Homelab security on 512 MB: warden scores my logs and asks before it bans anything

说明与用途

Warden 是一个轻量级 Python 工具，聚合日志、扫描漏洞，并通过 Discord 提出补丁和封禁建议，运行在 512 MB RAM 和 1 vCPU 上。

问题

Need a single, lightweight system to monitor homelab activity, detect vulnerabilities, and propose mitigations without installing agents on every host.

结果

Warden runs on a single 1 vCPU, 512 MB machine, consumes ~29 MB RAM for the console, and adds ~1 GB RAM and 2 GB disk for vulnerability scanning. It provides unified visibility, agentless operation, and manual approval for bans and patches.

工作流

• Collect logs via systemd timers and SSH
• Parse logs for attacks and score them
• Scan packages and containers with Trivy
• Score systems with Lynis and perform file integrity checks
• Run Suricata IDS and match threat feeds
• Snapshot Cloudflare edge settings
• Generate patch plans and edge ban proposals
• Post proposals to Discord with approval buttons
• Apply approved patches or bans via SSH or Cloudflare API

证据

Warden is plain Python and one SQLite file. Collectors run on systemd timers and write to the database.

来源

It reads the reverse proxy log (NPMplus/nginx), the Authelia log and the cloudflared tunnel log.

来源

Warden runs on 1 vCPU and 512 MB for the core. I measured the console at 29 MB resident on my box.

来源

When it does want to act, it asks. A proposed edge ban or a patch plan turns up in Discord with ✅ and ❌, and nothing happens until I tap one.

来源