# Ghaymah Systems — Private Networking, Internal DNS & Multi-Microservice Testing Suite

Comprehensive Automated QA, Internal DNS, Raw TCP, Inter-Service Mesh, and Penetration Testing Suite for **Ghaymah Systems** (`deploy.ghaymah.systems`).

## 🌐 Live Deployed Applications

* **Edge SOC Command Center Gateway (`soc-gateway-live`)**: 
  👉 **[https://soc-gateway-live-7c2ca9361c37.hosted.ghaymah.systems/](https://soc-gateway-live-7c2ca9361c37.hosted.ghaymah.systems/)**
  *(Status: Live / Healthy — Deployed natively as a container artifact inside project `ghaymah-soc-microservices`. Serves the complete, interactive Security Operations Center dashboard directly via Nginx 1.31.6. Zero terminal / ttyd interface).*
* **Private SOC Backend (`soc-backend`)**:
  *Status: Strictly Private (Public Access: Disabled / `publicAccess: false` — External probe returns HTTP 404 Not Found).*
* **Private SOC Database (`soc-redis`)**:
  *Status: Strictly Private (Raw TCP port 6379 only — Blocked from public internet).*
* **DevSecOps Testing Pod (`soc-tester`)**:
  *Status: Live (Management pod inside private mesh for diagnostics, CoreDNS tests, and security audits).*

---

## 📋 Comprehensive Assessment Reports

1. 👉 **[Multi-Microservice Architecture & Security Report (Project: ghaymah-soc-microservices)](reports/GHAYMAH_MULTI_MICROSERVICES_SECURITY_REPORT.md)**
   * Complete SOC multi-service topology: Native Edge Gateway Container (`soc-gateway-live`), Private REST Backend, Private Redis Database, and Diagnostic Pod.
   * Inter-service mesh routing, Raw TCP Redis transactions, and cross-project penetration testing findings.
   * Full documentation of the in-project container artifact build mechanism on Ghaymah, elimination of terminal UI, and cleanup of legacy static apps.
2. 👉 **[Internal DNS & Private Networking Report (Project: dns-tcp-test)](reports/GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md)**
   * Baseline discovery, CoreDNS resolution formula verification, and tenant isolation benchmarks.

---

## 🎯 Scope & Objectives
1. **Multi-Microservice Architecture**: Deploy a real 4-tier microservice application directly on Ghaymah:
   - `soc-gateway-live`: Public edge ingress, reverse proxy, and interactive UI dashboard running Nginx container artifact.
   - `soc-backend`: Private analysis engine listening on port 4000 (strictly internal).
   - `soc-redis`: Private threat intelligence database & cache on port 6379.
   - `soc-tester`: Live DevSecOps testing pod.
2. **Internal DNS Verification**: Verify container-to-container service discovery via CoreDNS (`10.43.0.10:53`) using deterministic unique names (`[name]-[hash]`).
3. **Raw TCP Socket Connectivity**: Validate non-HTTP socket communication over port 6379 (Redis handshake, write, read, atomic counters).
4. **Security & Penetration Testing**:
   - Assess intra-tenant cross-project lateral movement.
   - Verify cluster infrastructure isolation (Kubernetes API, Cloud Metadata SSRF).
   - Local subnet discovery & port scanning.
   - Outbound egress NAT and DNS leak behavior.

---

## 📂 Directory Structure

```text
├── reports/
│   ├── GHAYMAH_MULTI_MICROSERVICES_SECURITY_REPORT.md  # Multi-microservice SOC assessment report
│   └── GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md         # Initial DNS & TCP baseline report
├── logs/
│   ├── soc_multiservice_execution.log                 # Multi-microservice execution log
│   ├── soc_multiservice_results.json                  # Structured test results (JSON)
│   ├── ghaymah_execution.log                          # Baseline test execution log
│   └── uniquename_dns_tcp.log                         # Raw TCP test log
├── scripts/
│   ├── deploy_clean_gateway_artifact.js               # Deploys native container artifact (Nginx + SOC UI)
│   ├── delete_old_gateway.js                          # Retires old ttyd terminal container
│   ├── delete_static_app.js                           # Cleans up temporary cumin.dev static app
│   ├── make_backend_private.js                        # Enforces strict private backend isolation
│   ├── create_soc_microservices_project.js            # Deploys the multi-microservice project
│   ├── run_soc_multiservice_tests.js                  # Automated multi-service test runner
│   ├── monitor_soc_project.js                         # Deployment status polling
│   ├── remote_exec.js                                 # WebSocket terminal execution client
│   ├── test_soc_redis_tcp.js                          # Raw TCP protocol tester
│   └── auth_manager.js                                # Ghaymah authentication manager
├── soc_gateway_ui/                                    # Extracted SOC Dashboard static assets
│   ├── index.html                                     # Full SOC Command Center HTML UI
│   └── app.zip                                        # Deployment bundle
├── soc_project_topology.json                          # Full project resource definition & metadata
├── soc_static_gateway.json                            # Static Gateway lifecycle metadata (Deprecated/Deleted)
└── token.json                                         # Authenticated session token (auto-managed)
```

---

## 📊 Summary of Findings Matrix

| Test Domain | Target Service | Result | Classification | Key Observation |
| :--- | :--- | :---: | :---: | :--- |
| **Edge Ingress UI** | `soc-gateway-live` | **PASS** | Functional | HTTP 200 via `hosted.ghaymah.systems` (Native Nginx container, full SOC UI active, zero terminal) |
| **Internal DNS** | `soc-redis-10f420c389ef` | **PASS** | Functional | Resolves to `10.42.5.99` via CoreDNS |
| **Internal DNS** | `soc-backend-d1895c70f6b2`| **PASS** | Functional | Resolves to `10.42.5.103` via CoreDNS |
| **Internal DNS** | `soc-gateway-28cd1dc4e034`| **PASS** | Functional | Resolves to `10.42.5.101` via CoreDNS |
| **Raw TCP** | `soc-redis:6379` | **PASS** | Functional | `PING` $\rightarrow$ `+PONG`, `SET/GET` threat alerts verified |
| **Inter-Service Mesh** | `soc-gateway` $\rightarrow$ `soc-redis` | **PASS** | Functional | Edge Gateway queries Database directly over mesh |
| **Backend Isolation** | `soc-backend` (Public URL)| **PASS** | Secure | HTTP 404 / Strictly private internal service (`publicAccess: false`) |
| **Database Isolation**| `soc-redis` (Public URL)  | **PASS** | Secure | HTTP 404 / Blocked from public internet |
| **Project Isolation**| Cross-project Redis/HTTP | **FINDING** | **Medium/High** | Projects in same account share flat mesh network |
| **Cluster Boundary** | K8s API (`10.43.0.1:443`) | **PASS** | Secure | HTTP 401 Unauthorized (RBAC enforced) |
| **SSRF / Cloud Meta** | AWS/Cloud Metadata (`169.254.169.254`) | **PASS** | Secure | Blocked / Unreachable |
| **Cluster Telemetry** | CoreDNS Metrics (`10.43.0.10:9153`) | **INFO** | Low | Prometheus metrics exposed internally |

---

## 🚀 Execution & Verification

To run the automated multi-microservice tests:
```bash
# 1. Verify Authentication
node scripts/auth_manager.js

# 2. Run Comprehensive Test Suite
node scripts/run_soc_multiservice_tests.js
```