Security Operations Center

🛡️

Public Attack Surface: 100% Shielded SECURE

All 30 listening ports are strictly isolated by Docker iptables, Tailscale mesh, or localhost. 0 ports exposed directly to public internet.

🛑

Intrusion Shield & UFW Filter ACTIVE

Fail2ban active; 32,913 malicious automated reconnaissance probes dropped by UFW in the past 24 hours.

🔑

SSH Access & Identity Control 0 FAILURES

1,765 authorized Tailscale sessions authenticated in 24h. No brute-force anomalies detected.

🐳

Docker Workload Hardening ISOLATED

10 production containers active. Docker daemon TCP socket (2375/2376) is strictly restricted from external networks.

☁️

Cloudflare Zero Trust Ingress ONLINE

4 HA tunnel connections active (3 edge nodes); 95 exploit probes intercepted at Cloudflare edge in 7 days.

⚡

Host System Vitals STABLE

RAM 6% (1.8Gi/30Gi) • Load Avg: 3.89 • Disk: 63G/473G (14% used) • up 3 weeks, 22 hours, 11 minutes

Security Posture

SECURE

All controls active

Exposed Ports

30 monitored & shielded

UFW Blocks (24h)

32,913

Dropped scanning probes

SSH Failed (24h)

1,765 authorized logins

Containers

Docker daemon isolated

Tailscale Mesh

11 / 18

Encrypted mesh peers

CF Tunnel

ONLINE

HA edge nodes active

RAM / Load

6% / 3.89

Disk: 63G/473G

📡

Network Attack Surface & Listening Ports

30 Ports Monitored

✔

ufw-docker is ACTIVE: Docker bridge ports bound to 0.0.0.0 are intercepted by iptables DOCKER-USER chain and blocked from external ingress.

Listening Address	Service / Process	Security Classification
`127.0.0.1:37331`	agy-bin	Loopback 127.0.0.1
`127.0.0.1:6012`	cloudflared	Loopback 127.0.0.1
`100.80.139.9:22`	sshd	Tailscale Mesh
`10.0.0.1:22`	sshd	Private Network
`100.80.139.9:36486`	tailscaled	Tailscale Mesh
`127.0.0.1:40695`	agy-bin	Loopback 127.0.0.1
`127.0.0.1:24543`	moshi-hook	Loopback 127.0.0.1
`100.80.139.9:18443`	tailscaled	Tailscale Mesh
`127.0.0.1:22`	sshd	Loopback 127.0.0.1
`127.0.0.53%lo:53`	systemd-resolve	Loopback 127.0.0.1
`127.0.0.54:53`	systemd-resolve	Loopback 127.0.0.1
`0.0.0.0:8080`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`0.0.0.0:8000`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`100.80.139.9:8443`	tailscaled	Tailscale Mesh
`100.80.139.9:8317`	cli-proxy-api	Tailscale Mesh
`0.0.0.0:6001`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`0.0.0.0:6002`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`10.0.1.1:22`	sshd	Private Network
`0.0.0.0:443`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`0.0.0.0:80`	docker-proxy	Docker 0.0.0.0 (ufw-docker isolated)
`[fd7a:115c:a1e0::533b:8b09]:8443`	tailscaled	Tailscale Mesh
`[fd7a:115c:a1e0::533b:8b09]:43591`	tailscaled	Tailscale Mesh
`[::]:8080`	docker-proxy	Docker Internal Bridge
`[::]:8000`	docker-proxy	Docker Internal Bridge
`[::]:6001`	docker-proxy	Docker Internal Bridge
`[::]:6002`	docker-proxy	Docker Internal Bridge
`[fd7a:115c:a1e0::533b:8b09]:22`	sshd	Tailscale Mesh
`[::]:443`	docker-proxy	Docker Internal Bridge
`[::]:80`	docker-proxy	Docker Internal Bridge
`[fd7a:115c:a1e0::533b:8b09]:18443`	tailscaled	Tailscale Mesh

🔐

SSH Authentication & Access Audit

0 Failures 1,765 Sessions

No Tailscale SSH sessions recorded in audit period.

🔑 External / Host SSH Sessions

Time	Client IP	Host	Port
09/07 06:19	`10.0.0.2`	10.0.0.2	`47692`
09/07 06:25	`10.0.0.2`	10.0.0.2	`53134`
09/07 06:31	`10.0.0.2`	10.0.0.2	`33110`
09/07 06:37	`10.0.0.2`	10.0.0.2	`37992`
09/07 06:43	`10.0.0.2`	10.0.0.2	`53322`
09/07 06:49	`10.0.0.2`	10.0.0.2	`59920`
09/07 06:55	`10.0.0.2`	10.0.0.2	`42722`
09/07 07:01	`10.0.0.2`	10.0.0.2	`38526`

⚙️

System Workload & Process Monitor

Top Consumers

⚠

High CPU (>50%):

User	PID	CPU	Command
9999	`4110567`	68.5%	`/usr/local/bin/php`
9999	`4110549`	52.3%	`/usr/local/bin/php`
9999	`4110446`	52.3%	`/usr/local/bin/php`

✔

Memory Allocation Stable: No individual processes exceeding memory bounds.

☁️

Cloudflare Zero Trust Ingress Tunnel

0 Domains Routed

HA Tunnels

Edge Nodes

155

Errors

Sessions

Active Edge PoPs: sin07, sin20, sin21

Ingress Hostname	Routing Security

⚠

Intercepted Exploits (7 Days): 95 attack signatures blocked at edge.

Exploit Signature	Intercepted Count
Other	69
App probe	15
AWS credential probe	11

🛡️

UFW Threat Intelligence & Inbound Attacks (24h)

32,913 Intercepted Probes

Top Attacking Source IPs

2658 2001
   2062 204.76.203.4
   1897 10.0.0.3
   1184 77.239.124.253
   1161 2
   1065 10.0.1.9
   1032 45.142.193.161
    666 79.124.62.230
    654 79.124.62.134
    490 79.124.62.126

Top Targeted Ports

🐳

Docker Container Fleet

10 Active Containers

✔

Docker Daemon Isolated: TCP socket (2375/2376) is not exposed to any network.

Container Name	Runtime Status	Port Mappings
coolify	Up 5 days (healthy)	`8000/tcp, 8443/tcp, 9000/tcp, 0.0.0.0:8000->8080/tcp, [::]:8000->8080/tcp`
coolify-db	Up 5 days (healthy)	`5432/tcp`
coolify-redis	Up 5 days (healthy)	`6379/tcp`
coolify-realtime	Up 5 days (healthy)	`0.0.0.0:6001-6002->6001-6002/tcp, [::]:6001-6002->6001-6002/tcp`
coolify-proxy	Up 5 days (healthy)	`0.0.0.0:80->80/tcp, [::]:80->80/tcp, 0.0.0.0:443->443/tcp, [::]:443->443/tcp, 0.0.0.0:8080->8080/tcp, [::]:8080->8080/tcp, 0.0.0.0:443->443/udp, [::]:443->443/udp`
so13t9jiakgbyzwp863dmvzu-103035573499	Up 5 days	`3000/tcp`
lijg3ncf0yp8on32jagmeg0y	Up 5 days (healthy)	`5432/tcp`
lkn2msiqhoymcuyaa64cnazj-065012572847	Up 5 days	`3000/tcp`
ithh2dbx1jyjl6dejr3mre1k	Up 5 days (healthy)	`5432/tcp`
enthri8p43s4atofatobcunp-232449789422	Up 5 days	`3000/tcp`

🌐

Tailscale Encrypted Mesh Network

11 / 18 Peers Online

Node Name	Tailscale IP	OS Platform	Status
ssdnode THIS MACHINE	`100.80.139.9`	linux	Online
box	`100.86.226.66`	linux	Online
contabo	`100.111.135.6`	linux	Online
glkvm	`100.123.198.85`	linux	Online
hkrouter	`100.66.31.7`	linux	Online
ipad13tv	`100.117.146.121`	iOS	Online
ipadpro	`100.65.224.43`	iOS	Online
iphone-14-pro-max	`100.92.136.103`	iOS	Online
iphoneair	`100.95.106.126`	iOS	Online
kitai	`100.97.4.90`	linux	Online
kitmbp16	`100.123.239.87`	macOS	Online
tencent	`100.109.227.19`	linux	Online
appletv	`100.108.161.6`	tvOS	Offline
kit	`100.66.166.71`	macOS	Offline
kitlegiongo	`100.67.231.89`	windows	Offline
kits-macbook-air	`100.127.101.27`	macOS	Offline
mobilerouter	`100.127.101.21`	linux	Offline
node	`100.97.174.121`	iOS	Offline
virtualkit	`100.88.89.61`	macOS	Offline

🧱

Firewall Access Control Policy (UFW • 12 Active Rules)

Policy Enforced ↓

Rule / Protocol	Action	Interface	Source Match	Rule Note
`41641/udp`	ALLOW	—	`Anywhere`
`22/tcp`	ALLOW	tailscale0	`Anywhere`	SSH via Tailscale only
`Anywhere`	ALLOW	tailscale0	`Anywhere`
`60000:61000/udp`	ALLOW	tailscale0	`Anywhere`	Mosh via Tailscale
`22/tcp`	ALLOW	docker0	`Anywhere`
`41642/udp`	ALLOW	—	`Anywhere`	Tailscale peer relay
`41641/udp (v6)`	ALLOW	—	`Anywhere (v6)`
`22/tcp (v6)`	ALLOW	tailscale0	`Anywhere (v6)`	SSH via Tailscale only
`Anywhere (v6)`	ALLOW	tailscale0	`Anywhere (v6)`
`60000:61000/udp (v6)`	ALLOW	tailscale0	`Anywhere (v6)`	Mosh via Tailscale
`22/tcp (v6)`	ALLOW	docker0	`Anywhere (v6)`
`41642/udp (v6)`	ALLOW	—	`Anywhere (v6)`	Tailscale peer relay

🗄️

Historical Security Audit Archives

100 Reports Preserved