Homelab security on 512 MB: warden scores my logs and asks before it bans anything

Description and use

Warden is a lightweight Python tool that aggregates logs, scans for vulnerabilities, and proposes patches and bans via Discord, running on 512 MB RAM and 1 vCPU.

Problem

Need a single, lightweight system to monitor homelab activity, detect vulnerabilities, and propose mitigations without installing agents on every host.

Outcome

Warden runs on a single 1 vCPU, 512 MB machine, consumes ~29 MB RAM for the console, and adds ~1 GB RAM and 2 GB disk for vulnerability scanning. It provides unified visibility, agentless operation, and manual approval for bans and patches.

Workflow

• Collect logs via systemd timers and SSH
• Parse logs for attacks and score them
• Scan packages and containers with Trivy
• Score systems with Lynis and perform file integrity checks
• Run Suricata IDS and match threat feeds
• Snapshot Cloudflare edge settings
• Generate patch plans and edge ban proposals
• Post proposals to Discord with approval buttons
• Apply approved patches or bans via SSH or Cloudflare API

Evidence

Warden is plain Python and one SQLite file. Collectors run on systemd timers and write to the database.

Source

It reads the reverse proxy log (NPMplus/nginx), the Authelia log and the cloudflared tunnel log.

Source

Warden runs on 1 vCPU and 512 MB for the core. I measured the console at 29 MB resident on my box.

Source

When it does want to act, it asks. A proposed edge ban or a patch plan turns up in Discord with ✅ and ❌, and nothing happens until I tap one.

Source