Found while going through the selfh.st directory.
The asymmetry
This repository is unusually rigorous about container supply chain: every image carries a tag and a sha256: digest, CI enforces it, make pin-digests re-resolves it, and Dependabot opens a PR per bump. docs/security.md names image supply-chain compromise as accepted and undefended, and digest pinning is the mitigation that narrows it.
None of that applies to the hosts underneath:
| Host |
OS |
How its patch state is known today |
morpheus |
FreeBSD 15.0 (pfSense) |
By logging in and looking |
Saruman |
Proxmox VE 9.2.11 |
By logging in and looking |
prometheus |
Ubuntu Server 24.04.3 |
By logging in and looking |
oracle |
Ubuntu Server 24.04.3 |
By logging in and looking |
docs/security.md lists "a vulnerability in pfSense itself" as an accepted, undefended threat — which is a reasonable position to take deliberately, and a much weaker one if nobody knows how far behind that host is.
A container image is pinned, scanned, diffed and PR'd. The kernel it runs on is patched when someone remembers.
Proposed
PatchMon — agent-based Linux patch monitoring with a dashboard, ~3.3k stars, active. Covers the two Ubuntu hosts and probably Proxmox; will not cover the FreeBSD firewall, which is the host where this matters most, so it is a partial answer at best.
Cheaper alternatives worth pricing first, given the estate is four machines and not four hundred:
node_exporter's apt textfile collector on the Ubuntu hosts, scraped by the Prometheus that already exists, with a rule for "N security updates pending for M days". No new service, fits ADR-0004, and reuses config.alloy unchanged.- For
morpheus, pfSense reports available updates in its own UI and via SNMP; whether the current snmp-exporter module can reach that is worth checking as part of this.
The point of the issue is the gap, not the tool. A four-host estate probably wants the exporter, not another web UI.
Which VLAN this touches
🔴 99 — Winterfell (management)
🟢 30 — ImaginationLAN (lab)
Security review
Related
#88 (agents on Saruman and oracle — this rides on the same work), #105.
Found while going through the selfh.st directory.
The asymmetry
This repository is unusually rigorous about container supply chain: every image carries a tag and a
sha256:digest, CI enforces it,make pin-digestsre-resolves it, and Dependabot opens a PR per bump.docs/security.mdnames image supply-chain compromise as accepted and undefended, and digest pinning is the mitigation that narrows it.None of that applies to the hosts underneath:
morpheusSarumanprometheusoracledocs/security.mdlists "a vulnerability in pfSense itself" as an accepted, undefended threat — which is a reasonable position to take deliberately, and a much weaker one if nobody knows how far behind that host is.A container image is pinned, scanned, diffed and PR'd. The kernel it runs on is patched when someone remembers.
Proposed
PatchMon — agent-based Linux patch monitoring with a dashboard, ~3.3k stars, active. Covers the two Ubuntu hosts and probably Proxmox; will not cover the FreeBSD firewall, which is the host where this matters most, so it is a partial answer at best.
Cheaper alternatives worth pricing first, given the estate is four machines and not four hundred:
node_exporter'sapttextfile collector on the Ubuntu hosts, scraped by the Prometheus that already exists, with a rule for "N security updates pending for M days". No new service, fits ADR-0004, and reusesconfig.alloyunchanged.morpheus, pfSense reports available updates in its own UI and via SNMP; whether the currentsnmp-exportermodule can reach that is worth checking as part of this.The point of the issue is the gap, not the tool. A four-host estate probably wants the exporter, not another web UI.
Which VLAN this touches
🔴 99 — Winterfell (management)
🟢 30 — ImaginationLAN (lab)
Security review
secrets/*.sops.yamldocs/network.mdwith an OUI-truncated MAC — n/aRelated
#88 (agents on
Sarumanandoracle— this rides on the same work), #105.