Data flows
- Visitor → edge → site: page reads and rate-limited forms only.
- Traps → logs → summary → site: the site gets cleaned numbers; attacker text is checked first.
- Oversight → site: one way only. The site cannot control the checks.
ogurexxx@root:~$ tree --threat-model
Live architecture
The threat model of this site: its parts, the trust boundaries, and what happens if each is hacked. The goal is not to make a breach impossible, but to make it worthless.
Edge
All of the internet arrives here.
Reverse proxy
● working · 2026-10-31
TLS, headers, brute-force protection
If hacked: Site traffic can be intercepted. Certificate keys live only here.
Attack blocker
● working · 2026-10-31
Bans addresses by behaviour
If hacked: Attacks stop being blocked, but the site keeps working.
Application
Least privilege, writes only to the data folder.
Site
● working · 2026-10-31
PHP in a container, strict CSP
If hacked: Pages get defaced. Integrity monitoring notices changed files and raises an alert.
Data
● no signal
Content and summaries, no attacker addresses
If hacked: Site content leaks. Passwords are stored only as hashes.
Isolated traps
Assumed compromised. Outbound connections are forbidden.
SSH honeypot
● working · 2026-10-31
Records bot behaviour
If hacked: Nothing: there is no real system, and the container cannot reach the network.
Tarpit and decoys
● working · 2026-10-31
Waste bot time
If hacked: False counters on the site. The services run without privileges and with a memory cap.
Oversight
Run apart from the site. The site only reads them.
External scan
● working · 2026-10-31
Looks for vulnerabilities from outside
If hacked: A false picture on /pentest. The site itself is unaffected.
Image scan
● working · 2026-10-31
Vulnerabilities in components
If hacked: Missed updates.
Rebuild
● working · 2026-10-28
Rebuilds the image weekly, with rollback
If hacked: A tampered image is the worst case, so the build does not depend on the site.
Integrity monitor
● working · 2026-10-31
Compares files to a baseline
If hacked: The baseline is out of the site container’s reach, so hacking the site cannot forge it.