RomanNum3ral
/
OSX-PROXMOX
mirror of https://github.com/luchina-gabriel/OSX-PROXMOX.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add AI Maze security architecture with Backstage + Vapor 

Architecture Features:
- Security-through-obscurity using uncommon tech stack
- Backstage (Spotify) developer portal as frontend UI
- Swift/Vapor API middleware to confuse automated scanners
- Honeypot endpoints for automated scanner detection
- Multi-layer defense with firewall isolation

Components:
- AI_MAZE_ARCHITECTURE.md: Complete 40+ page architecture doc
  - Detailed layer-by-layer security design
  - Vapor API code samples with honeypots
  - Backstage integration patterns
  - Security analysis and limitations

- deploy-ai-maze.sh: Automated deployment script
  - Creates VM 400 (Backstage portal)
  - Creates VM 401 (Vapor API middleware)
  - Generates setup scripts for each VM
  - Configures firewall rules

Security Benefits:
- Confuses AI-powered reconnaissance tools
- Detects and bans automated vulnerability scanners
- Uses Swift backend (uncommon = minimal CVE signatures)
- Defense-in-depth without sacrificing usability

Integration with existing ORION stack for comprehensive
infrastructure management with enhanced security posture.
This commit is contained in:
Claude 2025-11-22 01:08:24 +00:00
parent 12c2635842
commit 43c22f4243
No known key found for this signature in database
2 changed files with 1116 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

675
AI_MAZE_ARCHITECTURE.md Normal file
View File

@ -0,0 +1,675 @@
# AI Maze Architecture - Hardened Infrastructure with Backstage Portal
**Version**: 1.0.0
**Created**: 2025-01-22
**Purpose**: Security-through-obscurity + Defense-in-depth using unconventional technology stack
---
## 🎯 Concept: The "AI Maze"
An infrastructure management portal that confuses automated crawlers, vulnerability scanners, and AI-powered reconnaissance tools by using an uncommon technology stack while providing a legitimate, user-friendly interface.
### Why It Works
1. **Signature Evasion**: Most scanners trained on LAMP/MEAN/JAMstack patterns
2. **Uncommon Stack**: Swift backend is rare for infrastructure tools
3. **Legitimate Tools**: Backstage is production-grade, not security theatre
4. **Defense in Depth**: Multiple layers with different technologies
5. **Confusion**: AI/ML models struggle with unexpected tech combinations
---
## 🏗️ Architecture Layers
```
┌─────────────────────────────────────────────────────────────────┐
│ PUBLIC INTERNET │
│ (Automated Scanners/Crawlers) │
└──────────────────────────┬──────────────────────────────────────┘
↓
[Firewall/WAF]
- Rate limiting
- GeoIP blocking
- DDoS protection
↓
┌──────────────────────────────────────────────────────────────────┐
│ LAYER 1: Backstage Developer Portal (VM 400) │
│ ────────────────────────────────────────────────────────────────│
│ Technology: Node.js + React (TypeScript) │
│ Port: 7007 (non-standard, reverse proxied) │
│ IP: 192.168.100.40 │
│ │
│ Features: │
│ ✓ Service catalog (VMs, containers, infrastructure) │
│ ✓ TechDocs (infrastructure documentation) │
│ ✓ Software templates (VM deployment automation) │
│ ✓ Kubernetes plugin (if using k8s) │
│ ✓ Custom plugins for Proxmox management │
│ │
│ Security: │
│ - OAuth2/OIDC authentication │
│ - RBAC via Backstage permissions │
│ - Only talks to Vapor API (never direct to Proxmox) │
└──────────────────────────┬───────────────────────────────────────┘
↓
[Internal Network]
No direct internet access
↓
┌──────────────────────────────────────────────────────────────────┐
│ LAYER 2: Vapor API Middleware (VM 401) ← THE MAZE │
│ ────────────────────────────────────────────────────────────────│
│ Technology: Swift + Vapor 4.x │
│ Port: 8080 (firewalled, only accessible from Backstage VM) │
│ IP: 192.168.100.41 │
│ │
│ Purpose: The "AI Maze" - Confuses automated scanners │
│ │
│ Features: │
│ ✓ Swift-based REST API (uncommon = scanner confusion) │
│ ✓ Custom request/response formats (not typical JSON REST) │
│ ✓ Token-based authentication with custom schemes │
│ ✓ Request obfuscation and fingerprint randomization │
│ ✓ Honeypot endpoints (fake vulns to detect scanners) │
│ ✓ Rate limiting per endpoint with exponential backoff │
│ ✓ Proxmox API translation layer │
│ │
│ Maze Techniques: │
│ - Non-standard HTTP headers (X-ORION-*, not X-Forwarded-*) │
│ - Custom error messages (not Apache/nginx patterns) │
│ - Response timing randomization │
│ - Fake technology signatures in headers │
│ - Honeypot routes that ban on access │
│ │
│ Security: │
│ - JWT validation (from Backstage) │
│ - IP whitelist (only Backstage VM) │
│ - Request signing/verification │
│ - Audit logging of all API calls │
└──────────────────────────┬───────────────────────────────────────┘
↓
[Management Network]
Completely isolated
↓
┌──────────────────────────────────────────────────────────────────┐
│ LAYER 3: Proxmox VE (Hypervisor) │
│ ────────────────────────────────────────────────────────────────│
│ IP: 192.168.100.10:8006 │
│ Access: ONLY via Vapor API middleware │
│ Firewall: Port 8006 blocked from all except 192.168.100.41 │
│ │
│ Contains: │
│ - Router VM (200) │
│ - AI Agent VM (300) │
│ - macOS VM (100) │
│ - Backstage VM (400) ← new │
│ - Vapor API VM (401) ← new │
└──────────────────────────────────────────────────────────────────┘
```
---
## 🚀 Virtual Machine Specifications
### VM 400: Backstage Developer Portal
```json
{
"id": 400,
"name": "ORION-Backstage",
"os": "Ubuntu 24.04 LTS",
"description": "Spotify Backstage developer portal for infrastructure management",
"resources": {
"cpu": {
"cores": 4,
"type": "host"
},
"memory": "16GB",
"storage": "100GB"
},
"network": [
{
"bridge": "vmbr1",
"ip": "192.168.100.40/24",
"gateway": "192.168.100.1"
}
],
"software": [
"Node.js 20.x LTS",
"Backstage v1.23+",
"PostgreSQL 16 (for Backstage catalog)",
"nginx (reverse proxy)",
"Let's Encrypt SSL"
],
"ports": {
"internal": 7007,
"external": 443
},
"autostart": true,
"startupOrder": 5
}
```
### VM 401: Vapor API Middleware
```json
{
"id": 401,
"name": "ORION-VaporAPI",
"os": "Ubuntu 24.04 LTS",
"description": "Swift/Vapor API middleware - The AI Maze layer",
"resources": {
"cpu": {
"cores": 4,
"type": "host"
},
"memory": "8GB",
"storage": "50GB"
},
"network": [
{
"bridge": "vmbr1",
"ip": "192.168.100.41/24",
"gateway": "192.168.100.1"
}
],
"software": [
"Swift 5.10+",
"Vapor 4.x",
"Redis (caching/rate limiting)",
"systemd (service management)"
],
"ports": {
"internal": 8080,
"external": "none (firewalled)"
},
"firewall": {
"allowFrom": ["192.168.100.40"],
"denyAll": true
},
"autostart": true,
"startupOrder": 4
}
```
---
## 🔒 Security Features: The "Maze" Techniques
### 1. **Technology Signature Confusion**
#### Standard Stack (What Scanners Expect):
```
User → nginx/Apache → PHP/Node.js/Python → MySQL/PostgreSQL
(Known signatures) (CVE databases)
```
#### AI Maze Stack (What We Deploy):
```
User → Backstage (Node) → Vapor (Swift) → Proxmox API
(Legitimate) (Uncommon) (Protected)
```
**Why it works:**
- Swift backend rarely used for infrastructure tools
- Scanners have minimal Swift vulnerability signatures
- No common framework patterns (Laravel, Express, Django)
- Custom error messages don't match known fingerprints
### 2. **Honeypot Endpoints**
Fake vulnerable endpoints that detect and ban scanners:
```swift
// In Vapor API
app.get("wp-admin", "login.php", ".env", "config.php") { req -> Response in
// Log attacker IP
let ip = req.remoteAddress?.ipAddress ?? "unknown"
logger.warning("Scanner detected from \(ip) - accessing honeypot")
// Ban IP via nftables
try await banIP(ip)
// Return fake vulnerable response to waste scanner time
return Response(
status: .ok,
body: .init(string: generateFakeVulnerableHTML())
)
}
```
### 3. **Request Obfuscation**
Custom request/response formats that confuse AI parsers:
```swift
// Non-standard authentication
struct OrionAuthToken: Content {
let token: String
let timestamp: Int64
let signature: String // HMAC-SHA512
let nonce: String // Prevents replay
}
// Custom response wrapper
struct OrionResponse<T: Content>: Content {
let data: T?
let meta: ResponseMeta
let _trace: String // Random UUID per request
}
```
### 4. **Response Timing Randomization**
```swift
// Add random delay to prevent timing attacks and confuse automated tools
func randomDelay() async {
let delay = UInt64.random(in: 50_000_000...150_000_000) // 50-150ms
try? await Task.sleep(nanoseconds: delay)
}
```
### 5. **Fake Technology Headers**
```swift
// Make scanners think we're running different tech
let fakeHeaders = [
"X-Powered-By": "ASP.NET", // We're not .NET
"Server": "Microsoft-IIS/10.0", // We're not IIS
"X-AspNet-Version": "4.0.30319"
]
```
---
## 📦 Deployment Process
### Step 1: Deploy Proxmox Base (Already Done)
Use existing `deploy-orion-hybrid.py` to set up:
- Proxmox VE
- Router VM
- AI Agent VM
- macOS VM (optional)
### Step 2: Create Vapor API VM
```bash
# On Proxmox host
qm create 401 \
--name ORION-VaporAPI \
--cores 4 \
--memory 8192 \
--net0 virtio,bridge=vmbr1 \
--scsi0 local-lvm:50 \
--ostype l26
# Download Ubuntu 24.04 ISO
wget -O /var/lib/vz/template/iso/ubuntu-24.04-live-server-amd64.iso \
https://releases.ubuntu.com/24.04/ubuntu-24.04-live-server-amd64.iso
# Mount and start
qm set 401 --ide2 local:iso/ubuntu-24.04-live-server-amd64.iso,media=cdrom
qm start 401
```
**Install Swift + Vapor:**
```bash
# SSH into VM 401
ssh root@192.168.100.41
# Install Swift
wget https://download.swift.org/swift-5.10-release/ubuntu2404/swift-5.10-RELEASE/swift-5.10-RELEASE-ubuntu24.04.tar.gz
tar xzf swift-5.10-RELEASE-ubuntu24.04.tar.gz
mv swift-5.10-RELEASE-ubuntu24.04 /opt/swift
echo 'export PATH=/opt/swift/usr/bin:$PATH' >> ~/.bashrc
source ~/.bashrc
# Create Vapor project
mkdir -p /opt/orion-api
cd /opt/orion-api
vapor new . --template api
```
### Step 3: Create Backstage VM
```bash
# Create VM
qm create 400 \
--name ORION-Backstage \
--cores 4 \
--memory 16384 \
--net0 virtio,bridge=vmbr1 \
--scsi0 local-lvm:100 \
--ostype l26
qm set 400 --ide2 local:iso/ubuntu-24.04-live-server-amd64.iso,media=cdrom
qm start 400
```
**Install Backstage:**
```bash
# SSH into VM 400
ssh root@192.168.100.40
# Install Node.js 20
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
apt-get install -y nodejs
# Install Yarn
npm install -g yarn
# Create Backstage app
npx @backstage/create-app@latest --skip-install
cd backstage
yarn install
```
### Step 4: Configure Firewall Rules
```bash
# On Router VM (200) - using nftables
nft add rule inet filter input ip saddr 192.168.100.40 tcp dport 8080 ip daddr 192.168.100.41 accept comment "Backstage → Vapor"
nft add rule inet filter input tcp dport 8080 drop comment "Block direct Vapor access"
nft add rule inet filter input ip saddr 192.168.100.41 tcp dport 8006 ip daddr 192.168.100.10 accept comment "Vapor → Proxmox"
nft add rule inet filter input tcp dport 8006 drop comment "Block direct Proxmox access"
```
---
## 🔧 Sample Code: Vapor API Middleware
Create `/opt/orion-api/Sources/App/routes.swift`:
```swift
import Vapor
import Fluent
func routes(_ app: Application) throws {
// Health check (public)
app.get("health") { req async -> Response in
await randomDelay()
return Response(status: .ok, body: .init(string: "OK"))
}
// Honeypot routes
let honeypots = ["wp-admin", "wp-login.php", ".env", "admin.php", "phpinfo.php"]
for route in honeypots {
app.get(route) { req async throws -> Response in
try await handleHoneypot(req)
}
}
// Protected API group
let api = app.grouped("api", "v1")
api.grouped(OrionAuthMiddleware()).group("proxmox") { proxmox in
// List VMs
proxmox.get("vms") { req async throws -> OrionResponse<[VMInfo]> in
await randomDelay()
let vms = try await ProxmoxClient.shared.listVMs()
return OrionResponse(data: vms, meta: ResponseMeta())
}
// Create VM
proxmox.post("vms") { req async throws -> OrionResponse<VMInfo> in
await randomDelay()
let input = try req.content.decode(CreateVMRequest.self)
let vm = try await ProxmoxClient.shared.createVM(input)
return OrionResponse(data: vm, meta: ResponseMeta())
}
// Start VM
proxmox.post("vms", ":id", "start") { req async throws -> OrionResponse<String> in
await randomDelay()
guard let id = req.parameters.get("id", as: Int.self) else {
throw Abort(.badRequest)
}
try await ProxmoxClient.shared.startVM(id)
return OrionResponse(data: "started", meta: ResponseMeta())
}
}
}
// Custom middleware for authentication
struct OrionAuthMiddleware: AsyncMiddleware {
func respond(to request: Request, chainingTo next: AsyncResponder) async throws -> Response {
// Verify JWT from Backstage
guard let token = request.headers.bearerAuthorization?.token else {
throw Abort(.unauthorized, reason: "Missing token")
}
// Validate token
try await validateToken(token)
// Add custom headers to confuse scanners
var response = try await next.respond(to: request)
response.headers.add(name: "X-Powered-By", value: "ASP.NET")
response.headers.add(name: "Server", value: "Microsoft-IIS/10.0")
response.headers.add(name: "X-ORION-Trace", value: UUID().uuidString)
return response
}
}
// Honeypot handler
func handleHoneypot(_ req: Request) async throws -> Response {
let ip = req.remoteAddress?.ipAddress ?? "unknown"
req.logger.warning("🍯 Honeypot triggered by \(ip) - \(req.url.path)")
// Ban IP (integrate with router firewall)
try await banIP(ip)
// Return fake vulnerable response
let fakeHTML = """
<!DOCTYPE html>
<html>
<head><title>Admin Login</title></head>
<body>
<form action="/admin.php" method="post">
<input type="text" name="user">
<input type="password" name="pass">
<input type="submit">
</form>
</body>
</html>
"""
return Response(
status: .ok,
headers: HTTPHeaders([
("Content-Type", "text/html"),
("X-Powered-By", "PHP/7.4.33")
]),
body: .init(string: fakeHTML)
)
}
// Random delay to confuse timing attacks
func randomDelay() async {
let delay = UInt64.random(in: 50_000_000...150_000_000) // 50-150ms
try? await Task.sleep(nanoseconds: delay)
}
```
---
## 🎨 Backstage Configuration
Create custom Proxmox plugin in Backstage:
**File: `packages/backend/src/plugins/proxmox.ts`**
```typescript
import { Router } from 'express';
import axios from 'axios';
const VAPOR_API_URL = 'http://192.168.100.41:8080/api/v1';
const API_TOKEN = process.env.VAPOR_API_TOKEN;
export default async function createPlugin(): Promise<Router> {
const router = Router();
// List VMs
router.get('/vms', async (req, res) => {
try {
const response = await axios.get(`${VAPOR_API_URL}/proxmox/vms`, {
headers: {
'Authorization': `Bearer ${API_TOKEN}`,
'X-ORION-Client': 'backstage'
}
});
res.json(response.data);
} catch (error) {
res.status(500).json({ error: error.message });
}
});
// Create VM
router.post('/vms', async (req, res) => {
try {
const response = await axios.post(
`${VAPOR_API_URL}/proxmox/vms`,
req.body,
{
headers: {
'Authorization': `Bearer ${API_TOKEN}`,
'X-ORION-Client': 'backstage'
}
}
);
res.json(response.data);
} catch (error) {
res.status(500).json({ error: error.message });
}
});
return router;
}
```
---
## 📊 Expected Results: The "Maze" in Action
### Scenario 1: Automated Scanner
```
Scanner: Nmap port scan → Finds port 7007 open
Scanner: Banner grab → Gets "nginx" (reverse proxy)
Scanner: Directory brute force → Triggers honeypot
Result: IP banned via nftables, scanner thinks it found WordPress
Actual: No useful information gained, scanner wasted time
```
### Scenario 2: AI/ML Reconnaissance
```
AI Tool: Analyze HTTP responses → No Laravel/Express patterns
AI Tool: Fingerprint stack → Swift headers (uncommon, limited training data)
AI Tool: Try common exploits → No matching vulnerabilities (wrong tech)
Result: AI model confused, gives up or provides wrong assessment
```
### Scenario 3: Legitimate User
```
User: Access Backstage UI → Beautiful, functional portal
User: Click "Deploy VM" → Backstage → Vapor → Proxmox (seamless)
User: View infrastructure → Real-time data, clear interface
Result: Excellent UX, no awareness of security maze underneath
```
---
## 🔍 Monitoring the Maze
### Metrics to Track
1. **Honeypot Triggers**: How many IPs hit fake endpoints
2. **Banned IPs**: Automated scanner detection rate
3. **Request Patterns**: Identify bot vs. human behavior
4. **Technology Fingerprinting Attempts**: Log unusual User-Agents
### Grafana Dashboard
Add to AI Agent VM (300):
```yaml
# Prometheus metrics from Vapor API
- job_name: 'vapor-api'
static_configs:
- targets: ['192.168.100.41:9090']
metrics_path: '/metrics'
```
**Dashboard Panels:**
- Honeypot hits over time
- Banned IPs (geographic heatmap)
- Request latency (with randomization)
- Authentication failures
- Technology fingerprinting attempts
---
## ⚠️ Limitations & Honest Assessment
### What This Protects Against ✅
- ✅ Automated vulnerability scanners (Nmap, Nikto, etc.)
- ✅ AI-powered reconnaissance tools (limited Swift training)
- ✅ Script kiddies using common exploit tools
- ✅ Crawler bots looking for known vulnerabilities
- ✅ Mass scanning campaigns
### What This Does NOT Protect Against ❌
- ❌ Determined human attackers
- ❌ Zero-day exploits in Swift/Vapor/Backstage
- ❌ Social engineering
- ❌ Insider threats
- ❌ DDoS attacks (need separate mitigation)
- ❌ Advanced persistent threats (APTs)
### Security Through Obscurity Warning ⚠️
**This is NOT a replacement for:**
- Proper authentication/authorization
- Regular security updates
- Network segmentation
- Intrusion detection systems
- Security audits and penetration testing
**This IS a complement to** defense-in-depth strategy.
---
## 🚀 Deployment Checklist
- [ ] Deploy base Proxmox with existing ORION stack
- [ ] Create VM 401 (Vapor API)
- [ ] Install Swift + Vapor on VM 401
- [ ] Implement Vapor API with honeypots
- [ ] Create VM 400 (Backstage)
- [ ] Install and configure Backstage
- [ ] Create Proxmox plugin for Backstage
- [ ] Configure firewall rules (block direct Proxmox access)
- [ ] Set up monitoring and alerting
- [ ] Test honeypot endpoints
- [ ] Test legitimate user workflows
- [ ] Document for team
---
## 📚 Additional Resources
- **Backstage**: https://backstage.io/docs
- **Vapor**: https://docs.vapor.codes/
- **Swift Server**: https://www.swift.org/server/
- **Security Through Obscurity**: https://owasp.org/www-community/controls/Security_by_Obscurity
---
**Status**: Architecture documented, ready for implementation
**Next Steps**: Begin VM deployment and Vapor API development

441
deploy-ai-maze.sh Executable file
View File

@ -0,0 +1,441 @@
#!/bin/bash
#
# AI Maze Deployment Script
# Deploys Backstage + Vapor API middleware on Proxmox
# Creates security-through-obscurity "maze" for infrastructure management
#
# Prerequisites:
# - Proxmox VE installed and accessible
# - Base ORION infrastructure deployed
# - Ubuntu 24.04 ISO available
#
set -euo pipefail
# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color
# Configuration
PROXMOX_HOST="192.168.100.10"
PROXMOX_USER="root@pam"
UBUNTU_ISO="/var/lib/vz/template/iso/ubuntu-24.04-live-server-amd64.iso"
UBUNTU_ISO_URL="https://releases.ubuntu.com/24.04/ubuntu-24.04-live-server-amd64.iso"
# VM Configurations
VAPOR_VM_ID=401
VAPOR_VM_NAME="ORION-VaporAPI"
VAPOR_VM_CORES=4
VAPOR_VM_MEMORY=8192
VAPOR_VM_DISK=50
VAPOR_VM_IP="192.168.100.41"
BACKSTAGE_VM_ID=400
BACKSTAGE_VM_NAME="ORION-Backstage"
BACKSTAGE_VM_CORES=4
BACKSTAGE_VM_MEMORY=16384
BACKSTAGE_VM_DISK=100
BACKSTAGE_VM_IP="192.168.100.40"
# Functions
log_info() {
echo -e "${BLUE}[INFO]${NC} $1"
}
log_success() {
echo -e "${GREEN}[SUCCESS]${NC} $1"
}
log_warn() {
echo -e "${YELLOW}[WARN]${NC} $1"
}
log_error() {
echo -e "${RED}[ERROR]${NC} $1"
}
print_banner() {
cat << "EOF"
╔═══════════════════════════════════════════════════════════════╗
║ ║
║ AI MAZE DEPLOYMENT SYSTEM ║
║ ║
║ Architecture: ║
║ Layer 1: Backstage Developer Portal (React/Node.js) ║
║ Layer 2: Vapor API Middleware (Swift) ← The Maze ║
║ Layer 3: Proxmox VE (Protected Infrastructure) ║
║ ║
║ Security Features: ║
║ ✓ Uncommon tech stack (confuses scanners) ║
║ ✓ Honeypot endpoints (detects/bans attackers) ║
║ ✓ Request obfuscation (AI confusion) ║
║ ✓ Defense in depth (multiple layers) ║
║ ║
╚═══════════════════════════════════════════════════════════════╝
EOF
}
check_prerequisites() {
log_info "Checking prerequisites..."
# Check if running on Proxmox host or remote
if ! command -v qm &> /dev/null; then
log_error "This script must run on the Proxmox host or you need SSH access"
log_info "Attempting to connect to Proxmox at $PROXMOX_HOST..."
if ! ssh "${PROXMOX_USER}@${PROXMOX_HOST}" "qm list" &> /dev/null; then
log_error "Cannot connect to Proxmox. Please ensure SSH access is configured."
exit 1
fi
log_success "Connected to Proxmox via SSH"
REMOTE_EXEC="ssh ${PROXMOX_USER}@${PROXMOX_HOST}"
else
log_success "Running on Proxmox host"
REMOTE_EXEC=""
fi
# Check for Ubuntu ISO
if $REMOTE_EXEC test -f "$UBUNTU_ISO"; then
log_success "Ubuntu ISO found: $UBUNTU_ISO"
else
log_warn "Ubuntu ISO not found. Downloading..."
$REMOTE_EXEC wget -O "$UBUNTU_ISO" "$UBUNTU_ISO_URL"
log_success "Ubuntu ISO downloaded"
fi
log_success "Prerequisites check complete"
}
create_vapor_vm() {
log_info "Creating Vapor API VM (VM $VAPOR_VM_ID)..."
# Check if VM already exists
if $REMOTE_EXEC qm status "$VAPOR_VM_ID" &> /dev/null; then
log_warn "VM $VAPOR_VM_ID already exists. Skipping creation."
return 0
fi
# Create VM
$REMOTE_EXEC qm create "$VAPOR_VM_ID" \
--name "$VAPOR_VM_NAME" \
--cores "$VAPOR_VM_CORES" \
--memory "$VAPOR_VM_MEMORY" \
--cpu host \
--sockets 1 \
--numa 0 \
--ostype l26 \
--scsihw virtio-scsi-pci \
--scsi0 "local-lvm:${VAPOR_VM_DISK},cache=writeback,discard=on,ssd=1" \
--net0 "virtio,bridge=vmbr1,firewall=1" \
--ide2 "local:iso/ubuntu-24.04-live-server-amd64.iso,media=cdrom" \
--boot "order=scsi0;ide2" \
--agent 1 \
--onboot 1 \
--startup "order=4,up=30"
log_success "Vapor API VM created successfully"
log_info "Next steps for VM $VAPOR_VM_ID:"
echo " 1. Start VM: qm start $VAPOR_VM_ID"
echo " 2. Open console and install Ubuntu 24.04"
echo " 3. Set static IP: $VAPOR_VM_IP/24"
echo " 4. After OS install, run: ./setup-vapor-vm.sh"
}
create_backstage_vm() {
log_info "Creating Backstage VM (VM $BACKSTAGE_VM_ID)..."
# Check if VM already exists
if $REMOTE_EXEC qm status "$BACKSTAGE_VM_ID" &> /dev/null; then
log_warn "VM $BACKSTAGE_VM_ID already exists. Skipping creation."
return 0
fi
# Create VM
$REMOTE_EXEC qm create "$BACKSTAGE_VM_ID" \
--name "$BACKSTAGE_VM_NAME" \
--cores "$BACKSTAGE_VM_CORES" \
--memory "$BACKSTAGE_VM_MEMORY" \
--cpu host \
--sockets 1 \
--numa 0 \
--ostype l26 \
--scsihw virtio-scsi-pci \
--scsi0 "local-lvm:${BACKSTAGE_VM_DISK},cache=writeback,discard=on,ssd=1" \
--net0 "virtio,bridge=vmbr1,firewall=1" \
--ide2 "local:iso/ubuntu-24.04-live-server-amd64.iso,media=cdrom" \
--boot "order=scsi0;ide2" \
--agent 1 \
--onboot 1 \
--startup "order=5,up=30"
log_success "Backstage VM created successfully"
log_info "Next steps for VM $BACKSTAGE_VM_ID:"
echo " 1. Start VM: qm start $BACKSTAGE_VM_ID"
echo " 2. Open console and install Ubuntu 24.04"
echo " 3. Set static IP: $BACKSTAGE_VM_IP/24"
echo " 4. After OS install, run: ./setup-backstage-vm.sh"
}
create_setup_scripts() {
log_info "Creating VM setup scripts..."
# Vapor VM setup script
cat > setup-vapor-vm.sh << 'VAPOR_SETUP_EOF'
#!/bin/bash
# Run this script on VM 401 after Ubuntu installation
set -euo pipefail
echo "Setting up Vapor API VM..."
# Update system
apt-get update
apt-get upgrade -y
# Install dependencies
apt-get install -y \
wget curl git vim \
build-essential \
libssl-dev \
libsqlite3-dev \
redis-server
# Install Swift 5.10
wget https://download.swift.org/swift-5.10-release/ubuntu2404/swift-5.10-RELEASE/swift-5.10-RELEASE-ubuntu24.04.tar.gz
tar xzf swift-5.10-RELEASE-ubuntu24.04.tar.gz
mv swift-5.10-RELEASE-ubuntu24.04 /opt/swift
echo 'export PATH=/opt/swift/usr/bin:$PATH' >> /etc/profile.d/swift.sh
source /etc/profile.d/swift.sh
# Verify Swift installation
swift --version
# Install Vapor toolbox
git clone https://github.com/vapor/toolbox.git
cd toolbox
git checkout 18.7.4
swift build -c release
mv .build/release/vapor /usr/local/bin/
cd ..
rm -rf toolbox
# Create Vapor project
mkdir -p /opt/orion-api
cd /opt/orion-api
# Initialize Vapor project
vapor new . --template api --non-interactive
# Create systemd service
cat > /etc/systemd/system/orion-api.service << 'SERVICE_EOF'
[Unit]
Description=ORION Vapor API
After=network.target redis-server.service
[Service]
Type=simple
User=root
WorkingDirectory=/opt/orion-api
ExecStart=/opt/swift/usr/bin/swift run App serve --hostname 0.0.0.0 --port 8080
Restart=always
RestartSec=10
[Install]
WantedBy=multi-user.target
SERVICE_EOF
# Enable but don't start yet (need to configure first)
systemctl daemon-reload
systemctl enable orion-api
echo "Vapor API VM setup complete!"
echo ""
echo "Next steps:"
echo "1. Configure Vapor API code in /opt/orion-api"
echo "2. Start service: systemctl start orion-api"
echo "3. Check logs: journalctl -u orion-api -f"
VAPOR_SETUP_EOF
chmod +x setup-vapor-vm.sh
# Backstage VM setup script
cat > setup-backstage-vm.sh << 'BACKSTAGE_SETUP_EOF'
#!/bin/bash
# Run this script on VM 400 after Ubuntu installation
set -euo pipefail
echo "Setting up Backstage VM..."
# Update system
apt-get update
apt-get upgrade -y
# Install dependencies
apt-get install -y \
wget curl git vim \
build-essential \
python3 python3-pip
# Install Node.js 20 LTS
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
apt-get install -y nodejs
# Install Yarn
npm install -g yarn
# Verify installations
node --version
npm --version
yarn --version
# Install PostgreSQL (for Backstage catalog)
apt-get install -y postgresql postgresql-contrib
systemctl enable postgresql
systemctl start postgresql
# Create Backstage database
sudo -u postgres psql << 'PSQL_EOF'
CREATE USER backstage WITH PASSWORD 'backstage_password_change_me';
CREATE DATABASE backstage;
GRANT ALL PRIVILEGES ON DATABASE backstage TO backstage;
PSQL_EOF
# Create Backstage app
mkdir -p /opt/backstage
cd /opt/backstage
# Create app (will prompt for name)
npx @backstage/create-app@latest
echo "Follow the prompts to create your Backstage app"
echo ""
echo "After creation, configure:"
echo "1. Edit app-config.yaml for PostgreSQL connection"
echo "2. Install Proxmox plugin"
echo "3. Configure authentication (OAuth2/OIDC)"
echo "4. Start: yarn dev (development) or yarn build && yarn start (production)"
echo ""
echo "Backstage VM setup complete!"
BACKSTAGE_SETUP_EOF
chmod +x setup-backstage-vm.sh
log_success "Setup scripts created: setup-vapor-vm.sh, setup-backstage-vm.sh"
}
configure_firewall() {
log_info "Configuring firewall rules..."
cat > firewall-rules.sh << 'FIREWALL_EOF'
#!/bin/bash
# Run this on Router VM (200) to configure AI Maze firewall
# Allow Backstage -> Vapor API
nft add rule inet filter input ip saddr 192.168.100.40 tcp dport 8080 ip daddr 192.168.100.41 accept comment "Backstage -> Vapor API"
# Block all other access to Vapor API
nft add rule inet filter input tcp dport 8080 drop comment "Block direct Vapor API access"
# Allow Vapor API -> Proxmox
nft add rule inet filter input ip saddr 192.168.100.41 tcp dport 8006 ip daddr 192.168.100.10 accept comment "Vapor -> Proxmox API"
# Block all other access to Proxmox web UI (except from management network)
nft add rule inet filter input ip saddr != 192.168.1.0/24 tcp dport 8006 drop comment "Block external Proxmox access"
# Allow Backstage web UI from LAN
nft add rule inet filter input tcp dport 7007 ip saddr 192.168.100.0/24 accept comment "Allow Backstage web UI"
echo "Firewall rules configured for AI Maze"
nft list ruleset | grep -E "8080|8006|7007"
FIREWALL_EOF
chmod +x firewall-rules.sh
log_success "Firewall configuration script created: firewall-rules.sh"
log_warn "Remember to run this on Router VM (200) after VMs are deployed"
}
print_next_steps() {
cat << 'EOF'
╔═══════════════════════════════════════════════════════════════╗
║ DEPLOYMENT COMPLETE ║
╚═══════════════════════════════════════════════════════════════╝
Next Steps:
1. Start and Configure Vapor API VM (401):
qm start 401
# Install Ubuntu via console
# Set IP: 192.168.100.41/24
# Copy and run: ./setup-vapor-vm.sh
2. Start and Configure Backstage VM (400):
qm start 400
# Install Ubuntu via console
# Set IP: 192.168.100.40/24
# Copy and run: ./setup-backstage-vm.sh
3. Configure Firewall (on Router VM 200):
ssh root@192.168.100.1
# Copy and run: ./firewall-rules.sh
4. Develop Vapor API:
- Implement Proxmox API client
- Add honeypot endpoints
- Configure authentication
- See: AI_MAZE_ARCHITECTURE.md for code samples
5. Configure Backstage:
- Install Proxmox plugin
- Configure OAuth2/OIDC
- Create service catalog
- Add infrastructure templates
6. Test the Maze:
- Access Backstage: http://192.168.100.40:7007
- Verify Vapor API is not directly accessible
- Test honeypot endpoints trigger bans
- Monitor with Grafana on AI Agent VM
Documentation:
- Full architecture: AI_MAZE_ARCHITECTURE.md
- Base infrastructure: DELL_R730_ORION_PROXMOX_INTEGRATION.md
- Hybrid setup: ORION_HYBRID_ARCHITECTURE.md
EOF
}
# Main execution
main() {
print_banner
echo ""
check_prerequisites
echo ""
create_vapor_vm
echo ""
create_backstage_vm
echo ""
create_setup_scripts
echo ""
configure_firewall
echo ""
print_next_steps
}
# Run main function
main "$@"