Ghaymah Systems — Private Networking, Internal DNS & Multi-Microservice Testing Suite

Comprehensive Automated QA, Internal DNS, Raw TCP, Inter-Service Mesh, and Penetration Testing Suite for Ghaymah Systems (deploy.ghaymah.systems).

🌐 Live Deployed Applications

• Edge SOC Command Center Gateway: 👉 https://ghaymah-soc-gateway-ac352412-web-3e953576.hosted.cumin.dev (Status: Live / Healthy — Serves the full interactive Security Operations Center dashboard)
• Private SOC Backend (soc-backend): Status: Strictly Private (Public Access: Disabled — Returns HTTP 404 externally)
• Private SOC Database (soc-redis): Status: Strictly Private (Raw TCP port 6379 only — Returns HTTP 404 externally)

---

📋 Comprehensive Assessment Reports

1. 👉 Multi-Microservice Architecture & Security Report (Project: ghaymah-soc-microservices)
   • Complete SOC multi-service topology: Edge Gateway, Private REST Backend, Private Redis Database, and Diagnostic Pod.
   • Inter-service mesh routing, Raw TCP Redis transactions, and cross-project penetration testing findings.
2. 👉 Internal DNS & Private Networking Report (Project: dns-tcp-test)
   • Baseline discovery, CoreDNS resolution formula verification, and tenant isolation benchmarks.

---

🎯 Scope & Objectives

1. Multi-Microservice Architecture: Deploy a real 4-tier microservice application directly on Ghaymah:
   • ghaymah-soc-gateway: Public edge ingress, reverse proxy, and interactive UI dashboard.
   • soc-backend: Private analysis engine listening on port 4000 (strictly internal).
   • soc-redis: Private threat intelligence database & cache on port 6379.
   • soc-tester: Live DevSecOps testing pod.
2. Internal DNS Verification: Verify container-to-container service discovery via CoreDNS (10.43.0.10:53) using deterministic unique names ([name]-[hash]).
3. Raw TCP Socket Connectivity: Validate non-HTTP socket communication over port 6379 (Redis handshake, write, read, atomic counters).
4. Security & Penetration Testing:
   • Assess intra-tenant cross-project lateral movement.
   • Verify cluster infrastructure isolation (Kubernetes API, Cloud Metadata SSRF).
   • Local subnet discovery & port scanning.
   • Outbound egress NAT and DNS leak behavior.

---

📂 Directory Structure

├── reports/
│   ├── GHAYMAH_MULTI_MICROSERVICES_SECURITY_REPORT.md  # Multi-microservice SOC assessment report
│   └── GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md         # Initial DNS & TCP baseline report
├── logs/
│   ├── soc_multiservice_execution.log                 # Multi-microservice execution log
│   ├── soc_multiservice_results.json                  # Structured test results (JSON)
│   ├── ghaymah_execution.log                          # Baseline test execution log
│   └── uniquename_dns_tcp.log                         # Raw TCP test log
├── scripts/
│   ├── deploy_static_soc_gateway.js                   # Deploys live SOC Command Center UI
│   ├── make_backend_private.js                        # Enforces strict private backend isolation
│   ├── create_soc_microservices_project.js            # Deploys the multi-microservice project
│   ├── run_soc_multiservice_tests.js                  # Automated multi-service test runner
│   ├── monitor_soc_project.js                         # Deployment status polling
│   ├── remote_exec.js                                 # WebSocket terminal execution client
│   ├── test_soc_redis_tcp.js                          # Raw TCP protocol tester
│   └── auth_manager.js                                # Ghaymah authentication manager
├── soc_gateway_ui/                                    # Extracted SOC Dashboard static assets
│   ├── index.html                                     # Full SOC Command Center HTML UI
│   └── app.zip                                        # Deployment bundle
├── soc_project_topology.json                          # Full project resource definition & metadata
├── soc_static_gateway.json                            # Live Gateway metadata
└── token.json                                         # Authenticated session token (auto-managed)

---

📊 Summary of Findings Matrix

Test Domain	Target Service	Result	Classification	Key Observation
Internal DNS	soc-redis-10f420c389ef	PASS	Functional	Resolves to 10.42.5.99 via CoreDNS
Internal DNS	soc-backend-d1895c70f6b2	PASS	Functional	Resolves to 10.42.5.103 via CoreDNS
Internal DNS	soc-gateway-28cd1dc4e034	PASS	Functional	Resolves to 10.42.5.101 via CoreDNS
Raw TCP	soc-redis:6379	PASS	Functional	PING \rightarrow +PONG, SET/GET threat alerts verified
Inter-Service Mesh	soc-gateway \rightarrow soc-redis	PASS	Functional	Edge Gateway queries Database directly over mesh
Edge Ingress	ghaymah-soc-gateway	PASS	Functional	HTTP 200 via hosted.cumin.dev (Full UI active)
Backend Isolation	soc-backend (Public URL)	PASS	Secure	HTTP 404 / Strictly private internal service
Database Isolation	soc-redis (Public URL)	PASS	Secure	HTTP 404 / Blocked from public internet
Project Isolation	Cross-project Redis/HTTP	FINDING	Medium/High	Projects in same account share flat mesh network
Cluster Boundary	K8s API (10.43.0.1:443)	PASS	Secure	HTTP 401 Unauthorized (RBAC enforced)
SSRF / Cloud Meta	AWS/Cloud Metadata (169.254.169.254)	PASS	Secure	Blocked / Unreachable
Cluster Telemetry	CoreDNS Metrics (10.43.0.10:9153)	INFO	Low	Prometheus metrics exposed internally

---

🚀 Execution & Verification

To run the automated multi-microservice tests:

# 1. Verify Authentication
node scripts/auth_manager.js

# 2. Run Comprehensive Test Suite
node scripts/run_soc_multiservice_tests.js