my-homelab-configs/security

Defensive Security Scans

This directory contains defensive scan configuration for the homelab and public website. These checks are for assets owned by this lab only.

Use Jeannie from the Debian homelab host:

./jeannie security-prepare
./jeannie security-scan
./jeannie security-zap
./jeannie security-k8s
./jeannie security-host
./jeannie security-web
./jeannie security-logs
./jeannie security-runtime

The default security-scan runs:

• Trivy filesystem and IaC/config scans against this repo.
• gitleaks secret scans against this repo.
• OWASP ZAP baseline passive scans against security/targets.txt.

The focused commands are:

• security-prepare: validate Docker/report prerequisites and pre-pull scanner images.
• security-zap: OWASP ZAP baseline scan only.
• security-k8s: kube-bench CIS checks against the kubeadm host.
• security-host: Lynis host audit summary for Debian. This command is report-only and prints one highest-risk finding to focus on first.
• security-trivy: Trivy repo and IaC/config scans only.
• security-secrets: gitleaks repo secret scan only.
• security-nuclei: low-rate nuclei HTTP exposure scans only.
• security-web: quick HTTPS, status, and defensive-header checks for owned web targets.
• security-logs: read-only summary of recent Gitea and Traefik security signals.
• security-runtime: Tetragon rollout check and event-log helper.

Reports are written to:

${HOMELAB_STATE_DIR}/security-reports

The ZAP scan uses baseline/passive mode. Do not run active attack scans against public endpoints unless you intentionally schedule a maintenance window and understand the traffic it will generate.

security/targets.txt is the public target allowlist. Keep it limited to services you own.

security-host intentionally does not self-fix Lynis findings. Some hardening recommendations can break SSH access, Docker networking, kubeadm, or public edge routing. When LAB_BACKSTAGE_BRAIN_ENABLED=true, Jeannie asks the local Ollama/RAG helper to select exactly one finding; otherwise it falls back to the first Lynis warning, then the first suggestion. The full Lynis report is still saved so you can review the complete output before adding any explicit hardening command.

security-logs uses recent Docker logs from the Debian Gitea container and Traefik pod logs when Kubernetes is reachable. It is intentionally heuristic: use it to spot scanner noise, auth failures, suspicious paths, and obvious client/server errors before opening the raw logs.

The apps/security-lab GitOps app deploys intentionally vulnerable targets for practice. They use ClusterIP services only and should be accessed with kubectl port-forward, not public ingress.

Tetragon is installed by the platform stack as a runtime visibility tool. Use it to learn what container process execution looks like after a pod is compromised.

Kyverno hardening policies live under apps/supply-chain-policy. The added pod hardening rules start in Audit mode so you can review violations before promoting any rule to Deny.