Christian Maier

Backup job of persistence2: daily mariadb-dump of the catalogue's MariaDB to Backblaze B2.

OpenSSH on Alpine as a tunnel to one MariaDB container: keys only, no shell, no root, nothing else.

MariaDB 11.4 LTS (official image) plus the hvergelmir catalogue's configuration; runs non-root.

Container management of the base platform: official Portainer CE, non-root, linux/amd64 and arm64

Docker socket proxy of the base platform: one client, reading only, allowed paths, amd64/arm64

Container metrics of the base platform: cAdvisor built from source, Docker via a read-only proxy

Interface of the base platform: Grafana without unused plugins, provisioned from Git, amd64/arm64

Host metrics of the base platform: node_exporter built from source, read-only host view, amd64/arm64

CrowdSec engine built from source, hub content pinned: bans scanners found in base 2 proxy logs

Probes of the base platform: Blackbox Exporter built from source, non-root, linux/amd64 and arm64

VPN of the base platform: WireGuard with DNS, forwarding to the admin network only, amd64/arm64

Metrics of the base platform: Prometheus with its scrape configuration, linux/amd64 and linux/arm64

Caddy built from source with CrowdSec bouncer, Coraza WAF (OWASP CRS) and GeoIP: proxy of base 2

hvergelmir php base image