Homelab security on 512 MB: warden scores my logs and asks before it bans anything

Описание и применение

Warden – небольшое Python‑приложение, объединяющее логи, сканирование уязвимостей и IDS, предлагающее патчи и блокировки через Discord, работающее на 512 МБ RAM и 1 vCPU.

Задача

Need a single, lightweight system to monitor homelab activity, detect vulnerabilities, and propose mitigations without installing agents on every host.

Результат

Warden runs on a single 1 vCPU, 512 MB machine, consumes ~29 MB RAM for the console, and adds ~1 GB RAM and 2 GB disk for vulnerability scanning. It provides unified visibility, agentless operation, and manual approval for bans and patches.

Рабочий процесс

• Collect logs via systemd timers and SSH
• Parse logs for attacks and score them
• Scan packages and containers with Trivy
• Score systems with Lynis and perform file integrity checks
• Run Suricata IDS and match threat feeds
• Snapshot Cloudflare edge settings
• Generate patch plans and edge ban proposals
• Post proposals to Discord with approval buttons
• Apply approved patches or bans via SSH or Cloudflare API

Доказательства

Warden is plain Python and one SQLite file. Collectors run on systemd timers and write to the database.

Источник

It reads the reverse proxy log (NPMplus/nginx), the Authelia log and the cloudflared tunnel log.

Источник

Warden runs on 1 vCPU and 512 MB for the core. I measured the console at 29 MB resident on my box.

Источник

When it does want to act, it asks. A proposed edge ban or a patch plan turns up in Discord with ✅ and ❌, and nothing happens until I tap one.

Источник