my-homelab-configs/security/README.md

Defensive Security Scans

This directory contains defensive scan configuration for the homelab and public website. These checks are for assets owned by this lab only.

Use Jeannie from the Debian homelab host:

./jeannie security-prepare
./jeannie security-scan
./jeannie security-zap
./jeannie security-k8s

The default security-scan runs:

• Trivy filesystem and IaC/config scans against this repo.
• OWASP ZAP baseline passive scans against security/targets.txt.

The focused commands are:

• security-prepare: validate Docker/report prerequisites and pre-pull scanner images.
• security-zap: OWASP ZAP baseline scan only.
• security-k8s: kube-bench CIS checks against the kubeadm host.
• security-trivy: Trivy repo and IaC/config scans only.
• security-nuclei: low-rate nuclei HTTP exposure scans only.

Reports are written to:

${HOMELAB_STATE_DIR}/security-reports

The ZAP scan uses baseline/passive mode. Do not run active attack scans against public endpoints unless you intentionally schedule a maintenance window and understand the traffic it will generate.

security/targets.txt is the public target allowlist. Keep it limited to services you own.