Architecture
Component Overview:
Headless Server (Backend)
- Harden/Lock down server to collect data/info from endpoints
- Database involved?
- TCP Proto SSL?
- Python so we don’t go insane
- Talk to hypervisor API when dispatching jobs to virtualized endpoint
- AKA “snapshot before apt-upgrade or config change”
Endpoint Client (service)
- Some compiled language (for funny + portability)
- Talk to backend to get and execute jobs
- Similar to C2 Beacon → Need to defend + check in w/ Backend Server periodically
- Auto-enroll with backend server (for ease of automation)
Management Client (and/or web panel?? (maybe not)
- Dispatch jobs to clients via backend server
- Get job results
- Get inventory data on endpoints
- OS type, version
- Service type/versions
- Outdated things?
- Outstanding config issues / auth failures etc
OS targets:
Linux
- Systemd-based (Debian, Rocky, etc)
- Non-systemd? (Gentoo, Devuan etc)
BSD
- FreeBSD
- OpenBSD
MacOS ???
Windows
- WKS
- Server (core)
Demo/Testing Tools:
- Proxmox - Deployment Test Scripts + Terraform/Ansible
- VMs for sample env
- Backend server - Debian
- Mgmt box w/ mgmt client installed - Xubuntu etc
- Sample hosts: 1x Linux, 1x BSD, 1x Windows (maybe Mac if we’re brave?)
- Github → Suggested Setups
- Auto Updates
- Harden
- Installing the service (based on the latest tagged release on github)
- Install Scripts based on OS type (apt, dnf/yum, Windows Whatever)
- Setup host as Endpoint “0”
Diagrams:
==
References:
- https://pve.proxmox.com/wiki/Proxmox_VE_API
- https://pve.proxmox.com/wiki/Qemu-guest-agent
- https://www.reddit.com/r/homelab/comments/mm04gz/serverdesktop_update_management_tool/
- https://www.reddit.com/r/Proxmox/comments/1ak56p9/proxmox_host_and_guest_updater/
==