diff --git a/AI_MAZE_ARCHITECTURE.md b/AI_MAZE_ARCHITECTURE.md new file mode 100644 index 0000000..6b52aa8 --- /dev/null +++ b/AI_MAZE_ARCHITECTURE.md @@ -0,0 +1,675 @@ +# AI Maze Architecture - Hardened Infrastructure with Backstage Portal + +**Version**: 1.0.0 +**Created**: 2025-01-22 +**Purpose**: Security-through-obscurity + Defense-in-depth using unconventional technology stack + +--- + +## 🎯 Concept: The "AI Maze" + +An infrastructure management portal that confuses automated crawlers, vulnerability scanners, and AI-powered reconnaissance tools by using an uncommon technology stack while providing a legitimate, user-friendly interface. + +### Why It Works + +1. **Signature Evasion**: Most scanners trained on LAMP/MEAN/JAMstack patterns +2. **Uncommon Stack**: Swift backend is rare for infrastructure tools +3. **Legitimate Tools**: Backstage is production-grade, not security theatre +4. **Defense in Depth**: Multiple layers with different technologies +5. **Confusion**: AI/ML models struggle with unexpected tech combinations + +--- + +## 🏗️ Architecture Layers + +``` +┌─────────────────────────────────────────────────────────────────┐ +│ PUBLIC INTERNET │ +│ (Automated Scanners/Crawlers) │ +└──────────────────────────┬──────────────────────────────────────┘ + ↓ + [Firewall/WAF] + - Rate limiting + - GeoIP blocking + - DDoS protection + ↓ +┌──────────────────────────────────────────────────────────────────┐ +│ LAYER 1: Backstage Developer Portal (VM 400) │ +│ ────────────────────────────────────────────────────────────────│ +│ Technology: Node.js + React (TypeScript) │ +│ Port: 7007 (non-standard, reverse proxied) │ +│ IP: 192.168.100.40 │ +│ │ +│ Features: │ +│ ✓ Service catalog (VMs, containers, infrastructure) │ +│ ✓ TechDocs (infrastructure documentation) │ +│ ✓ Software templates (VM deployment automation) │ +│ ✓ Kubernetes plugin (if using k8s) │ +│ ✓ Custom plugins for Proxmox management │ +│ │ +│ Security: │ +│ - OAuth2/OIDC authentication │ +│ - RBAC via Backstage permissions │ +│ - Only talks to Vapor API (never direct to Proxmox) │ +└──────────────────────────┬───────────────────────────────────────┘ + ↓ + [Internal Network] + No direct internet access + ↓ +┌──────────────────────────────────────────────────────────────────┐ +│ LAYER 2: Vapor API Middleware (VM 401) ← THE MAZE │ +│ ────────────────────────────────────────────────────────────────│ +│ Technology: Swift + Vapor 4.x │ +│ Port: 8080 (firewalled, only accessible from Backstage VM) │ +│ IP: 192.168.100.41 │ +│ │ +│ Purpose: The "AI Maze" - Confuses automated scanners │ +│ │ +│ Features: │ +│ ✓ Swift-based REST API (uncommon = scanner confusion) │ +│ ✓ Custom request/response formats (not typical JSON REST) │ +│ ✓ Token-based authentication with custom schemes │ +│ ✓ Request obfuscation and fingerprint randomization │ +│ ✓ Honeypot endpoints (fake vulns to detect scanners) │ +│ ✓ Rate limiting per endpoint with exponential backoff │ +│ ✓ Proxmox API translation layer │ +│ │ +│ Maze Techniques: │ +│ - Non-standard HTTP headers (X-ORION-*, not X-Forwarded-*) │ +│ - Custom error messages (not Apache/nginx patterns) │ +│ - Response timing randomization │ +│ - Fake technology signatures in headers │ +│ - Honeypot routes that ban on access │ +│ │ +│ Security: │ +│ - JWT validation (from Backstage) │ +│ - IP whitelist (only Backstage VM) │ +│ - Request signing/verification │ +│ - Audit logging of all API calls │ +└──────────────────────────┬───────────────────────────────────────┘ + ↓ + [Management Network] + Completely isolated + ↓ +┌──────────────────────────────────────────────────────────────────┐ +│ LAYER 3: Proxmox VE (Hypervisor) │ +│ ────────────────────────────────────────────────────────────────│ +│ IP: 192.168.100.10:8006 │ +│ Access: ONLY via Vapor API middleware │ +│ Firewall: Port 8006 blocked from all except 192.168.100.41 │ +│ │ +│ Contains: │ +│ - Router VM (200) │ +│ - AI Agent VM (300) │ +│ - macOS VM (100) │ +│ - Backstage VM (400) ← new │ +│ - Vapor API VM (401) ← new │ +└──────────────────────────────────────────────────────────────────┘ +``` + +--- + +## 🚀 Virtual Machine Specifications + +### VM 400: Backstage Developer Portal + +```json +{ + "id": 400, + "name": "ORION-Backstage", + "os": "Ubuntu 24.04 LTS", + "description": "Spotify Backstage developer portal for infrastructure management", + "resources": { + "cpu": { + "cores": 4, + "type": "host" + }, + "memory": "16GB", + "storage": "100GB" + }, + "network": [ + { + "bridge": "vmbr1", + "ip": "192.168.100.40/24", + "gateway": "192.168.100.1" + } + ], + "software": [ + "Node.js 20.x LTS", + "Backstage v1.23+", + "PostgreSQL 16 (for Backstage catalog)", + "nginx (reverse proxy)", + "Let's Encrypt SSL" + ], + "ports": { + "internal": 7007, + "external": 443 + }, + "autostart": true, + "startupOrder": 5 +} +``` + +### VM 401: Vapor API Middleware + +```json +{ + "id": 401, + "name": "ORION-VaporAPI", + "os": "Ubuntu 24.04 LTS", + "description": "Swift/Vapor API middleware - The AI Maze layer", + "resources": { + "cpu": { + "cores": 4, + "type": "host" + }, + "memory": "8GB", + "storage": "50GB" + }, + "network": [ + { + "bridge": "vmbr1", + "ip": "192.168.100.41/24", + "gateway": "192.168.100.1" + } + ], + "software": [ + "Swift 5.10+", + "Vapor 4.x", + "Redis (caching/rate limiting)", + "systemd (service management)" + ], + "ports": { + "internal": 8080, + "external": "none (firewalled)" + }, + "firewall": { + "allowFrom": ["192.168.100.40"], + "denyAll": true + }, + "autostart": true, + "startupOrder": 4 +} +``` + +--- + +## 🔒 Security Features: The "Maze" Techniques + +### 1. **Technology Signature Confusion** + +#### Standard Stack (What Scanners Expect): +``` +User → nginx/Apache → PHP/Node.js/Python → MySQL/PostgreSQL + (Known signatures) (CVE databases) +``` + +#### AI Maze Stack (What We Deploy): +``` +User → Backstage (Node) → Vapor (Swift) → Proxmox API + (Legitimate) (Uncommon) (Protected) +``` + +**Why it works:** +- Swift backend rarely used for infrastructure tools +- Scanners have minimal Swift vulnerability signatures +- No common framework patterns (Laravel, Express, Django) +- Custom error messages don't match known fingerprints + +### 2. **Honeypot Endpoints** + +Fake vulnerable endpoints that detect and ban scanners: + +```swift +// In Vapor API +app.get("wp-admin", "login.php", ".env", "config.php") { req -> Response in + // Log attacker IP + let ip = req.remoteAddress?.ipAddress ?? "unknown" + logger.warning("Scanner detected from \(ip) - accessing honeypot") + + // Ban IP via nftables + try await banIP(ip) + + // Return fake vulnerable response to waste scanner time + return Response( + status: .ok, + body: .init(string: generateFakeVulnerableHTML()) + ) +} +``` + +### 3. **Request Obfuscation** + +Custom request/response formats that confuse AI parsers: + +```swift +// Non-standard authentication +struct OrionAuthToken: Content { + let token: String + let timestamp: Int64 + let signature: String // HMAC-SHA512 + let nonce: String // Prevents replay +} + +// Custom response wrapper +struct OrionResponse: Content { + let data: T? + let meta: ResponseMeta + let _trace: String // Random UUID per request +} +``` + +### 4. **Response Timing Randomization** + +```swift +// Add random delay to prevent timing attacks and confuse automated tools +func randomDelay() async { + let delay = UInt64.random(in: 50_000_000...150_000_000) // 50-150ms + try? await Task.sleep(nanoseconds: delay) +} +``` + +### 5. **Fake Technology Headers** + +```swift +// Make scanners think we're running different tech +let fakeHeaders = [ + "X-Powered-By": "ASP.NET", // We're not .NET + "Server": "Microsoft-IIS/10.0", // We're not IIS + "X-AspNet-Version": "4.0.30319" +] +``` + +--- + +## 📦 Deployment Process + +### Step 1: Deploy Proxmox Base (Already Done) + +Use existing `deploy-orion-hybrid.py` to set up: +- Proxmox VE +- Router VM +- AI Agent VM +- macOS VM (optional) + +### Step 2: Create Vapor API VM + +```bash +# On Proxmox host +qm create 401 \ + --name ORION-VaporAPI \ + --cores 4 \ + --memory 8192 \ + --net0 virtio,bridge=vmbr1 \ + --scsi0 local-lvm:50 \ + --ostype l26 + +# Download Ubuntu 24.04 ISO +wget -O /var/lib/vz/template/iso/ubuntu-24.04-live-server-amd64.iso \ + https://releases.ubuntu.com/24.04/ubuntu-24.04-live-server-amd64.iso + +# Mount and start +qm set 401 --ide2 local:iso/ubuntu-24.04-live-server-amd64.iso,media=cdrom +qm start 401 +``` + +**Install Swift + Vapor:** +```bash +# SSH into VM 401 +ssh root@192.168.100.41 + +# Install Swift +wget https://download.swift.org/swift-5.10-release/ubuntu2404/swift-5.10-RELEASE/swift-5.10-RELEASE-ubuntu24.04.tar.gz +tar xzf swift-5.10-RELEASE-ubuntu24.04.tar.gz +mv swift-5.10-RELEASE-ubuntu24.04 /opt/swift +echo 'export PATH=/opt/swift/usr/bin:$PATH' >> ~/.bashrc +source ~/.bashrc + +# Create Vapor project +mkdir -p /opt/orion-api +cd /opt/orion-api +vapor new . --template api +``` + +### Step 3: Create Backstage VM + +```bash +# Create VM +qm create 400 \ + --name ORION-Backstage \ + --cores 4 \ + --memory 16384 \ + --net0 virtio,bridge=vmbr1 \ + --scsi0 local-lvm:100 \ + --ostype l26 + +qm set 400 --ide2 local:iso/ubuntu-24.04-live-server-amd64.iso,media=cdrom +qm start 400 +``` + +**Install Backstage:** +```bash +# SSH into VM 400 +ssh root@192.168.100.40 + +# Install Node.js 20 +curl -fsSL https://deb.nodesource.com/setup_20.x | bash - +apt-get install -y nodejs + +# Install Yarn +npm install -g yarn + +# Create Backstage app +npx @backstage/create-app@latest --skip-install +cd backstage +yarn install +``` + +### Step 4: Configure Firewall Rules + +```bash +# On Router VM (200) - using nftables +nft add rule inet filter input ip saddr 192.168.100.40 tcp dport 8080 ip daddr 192.168.100.41 accept comment "Backstage → Vapor" +nft add rule inet filter input tcp dport 8080 drop comment "Block direct Vapor access" +nft add rule inet filter input ip saddr 192.168.100.41 tcp dport 8006 ip daddr 192.168.100.10 accept comment "Vapor → Proxmox" +nft add rule inet filter input tcp dport 8006 drop comment "Block direct Proxmox access" +``` + +--- + +## 🔧 Sample Code: Vapor API Middleware + +Create `/opt/orion-api/Sources/App/routes.swift`: + +```swift +import Vapor +import Fluent + +func routes(_ app: Application) throws { + + // Health check (public) + app.get("health") { req async -> Response in + await randomDelay() + return Response(status: .ok, body: .init(string: "OK")) + } + + // Honeypot routes + let honeypots = ["wp-admin", "wp-login.php", ".env", "admin.php", "phpinfo.php"] + for route in honeypots { + app.get(route) { req async throws -> Response in + try await handleHoneypot(req) + } + } + + // Protected API group + let api = app.grouped("api", "v1") + api.grouped(OrionAuthMiddleware()).group("proxmox") { proxmox in + + // List VMs + proxmox.get("vms") { req async throws -> OrionResponse<[VMInfo]> in + await randomDelay() + let vms = try await ProxmoxClient.shared.listVMs() + return OrionResponse(data: vms, meta: ResponseMeta()) + } + + // Create VM + proxmox.post("vms") { req async throws -> OrionResponse in + await randomDelay() + let input = try req.content.decode(CreateVMRequest.self) + let vm = try await ProxmoxClient.shared.createVM(input) + return OrionResponse(data: vm, meta: ResponseMeta()) + } + + // Start VM + proxmox.post("vms", ":id", "start") { req async throws -> OrionResponse in + await randomDelay() + guard let id = req.parameters.get("id", as: Int.self) else { + throw Abort(.badRequest) + } + try await ProxmoxClient.shared.startVM(id) + return OrionResponse(data: "started", meta: ResponseMeta()) + } + } +} + +// Custom middleware for authentication +struct OrionAuthMiddleware: AsyncMiddleware { + func respond(to request: Request, chainingTo next: AsyncResponder) async throws -> Response { + // Verify JWT from Backstage + guard let token = request.headers.bearerAuthorization?.token else { + throw Abort(.unauthorized, reason: "Missing token") + } + + // Validate token + try await validateToken(token) + + // Add custom headers to confuse scanners + var response = try await next.respond(to: request) + response.headers.add(name: "X-Powered-By", value: "ASP.NET") + response.headers.add(name: "Server", value: "Microsoft-IIS/10.0") + response.headers.add(name: "X-ORION-Trace", value: UUID().uuidString) + + return response + } +} + +// Honeypot handler +func handleHoneypot(_ req: Request) async throws -> Response { + let ip = req.remoteAddress?.ipAddress ?? "unknown" + req.logger.warning("🍯 Honeypot triggered by \(ip) - \(req.url.path)") + + // Ban IP (integrate with router firewall) + try await banIP(ip) + + // Return fake vulnerable response + let fakeHTML = """ + + + Admin Login + +
+ + + +
+ + + """ + + return Response( + status: .ok, + headers: HTTPHeaders([ + ("Content-Type", "text/html"), + ("X-Powered-By", "PHP/7.4.33") + ]), + body: .init(string: fakeHTML) + ) +} + +// Random delay to confuse timing attacks +func randomDelay() async { + let delay = UInt64.random(in: 50_000_000...150_000_000) // 50-150ms + try? await Task.sleep(nanoseconds: delay) +} +``` + +--- + +## 🎨 Backstage Configuration + +Create custom Proxmox plugin in Backstage: + +**File: `packages/backend/src/plugins/proxmox.ts`** + +```typescript +import { Router } from 'express'; +import axios from 'axios'; + +const VAPOR_API_URL = 'http://192.168.100.41:8080/api/v1'; +const API_TOKEN = process.env.VAPOR_API_TOKEN; + +export default async function createPlugin(): Promise { + const router = Router(); + + // List VMs + router.get('/vms', async (req, res) => { + try { + const response = await axios.get(`${VAPOR_API_URL}/proxmox/vms`, { + headers: { + 'Authorization': `Bearer ${API_TOKEN}`, + 'X-ORION-Client': 'backstage' + } + }); + res.json(response.data); + } catch (error) { + res.status(500).json({ error: error.message }); + } + }); + + // Create VM + router.post('/vms', async (req, res) => { + try { + const response = await axios.post( + `${VAPOR_API_URL}/proxmox/vms`, + req.body, + { + headers: { + 'Authorization': `Bearer ${API_TOKEN}`, + 'X-ORION-Client': 'backstage' + } + } + ); + res.json(response.data); + } catch (error) { + res.status(500).json({ error: error.message }); + } + }); + + return router; +} +``` + +--- + +## 📊 Expected Results: The "Maze" in Action + +### Scenario 1: Automated Scanner + +``` +Scanner: Nmap port scan → Finds port 7007 open +Scanner: Banner grab → Gets "nginx" (reverse proxy) +Scanner: Directory brute force → Triggers honeypot +Result: IP banned via nftables, scanner thinks it found WordPress +Actual: No useful information gained, scanner wasted time +``` + +### Scenario 2: AI/ML Reconnaissance + +``` +AI Tool: Analyze HTTP responses → No Laravel/Express patterns +AI Tool: Fingerprint stack → Swift headers (uncommon, limited training data) +AI Tool: Try common exploits → No matching vulnerabilities (wrong tech) +Result: AI model confused, gives up or provides wrong assessment +``` + +### Scenario 3: Legitimate User + +``` +User: Access Backstage UI → Beautiful, functional portal +User: Click "Deploy VM" → Backstage → Vapor → Proxmox (seamless) +User: View infrastructure → Real-time data, clear interface +Result: Excellent UX, no awareness of security maze underneath +``` + +--- + +## 🔍 Monitoring the Maze + +### Metrics to Track + +1. **Honeypot Triggers**: How many IPs hit fake endpoints +2. **Banned IPs**: Automated scanner detection rate +3. **Request Patterns**: Identify bot vs. human behavior +4. **Technology Fingerprinting Attempts**: Log unusual User-Agents + +### Grafana Dashboard + +Add to AI Agent VM (300): + +```yaml +# Prometheus metrics from Vapor API +- job_name: 'vapor-api' + static_configs: + - targets: ['192.168.100.41:9090'] + metrics_path: '/metrics' +``` + +**Dashboard Panels:** +- Honeypot hits over time +- Banned IPs (geographic heatmap) +- Request latency (with randomization) +- Authentication failures +- Technology fingerprinting attempts + +--- + +## ⚠️ Limitations & Honest Assessment + +### What This Protects Against ✅ + +- ✅ Automated vulnerability scanners (Nmap, Nikto, etc.) +- ✅ AI-powered reconnaissance tools (limited Swift training) +- ✅ Script kiddies using common exploit tools +- ✅ Crawler bots looking for known vulnerabilities +- ✅ Mass scanning campaigns + +### What This Does NOT Protect Against ❌ + +- ❌ Determined human attackers +- ❌ Zero-day exploits in Swift/Vapor/Backstage +- ❌ Social engineering +- ❌ Insider threats +- ❌ DDoS attacks (need separate mitigation) +- ❌ Advanced persistent threats (APTs) + +### Security Through Obscurity Warning ⚠️ + +**This is NOT a replacement for:** +- Proper authentication/authorization +- Regular security updates +- Network segmentation +- Intrusion detection systems +- Security audits and penetration testing + +**This IS a complement to** defense-in-depth strategy. + +--- + +## 🚀 Deployment Checklist + +- [ ] Deploy base Proxmox with existing ORION stack +- [ ] Create VM 401 (Vapor API) +- [ ] Install Swift + Vapor on VM 401 +- [ ] Implement Vapor API with honeypots +- [ ] Create VM 400 (Backstage) +- [ ] Install and configure Backstage +- [ ] Create Proxmox plugin for Backstage +- [ ] Configure firewall rules (block direct Proxmox access) +- [ ] Set up monitoring and alerting +- [ ] Test honeypot endpoints +- [ ] Test legitimate user workflows +- [ ] Document for team + +--- + +## 📚 Additional Resources + +- **Backstage**: https://backstage.io/docs +- **Vapor**: https://docs.vapor.codes/ +- **Swift Server**: https://www.swift.org/server/ +- **Security Through Obscurity**: https://owasp.org/www-community/controls/Security_by_Obscurity + +--- + +**Status**: Architecture documented, ready for implementation +**Next Steps**: Begin VM deployment and Vapor API development diff --git a/deploy-ai-maze.sh b/deploy-ai-maze.sh new file mode 100755 index 0000000..3afbab6 --- /dev/null +++ b/deploy-ai-maze.sh @@ -0,0 +1,441 @@ +#!/bin/bash +# +# AI Maze Deployment Script +# Deploys Backstage + Vapor API middleware on Proxmox +# Creates security-through-obscurity "maze" for infrastructure management +# +# Prerequisites: +# - Proxmox VE installed and accessible +# - Base ORION infrastructure deployed +# - Ubuntu 24.04 ISO available +# + +set -euo pipefail + +# Colors for output +RED='\033[0;31m' +GREEN='\033[0;32m' +YELLOW='\033[1;33m' +BLUE='\033[0;34m' +NC='\033[0m' # No Color + +# Configuration +PROXMOX_HOST="192.168.100.10" +PROXMOX_USER="root@pam" +UBUNTU_ISO="/var/lib/vz/template/iso/ubuntu-24.04-live-server-amd64.iso" +UBUNTU_ISO_URL="https://releases.ubuntu.com/24.04/ubuntu-24.04-live-server-amd64.iso" + +# VM Configurations +VAPOR_VM_ID=401 +VAPOR_VM_NAME="ORION-VaporAPI" +VAPOR_VM_CORES=4 +VAPOR_VM_MEMORY=8192 +VAPOR_VM_DISK=50 +VAPOR_VM_IP="192.168.100.41" + +BACKSTAGE_VM_ID=400 +BACKSTAGE_VM_NAME="ORION-Backstage" +BACKSTAGE_VM_CORES=4 +BACKSTAGE_VM_MEMORY=16384 +BACKSTAGE_VM_DISK=100 +BACKSTAGE_VM_IP="192.168.100.40" + +# Functions +log_info() { + echo -e "${BLUE}[INFO]${NC} $1" +} + +log_success() { + echo -e "${GREEN}[SUCCESS]${NC} $1" +} + +log_warn() { + echo -e "${YELLOW}[WARN]${NC} $1" +} + +log_error() { + echo -e "${RED}[ERROR]${NC} $1" +} + +print_banner() { + cat << "EOF" +╔═══════════════════════════════════════════════════════════════╗ +║ ║ +║ AI MAZE DEPLOYMENT SYSTEM ║ +║ ║ +║ Architecture: ║ +║ Layer 1: Backstage Developer Portal (React/Node.js) ║ +║ Layer 2: Vapor API Middleware (Swift) ← The Maze ║ +║ Layer 3: Proxmox VE (Protected Infrastructure) ║ +║ ║ +║ Security Features: ║ +║ ✓ Uncommon tech stack (confuses scanners) ║ +║ ✓ Honeypot endpoints (detects/bans attackers) ║ +║ ✓ Request obfuscation (AI confusion) ║ +║ ✓ Defense in depth (multiple layers) ║ +║ ║ +╚═══════════════════════════════════════════════════════════════╝ +EOF +} + +check_prerequisites() { + log_info "Checking prerequisites..." + + # Check if running on Proxmox host or remote + if ! command -v qm &> /dev/null; then + log_error "This script must run on the Proxmox host or you need SSH access" + log_info "Attempting to connect to Proxmox at $PROXMOX_HOST..." + + if ! ssh "${PROXMOX_USER}@${PROXMOX_HOST}" "qm list" &> /dev/null; then + log_error "Cannot connect to Proxmox. Please ensure SSH access is configured." + exit 1 + fi + + log_success "Connected to Proxmox via SSH" + REMOTE_EXEC="ssh ${PROXMOX_USER}@${PROXMOX_HOST}" + else + log_success "Running on Proxmox host" + REMOTE_EXEC="" + fi + + # Check for Ubuntu ISO + if $REMOTE_EXEC test -f "$UBUNTU_ISO"; then + log_success "Ubuntu ISO found: $UBUNTU_ISO" + else + log_warn "Ubuntu ISO not found. Downloading..." + $REMOTE_EXEC wget -O "$UBUNTU_ISO" "$UBUNTU_ISO_URL" + log_success "Ubuntu ISO downloaded" + fi + + log_success "Prerequisites check complete" +} + +create_vapor_vm() { + log_info "Creating Vapor API VM (VM $VAPOR_VM_ID)..." + + # Check if VM already exists + if $REMOTE_EXEC qm status "$VAPOR_VM_ID" &> /dev/null; then + log_warn "VM $VAPOR_VM_ID already exists. Skipping creation." + return 0 + fi + + # Create VM + $REMOTE_EXEC qm create "$VAPOR_VM_ID" \ + --name "$VAPOR_VM_NAME" \ + --cores "$VAPOR_VM_CORES" \ + --memory "$VAPOR_VM_MEMORY" \ + --cpu host \ + --sockets 1 \ + --numa 0 \ + --ostype l26 \ + --scsihw virtio-scsi-pci \ + --scsi0 "local-lvm:${VAPOR_VM_DISK},cache=writeback,discard=on,ssd=1" \ + --net0 "virtio,bridge=vmbr1,firewall=1" \ + --ide2 "local:iso/ubuntu-24.04-live-server-amd64.iso,media=cdrom" \ + --boot "order=scsi0;ide2" \ + --agent 1 \ + --onboot 1 \ + --startup "order=4,up=30" + + log_success "Vapor API VM created successfully" + + log_info "Next steps for VM $VAPOR_VM_ID:" + echo " 1. Start VM: qm start $VAPOR_VM_ID" + echo " 2. Open console and install Ubuntu 24.04" + echo " 3. Set static IP: $VAPOR_VM_IP/24" + echo " 4. After OS install, run: ./setup-vapor-vm.sh" +} + +create_backstage_vm() { + log_info "Creating Backstage VM (VM $BACKSTAGE_VM_ID)..." + + # Check if VM already exists + if $REMOTE_EXEC qm status "$BACKSTAGE_VM_ID" &> /dev/null; then + log_warn "VM $BACKSTAGE_VM_ID already exists. Skipping creation." + return 0 + fi + + # Create VM + $REMOTE_EXEC qm create "$BACKSTAGE_VM_ID" \ + --name "$BACKSTAGE_VM_NAME" \ + --cores "$BACKSTAGE_VM_CORES" \ + --memory "$BACKSTAGE_VM_MEMORY" \ + --cpu host \ + --sockets 1 \ + --numa 0 \ + --ostype l26 \ + --scsihw virtio-scsi-pci \ + --scsi0 "local-lvm:${BACKSTAGE_VM_DISK},cache=writeback,discard=on,ssd=1" \ + --net0 "virtio,bridge=vmbr1,firewall=1" \ + --ide2 "local:iso/ubuntu-24.04-live-server-amd64.iso,media=cdrom" \ + --boot "order=scsi0;ide2" \ + --agent 1 \ + --onboot 1 \ + --startup "order=5,up=30" + + log_success "Backstage VM created successfully" + + log_info "Next steps for VM $BACKSTAGE_VM_ID:" + echo " 1. Start VM: qm start $BACKSTAGE_VM_ID" + echo " 2. Open console and install Ubuntu 24.04" + echo " 3. Set static IP: $BACKSTAGE_VM_IP/24" + echo " 4. After OS install, run: ./setup-backstage-vm.sh" +} + +create_setup_scripts() { + log_info "Creating VM setup scripts..." + + # Vapor VM setup script + cat > setup-vapor-vm.sh << 'VAPOR_SETUP_EOF' +#!/bin/bash +# Run this script on VM 401 after Ubuntu installation + +set -euo pipefail + +echo "Setting up Vapor API VM..." + +# Update system +apt-get update +apt-get upgrade -y + +# Install dependencies +apt-get install -y \ + wget curl git vim \ + build-essential \ + libssl-dev \ + libsqlite3-dev \ + redis-server + +# Install Swift 5.10 +wget https://download.swift.org/swift-5.10-release/ubuntu2404/swift-5.10-RELEASE/swift-5.10-RELEASE-ubuntu24.04.tar.gz +tar xzf swift-5.10-RELEASE-ubuntu24.04.tar.gz +mv swift-5.10-RELEASE-ubuntu24.04 /opt/swift +echo 'export PATH=/opt/swift/usr/bin:$PATH' >> /etc/profile.d/swift.sh +source /etc/profile.d/swift.sh + +# Verify Swift installation +swift --version + +# Install Vapor toolbox +git clone https://github.com/vapor/toolbox.git +cd toolbox +git checkout 18.7.4 +swift build -c release +mv .build/release/vapor /usr/local/bin/ +cd .. +rm -rf toolbox + +# Create Vapor project +mkdir -p /opt/orion-api +cd /opt/orion-api + +# Initialize Vapor project +vapor new . --template api --non-interactive + +# Create systemd service +cat > /etc/systemd/system/orion-api.service << 'SERVICE_EOF' +[Unit] +Description=ORION Vapor API +After=network.target redis-server.service + +[Service] +Type=simple +User=root +WorkingDirectory=/opt/orion-api +ExecStart=/opt/swift/usr/bin/swift run App serve --hostname 0.0.0.0 --port 8080 +Restart=always +RestartSec=10 + +[Install] +WantedBy=multi-user.target +SERVICE_EOF + +# Enable but don't start yet (need to configure first) +systemctl daemon-reload +systemctl enable orion-api + +echo "Vapor API VM setup complete!" +echo "" +echo "Next steps:" +echo "1. Configure Vapor API code in /opt/orion-api" +echo "2. Start service: systemctl start orion-api" +echo "3. Check logs: journalctl -u orion-api -f" +VAPOR_SETUP_EOF + + chmod +x setup-vapor-vm.sh + + # Backstage VM setup script + cat > setup-backstage-vm.sh << 'BACKSTAGE_SETUP_EOF' +#!/bin/bash +# Run this script on VM 400 after Ubuntu installation + +set -euo pipefail + +echo "Setting up Backstage VM..." + +# Update system +apt-get update +apt-get upgrade -y + +# Install dependencies +apt-get install -y \ + wget curl git vim \ + build-essential \ + python3 python3-pip + +# Install Node.js 20 LTS +curl -fsSL https://deb.nodesource.com/setup_20.x | bash - +apt-get install -y nodejs + +# Install Yarn +npm install -g yarn + +# Verify installations +node --version +npm --version +yarn --version + +# Install PostgreSQL (for Backstage catalog) +apt-get install -y postgresql postgresql-contrib +systemctl enable postgresql +systemctl start postgresql + +# Create Backstage database +sudo -u postgres psql << 'PSQL_EOF' +CREATE USER backstage WITH PASSWORD 'backstage_password_change_me'; +CREATE DATABASE backstage; +GRANT ALL PRIVILEGES ON DATABASE backstage TO backstage; +PSQL_EOF + +# Create Backstage app +mkdir -p /opt/backstage +cd /opt/backstage + +# Create app (will prompt for name) +npx @backstage/create-app@latest + +echo "Follow the prompts to create your Backstage app" +echo "" +echo "After creation, configure:" +echo "1. Edit app-config.yaml for PostgreSQL connection" +echo "2. Install Proxmox plugin" +echo "3. Configure authentication (OAuth2/OIDC)" +echo "4. Start: yarn dev (development) or yarn build && yarn start (production)" + +echo "" +echo "Backstage VM setup complete!" +BACKSTAGE_SETUP_EOF + + chmod +x setup-backstage-vm.sh + + log_success "Setup scripts created: setup-vapor-vm.sh, setup-backstage-vm.sh" +} + +configure_firewall() { + log_info "Configuring firewall rules..." + + cat > firewall-rules.sh << 'FIREWALL_EOF' +#!/bin/bash +# Run this on Router VM (200) to configure AI Maze firewall + +# Allow Backstage -> Vapor API +nft add rule inet filter input ip saddr 192.168.100.40 tcp dport 8080 ip daddr 192.168.100.41 accept comment "Backstage -> Vapor API" + +# Block all other access to Vapor API +nft add rule inet filter input tcp dport 8080 drop comment "Block direct Vapor API access" + +# Allow Vapor API -> Proxmox +nft add rule inet filter input ip saddr 192.168.100.41 tcp dport 8006 ip daddr 192.168.100.10 accept comment "Vapor -> Proxmox API" + +# Block all other access to Proxmox web UI (except from management network) +nft add rule inet filter input ip saddr != 192.168.1.0/24 tcp dport 8006 drop comment "Block external Proxmox access" + +# Allow Backstage web UI from LAN +nft add rule inet filter input tcp dport 7007 ip saddr 192.168.100.0/24 accept comment "Allow Backstage web UI" + +echo "Firewall rules configured for AI Maze" +nft list ruleset | grep -E "8080|8006|7007" +FIREWALL_EOF + + chmod +x firewall-rules.sh + + log_success "Firewall configuration script created: firewall-rules.sh" + log_warn "Remember to run this on Router VM (200) after VMs are deployed" +} + +print_next_steps() { + cat << 'EOF' + +╔═══════════════════════════════════════════════════════════════╗ +║ DEPLOYMENT COMPLETE ║ +╚═══════════════════════════════════════════════════════════════╝ + +Next Steps: + +1. Start and Configure Vapor API VM (401): + qm start 401 + # Install Ubuntu via console + # Set IP: 192.168.100.41/24 + # Copy and run: ./setup-vapor-vm.sh + +2. Start and Configure Backstage VM (400): + qm start 400 + # Install Ubuntu via console + # Set IP: 192.168.100.40/24 + # Copy and run: ./setup-backstage-vm.sh + +3. Configure Firewall (on Router VM 200): + ssh root@192.168.100.1 + # Copy and run: ./firewall-rules.sh + +4. Develop Vapor API: + - Implement Proxmox API client + - Add honeypot endpoints + - Configure authentication + - See: AI_MAZE_ARCHITECTURE.md for code samples + +5. Configure Backstage: + - Install Proxmox plugin + - Configure OAuth2/OIDC + - Create service catalog + - Add infrastructure templates + +6. Test the Maze: + - Access Backstage: http://192.168.100.40:7007 + - Verify Vapor API is not directly accessible + - Test honeypot endpoints trigger bans + - Monitor with Grafana on AI Agent VM + +Documentation: +- Full architecture: AI_MAZE_ARCHITECTURE.md +- Base infrastructure: DELL_R730_ORION_PROXMOX_INTEGRATION.md +- Hybrid setup: ORION_HYBRID_ARCHITECTURE.md + +EOF +} + +# Main execution +main() { + print_banner + echo "" + + check_prerequisites + echo "" + + create_vapor_vm + echo "" + + create_backstage_vm + echo "" + + create_setup_scripts + echo "" + + configure_firewall + echo "" + + print_next_steps +} + +# Run main function +main "$@"