0.0.0.0:8080`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`0.0.0.0:8000`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`100.80.139.9:8443`	tailscaled	Tailscale Mesh
`100.80.139.9:8317`	cli-proxy-api	Tailscale Mesh
`0.0.0.0:6001`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`0.0.0.0:6002`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`10.0.1.1:22`	sshd	Private Network
`0.0.0.0:443`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`0.0.0.0:80`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`[fd7a:115c:a1e0::533b:8b09]:8443`	tailscaled	Tailscale Mesh
`[fd7a:115c:a1e0::533b:8b09]:43591`	tailscaled	Tailscale Mesh
`[::]:8080`	docker-proxy	Docker Internal Bridge
`[::]:8000`	docker-proxy	Docker Internal Bridge
`[::]:6001`	docker-proxy	Docker Internal Bridge
`[::]:6002`	docker-proxy	Docker Internal Bridge
`[fd7a:115c:a1e0::533b:8b09]:22`	sshd	Tailscale Mesh
`[::]:443`	docker-proxy	Docker Internal Bridge
`[::]:80`	docker-proxy	Docker Internal Bridge
`[fd7a:115c:a1e0::533b:8b09]:18443`	tailscaled	Tailscale Mesh

🔐

SSH Authentication & Access Audit

0 Failures 279 Sessions

🔒 Tailscale SSH Sessions (Recent)

Time	Client IP	Host	Tailscale User	Source Node
09/18 05:33	`100.65.224.43`	ipadpro	tagged-devices	ipadpro
09/18 16:34	`100.123.239.87`	kitmbp16	tagged-devices	kitmbp16
09/18 17:15	`100.117.146.121`	ipad13tv	tagged-devices	ipad13tv
09/18 17:22	`100.117.146.121`	ipad13tv	tagged-devices	ipad13tv
09/19 05:52	`100.123.239.87`	kitmbp16	tagged-devices	kitmbp16
09/19 05:52	`100.95.106.126`	iphoneair	tagged-devices	iphoneair
09/19 05:53	`100.95.106.126`	iphoneair	tagged-devices	iphoneair
09/19 15:14	`100.95.106.126`	iphoneair	tagged-devices	iphoneair

⚙️

System Workload & Process Monitor

Top Consumers

✔

CPU Workload Stable: No anomalous processes exceeding 50% CPU.

✔

Memory Allocation Stable: No individual processes exceeding memory bounds.

☁️

Cloudflare Zero Trust Ingress Tunnel

0 Domains Routed

HA Tunnels

Edge Nodes

565

Errors

Sessions

Active Edge PoPs: sin07, sin20, sin21

Ingress Hostname	Routing Security

⚠

Intercepted Exploits (7 Days): 410 attack signatures blocked at edge.

Exploit Signature	Intercepted Count
Other	236
App probe	139
AWS credential probe	35

🛡️

UFW Threat Intelligence & Inbound Attacks (24h)

33,940 Intercepted Probes

Top Attacking Source IPs

2583 2001
   1794 77.239.124.253
   1619 2
   1558 10.0.1.9
    839 79.124.62.230
    816 79.124.62.134
    676 79.124.62.126
    250 2604
    197 161.35.55.174
    191 2606

Top Targeted Ports

🐳

Docker Container Fleet

10 Active Containers

✔

Docker Daemon Isolated: TCP socket (2375/2376) is not exposed to any network.

Container Name	Runtime Status	Port Mappings
coolify	Up 12 days (healthy)	`8000/tcp, 8443/tcp, 9000/tcp, 0.0.0.0:8000->8080/tcp, [::]:8000->8080/tcp`
coolify-db	Up 12 days (healthy)	`5432/tcp`
coolify-redis	Up 12 days (healthy)	`6379/tcp`
coolify-realtime	Up 12 days (healthy)	`0.0.0.0:6001-6002->6001-6002/tcp, [::]:6001-6002->6001-6002/tcp`
coolify-proxy	Up 12 days (healthy)	`0.0.0.0:80->80/tcp, [::]:80->80/tcp, 0.0.0.0:443->443/tcp, [::]:443->443/tcp, 0.0.0.0:8080->8080/tcp, [::]:8080->8080/tcp, 0.0.0.0:443->443/udp, [::]:443->443/udp`
so13t9jiakgbyzwp863dmvzu-103035573499	Up 12 days	`3000/tcp`
lijg3ncf0yp8on32jagmeg0y	Up 12 days (healthy)	`5432/tcp`
lkn2msiqhoymcuyaa64cnazj-065012572847	Up 12 days	`3000/tcp`
ithh2dbx1jyjl6dejr3mre1k	Up 12 days (healthy)	`5432/tcp`
enthri8p43s4atofatobcunp-232449789422	Up 12 days	`3000/tcp`

🌐

Tailscale Encrypted Mesh Network

11 / 19 Peers Online

Node Name	Tailscale IP	OS Platform	Status
ssdnode THIS MACHINE	`100.80.139.9`	linux	Online
box	`100.86.226.66`	linux	Online
contabo	`100.111.135.6`	linux	Online
glkvm	`100.123.198.85`	linux	Online
hkrouter	`100.66.31.7`	linux	Online
ipad13tv	`100.117.146.121`	iOS	Online
ipadpro	`100.65.224.43`	iOS	Online
iphone-14-pro-max	`100.92.136.103`	iOS	Online
iphoneair	`100.95.106.126`	iOS	Online
kitai	`100.97.4.90`	linux	Online
kitmbp16	`100.123.239.87`	macOS	Online
tencent	`100.109.227.19`	linux	Online
appletv	`100.108.161.6`	tvOS	Offline
kit	`100.66.166.71`	macOS	Offline
kitlegiongo	`100.67.231.89`	windows	Offline
kits-macbook-air	`100.127.101.27`	macOS	Offline
macbookair-linux	`100.65.0.96`	linux	Offline
mobilerouter	`100.127.101.21`	linux	Offline
node	`100.97.174.121`	iOS	Offline
virtualkit	`100.88.89.61`	macOS	Offline

🧱

Firewall Access Control Policy (UFW • 12 Active Rules)

Policy Enforced ↓

Rule / Protocol	Action	Interface	Source Match	Rule Note
`41641/udp`	ALLOW	—	`Anywhere`
`22/tcp`	ALLOW	tailscale0	`Anywhere`	SSH via Tailscale only
`Anywhere`	ALLOW	tailscale0	`Anywhere`
`60000:61000/udp`	ALLOW	tailscale0	`Anywhere`	Mosh via Tailscale
`22/tcp`	ALLOW	docker0	`Anywhere`
`41642/udp`	ALLOW	—	`Anywhere`	Tailscale peer relay
`41641/udp (v6)`	ALLOW	—	`Anywhere (v6)`
`22/tcp (v6)`	ALLOW	tailscale0	`Anywhere (v6)`	SSH via Tailscale only
`Anywhere (v6)`	ALLOW	tailscale0	`Anywhere (v6)`
`60000:61000/udp (v6)`	ALLOW	tailscale0	`Anywhere (v6)`	Mosh via Tailscale
`22/tcp (v6)`	ALLOW	docker0	`Anywhere (v6)`
`41642/udp (v6)`	ALLOW	—	`Anywhere (v6)`	Tailscale peer relay

🗄️

Historical Security Audit Archives

108 Reports Preserved