7.6 KiB
7.6 KiB
Ghaymah Systems — Private Networking, Internal DNS & Multi-Microservice Testing Suite
Comprehensive Automated QA, Internal DNS, Raw TCP, Inter-Service Mesh, and Penetration Testing Suite for Ghaymah Systems (deploy.ghaymah.systems).
🌐 Live Deployed Applications
- Edge SOC Command Center Gateway (
soc-gateway-live): 👉 https://soc-gateway-live-34af72b825ed.hosted.ghaymah.systems/ (Status: Live / Healthy — Deployed natively as a Node.js Edge Gateway & Microservice Proxy container artifact inside projectghaymah-soc-microservices. Serves the complete, interactive Security Operations Center dashboard with all 9 microservices active, live threat telemetry, real security scans of Google/GitHub/Cloudflare, sub-millisecond mesh Redis connectivity, zero terminal interface, and instant rendering). - Private SOC Backend (
soc-backend): Status: Strictly Private (Public Access: Disabled /publicAccess: false— External probe returns HTTP 404 Not Found). - Private SOC Database (
soc-redis): Status: Strictly Private (Raw TCP port 6379 only — Mesh ping active, verified with sub-millisecond latency). - DevSecOps Testing Pod (
soc-tester): Status: Live (Management pod inside private mesh for diagnostics, CoreDNS tests, and security audits).
📋 Comprehensive Assessment Reports
- 👉 Multi-Microservice Architecture & Security Report (Project: ghaymah-soc-microservices)
- Complete SOC multi-service topology: Native Edge Gateway Container (
soc-gateway-live), Private REST Backend, Private Redis Database, and Diagnostic Pod. - Inter-service mesh routing, Raw TCP Redis transactions, and cross-project penetration testing findings.
- Full documentation of the in-project container artifact build mechanism on Ghaymah, elimination of terminal UI, and cleanup of legacy static apps.
- Complete SOC multi-service topology: Native Edge Gateway Container (
- 👉 Internal DNS & Private Networking Report (Project: dns-tcp-test)
- Baseline discovery, CoreDNS resolution formula verification, and tenant isolation benchmarks.
🎯 Scope & Objectives
- Multi-Microservice Architecture: Deploy a real 4-tier microservice application directly on Ghaymah:
soc-gateway-live: Public edge ingress, reverse proxy, and interactive UI dashboard running Node.js container artifact with embedded SOC microservices engine.soc-backend: Private analysis engine listening on port 4000 (strictly internal).soc-redis: Private threat intelligence database & cache on port 6379.soc-tester: Live DevSecOps testing pod.
- Internal DNS Verification: Verify container-to-container service discovery via CoreDNS (
10.43.0.10:53) using deterministic unique names ([name]-[hash]). - Raw TCP Socket Connectivity: Validate non-HTTP socket communication over port 6379 (Redis handshake, write, read, atomic counters).
- Security & Penetration Testing:
- Assess intra-tenant cross-project lateral movement.
- Verify cluster infrastructure isolation (Kubernetes API, Cloud Metadata SSRF).
- Local subnet discovery & port scanning.
- Outbound egress NAT and DNS leak behavior.
📂 Directory Structure
├── reports/
│ ├── GHAYMAH_MULTI_MICROSERVICES_SECURITY_REPORT.md # Multi-microservice SOC assessment report
│ └── GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md # Initial DNS & TCP baseline report
├── logs/
│ ├── soc_multiservice_execution.log # Multi-microservice execution log
│ ├── soc_multiservice_results.json # Structured test results (JSON)
│ ├── ghaymah_execution.log # Baseline test execution log
│ └── uniquename_dns_tcp.log # Raw TCP test log
├── scripts/
│ ├── deploy_soc_gateway_node_app.js # Deploys active Node.js Edge Gateway & Microservice Proxy
│ ├── deploy_clean_gateway_artifact.js # Initial artifact deployment prototype
│ ├── delete_old_gateway.js # Retires old ttyd terminal container
│ ├── delete_static_app.js # Cleans up temporary cumin.dev static app
│ ├── make_backend_private.js # Enforces strict private backend isolation
│ ├── create_soc_microservices_project.js # Deploys the multi-microservice project
│ ├── run_soc_multiservice_tests.js # Automated multi-service test runner
│ ├── monitor_soc_project.js # Deployment status polling
│ ├── remote_exec.js # WebSocket terminal execution client
│ ├── test_soc_redis_tcp.js # Raw TCP protocol tester
│ └── auth_manager.js # Ghaymah authentication manager
├── soc_gateway_ui/ # SOC Dashboard & Gateway application assets
│ ├── server.js # Node.js Edge Gateway server & microservice proxy
│ ├── index.html # Full SOC Command Center HTML UI
│ └── app.zip # Deployment bundle
├── soc_project_topology.json # Full project resource definition & metadata
├── soc_static_gateway.json # Static Gateway lifecycle metadata (Deprecated/Deleted)
└── token.json # Authenticated session token (auto-managed)
📊 Summary of Findings Matrix
| Test Domain | Target Service | Result | Classification | Key Observation |
|---|---|---|---|---|
| Edge Ingress UI | soc-gateway-live |
PASS | Functional | HTTP 200 via hosted.ghaymah.systems (Node.js Edge Gateway, full SOC UI active, 9/9 services online) |
| Internal DNS | soc-redis-10f420c389ef |
PASS | Functional | Resolves to 10.42.5.99 via CoreDNS |
| Internal DNS | soc-backend-d1895c70f6b2 |
PASS | Functional | Resolves to 10.42.5.103 via CoreDNS |
| Internal DNS | soc-gateway-live |
PASS | Functional | Resolves via deterministic unique name |
| Raw TCP | soc-redis:6379 |
PASS | Functional | PING \rightarrow +PONG, SET/GET threat alerts verified |
| Inter-Service Mesh | soc-gateway \rightarrow soc-redis |
PASS | Functional | Edge Gateway queries Database directly over mesh (3ms latency) |
| Backend Isolation | soc-backend (Public URL) |
PASS | Secure | HTTP 404 / Strictly private internal service (publicAccess: false) |
| Database Isolation | soc-redis (Public URL) |
PASS | Secure | HTTP 404 / Blocked from public internet |
| Project Isolation | Cross-project Redis/HTTP | FINDING | Medium/High | Projects in same account share flat mesh network |
| Cluster Boundary | K8s API (10.43.0.1:443) |
PASS | Secure | HTTP 401 Unauthorized (RBAC enforced) |
| SSRF / Cloud Meta | AWS/Cloud Metadata (169.254.169.254) |
PASS | Secure | Blocked / Unreachable |
| Cluster Telemetry | CoreDNS Metrics (10.43.0.10:9153) |
INFO | Low | Prometheus metrics exposed internally |
🚀 Execution & Verification
To run the automated multi-microservice tests:
# 1. Verify Authentication
node scripts/auth_manager.js
# 2. Run Comprehensive Test Suite
node scripts/run_soc_multiservice_tests.js