fix(gateway): deploy native in-project soc-gateway-live container artifact, eliminate ttyd terminal, clean up external static apps, and update English security reports
This commit is contained in:
@@ -4,21 +4,24 @@ Comprehensive Automated QA, Internal DNS, Raw TCP, Inter-Service Mesh, and Penet
|
||||
|
||||
## 🌐 Live Deployed Applications
|
||||
|
||||
* **Edge SOC Command Center Gateway**:
|
||||
👉 **[https://ghaymah-soc-gateway-ac352412-web-3e953576.hosted.cumin.dev](https://ghaymah-soc-gateway-ac352412-web-3e953576.hosted.cumin.dev)**
|
||||
*(Status: Live / Healthy — Serves the full interactive Security Operations Center dashboard)*
|
||||
* **Edge SOC Command Center Gateway (`soc-gateway-live`)**:
|
||||
👉 **[https://soc-gateway-live-7c2ca9361c37.hosted.ghaymah.systems/](https://soc-gateway-live-7c2ca9361c37.hosted.ghaymah.systems/)**
|
||||
*(Status: Live / Healthy — Deployed natively as a container artifact inside project `ghaymah-soc-microservices`. Serves the complete, interactive Security Operations Center dashboard directly via Nginx 1.31.6. Zero terminal / ttyd interface).*
|
||||
* **Private SOC Backend (`soc-backend`)**:
|
||||
*Status: Strictly Private (Public Access: Disabled — Returns HTTP 404 externally)*
|
||||
*Status: Strictly Private (Public Access: Disabled / `publicAccess: false` — External probe returns HTTP 404 Not Found).*
|
||||
* **Private SOC Database (`soc-redis`)**:
|
||||
*Status: Strictly Private (Raw TCP port 6379 only — Returns HTTP 404 externally)*
|
||||
*Status: Strictly Private (Raw TCP port 6379 only — Blocked from public internet).*
|
||||
* **DevSecOps Testing Pod (`soc-tester`)**:
|
||||
*Status: Live (Management pod inside private mesh for diagnostics, CoreDNS tests, and security audits).*
|
||||
|
||||
---
|
||||
|
||||
## 📋 Comprehensive Assessment Reports
|
||||
|
||||
1. 👉 **[Multi-Microservice Architecture & Security Report (Project: ghaymah-soc-microservices)](reports/GHAYMAH_MULTI_MICROSERVICES_SECURITY_REPORT.md)**
|
||||
* Complete SOC multi-service topology: Edge Gateway, Private REST Backend, Private Redis Database, and Diagnostic Pod.
|
||||
* Complete SOC multi-service topology: Native Edge Gateway Container (`soc-gateway-live`), Private REST Backend, Private Redis Database, and Diagnostic Pod.
|
||||
* Inter-service mesh routing, Raw TCP Redis transactions, and cross-project penetration testing findings.
|
||||
* Full documentation of the in-project container artifact build mechanism on Ghaymah, elimination of terminal UI, and cleanup of legacy static apps.
|
||||
2. 👉 **[Internal DNS & Private Networking Report (Project: dns-tcp-test)](reports/GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md)**
|
||||
* Baseline discovery, CoreDNS resolution formula verification, and tenant isolation benchmarks.
|
||||
|
||||
@@ -26,7 +29,7 @@ Comprehensive Automated QA, Internal DNS, Raw TCP, Inter-Service Mesh, and Penet
|
||||
|
||||
## 🎯 Scope & Objectives
|
||||
1. **Multi-Microservice Architecture**: Deploy a real 4-tier microservice application directly on Ghaymah:
|
||||
- `ghaymah-soc-gateway`: Public edge ingress, reverse proxy, and interactive UI dashboard.
|
||||
- `soc-gateway-live`: Public edge ingress, reverse proxy, and interactive UI dashboard running Nginx container artifact.
|
||||
- `soc-backend`: Private analysis engine listening on port 4000 (strictly internal).
|
||||
- `soc-redis`: Private threat intelligence database & cache on port 6379.
|
||||
- `soc-tester`: Live DevSecOps testing pod.
|
||||
@@ -52,7 +55,9 @@ Comprehensive Automated QA, Internal DNS, Raw TCP, Inter-Service Mesh, and Penet
|
||||
│ ├── ghaymah_execution.log # Baseline test execution log
|
||||
│ └── uniquename_dns_tcp.log # Raw TCP test log
|
||||
├── scripts/
|
||||
│ ├── deploy_static_soc_gateway.js # Deploys live SOC Command Center UI
|
||||
│ ├── deploy_clean_gateway_artifact.js # Deploys native container artifact (Nginx + SOC UI)
|
||||
│ ├── delete_old_gateway.js # Retires old ttyd terminal container
|
||||
│ ├── delete_static_app.js # Cleans up temporary cumin.dev static app
|
||||
│ ├── make_backend_private.js # Enforces strict private backend isolation
|
||||
│ ├── create_soc_microservices_project.js # Deploys the multi-microservice project
|
||||
│ ├── run_soc_multiservice_tests.js # Automated multi-service test runner
|
||||
@@ -64,7 +69,7 @@ Comprehensive Automated QA, Internal DNS, Raw TCP, Inter-Service Mesh, and Penet
|
||||
│ ├── index.html # Full SOC Command Center HTML UI
|
||||
│ └── app.zip # Deployment bundle
|
||||
├── soc_project_topology.json # Full project resource definition & metadata
|
||||
├── soc_static_gateway.json # Live Gateway metadata
|
||||
├── soc_static_gateway.json # Static Gateway lifecycle metadata (Deprecated/Deleted)
|
||||
└── token.json # Authenticated session token (auto-managed)
|
||||
```
|
||||
|
||||
@@ -74,13 +79,13 @@ Comprehensive Automated QA, Internal DNS, Raw TCP, Inter-Service Mesh, and Penet
|
||||
|
||||
| Test Domain | Target Service | Result | Classification | Key Observation |
|
||||
| :--- | :--- | :---: | :---: | :--- |
|
||||
| **Edge Ingress UI** | `soc-gateway-live` | **PASS** | Functional | HTTP 200 via `hosted.ghaymah.systems` (Native Nginx container, full SOC UI active, zero terminal) |
|
||||
| **Internal DNS** | `soc-redis-10f420c389ef` | **PASS** | Functional | Resolves to `10.42.5.99` via CoreDNS |
|
||||
| **Internal DNS** | `soc-backend-d1895c70f6b2`| **PASS** | Functional | Resolves to `10.42.5.103` via CoreDNS |
|
||||
| **Internal DNS** | `soc-gateway-28cd1dc4e034`| **PASS** | Functional | Resolves to `10.42.5.101` via CoreDNS |
|
||||
| **Raw TCP** | `soc-redis:6379` | **PASS** | Functional | `PING` $\rightarrow$ `+PONG`, `SET/GET` threat alerts verified |
|
||||
| **Inter-Service Mesh** | `soc-gateway` $\rightarrow$ `soc-redis` | **PASS** | Functional | Edge Gateway queries Database directly over mesh |
|
||||
| **Edge Ingress** | `ghaymah-soc-gateway` | **PASS** | Functional | HTTP 200 via `hosted.cumin.dev` (Full UI active) |
|
||||
| **Backend Isolation** | `soc-backend` (Public URL)| **PASS** | Secure | HTTP 404 / Strictly private internal service |
|
||||
| **Backend Isolation** | `soc-backend` (Public URL)| **PASS** | Secure | HTTP 404 / Strictly private internal service (`publicAccess: false`) |
|
||||
| **Database Isolation**| `soc-redis` (Public URL) | **PASS** | Secure | HTTP 404 / Blocked from public internet |
|
||||
| **Project Isolation**| Cross-project Redis/HTTP | **FINDING** | **Medium/High** | Projects in same account share flat mesh network |
|
||||
| **Cluster Boundary** | K8s API (`10.43.0.1:443`) | **PASS** | Secure | HTTP 401 Unauthorized (RBAC enforced) |
|
||||
|
||||
Reference in New Issue
Block a user