beane.meOperations briefing
Updated
This briefing has not refreshed recently, so what you see may be out of date.
Healthy

Everything is operating normally.

7 of 7 services are healthy and mirrored; 7 of 7 fleet nodes are reporting; 3 of 3 backups are on schedule. 3 items to watch.

A self-hosted, multi-node platform: every public service runs on a primary and a mirror behind automatic DNS failover, FluxCD keeps configuration in line with its Git repository, each node repairs any drift between its nftables firewall and CrowdSec's ban decisions, and a decision engine escalates repeat offenders from the shared threat feed to 24-hour and then 14-day bans across the whole fleet. This page is generated from the platform's own APIs and explains, in one place, what is running and what changed.

Services healthy
7/7
all with a live mirror and DNS failover
Fleet nodes reporting
7/7
304 active bans, ban lists differ by 1
Backups on schedule
3/3
oldest run 12 h ago · 2 restore-tested
Bans yesterday
400
above normal (median 186)
Firewall self-heal, 24h
98.42%
190 drifts detected, 3 fixed on retry
Uptime, 7 days
100%
12 of 12 monitors up
HetrixTools ↗

What changed last 7 days

  • Zephyrus is reporting normally again
  • Flux on Zephyrus is healthy again
  • Flux on Triton is healthy again

+12 more this week

Needs attention

Nothing needs attention.

Watch minor, no action needed yet

  • 3 self-heal attempts failed in the last 24h
  • Ban lists differ by 1 between nodes, within tolerance
  • Flux on Ares: 1 resource intentionally suspended

Services

ServicePrimaryMirrorServing
Threatsthreats.beane.meUpUpPrimary
Intelintel.beane.meUpUpPrimary
Backupsbackups.beane.meUpUpPrimary
Observeobserve.beane.meUpUpPrimary
Vulnvuln.beane.meUpUpPrimary
Portfoliobeane.meUpUpPrimary
Opsops.beane.meUpUpPrimary

Each service runs on a primary and a mirror; DNS moves to the mirror automatically if the primary fails.

Threat picture

The 25 most recent distinct threats from CrowdSec, reaching back 8.8 h, seen by 6 nodes. Severity reflects the techniques a source attempted.

By severity

Critical7
High6
Low12

By technique (MITRE ATT&CK)

Active scanning T159515
Exploit public-facing application T119012
Command & scripting interpreter T10596
Ingress tool transfer T11056

3 groups of sources share a network block, which usually means one actor.

Bans per day, last 30 days

0250500Sep 10: 73 bansSep 11: 158 bansSep 12: 146 bansSep 13: 136 bansSep 14: 63 bansSep 15: 49,543 bans (suspected botnet)Sep 16: 182 bansSep 17: 222 bansSep 18: 183 bansSep 19: 107 bansSep 20: 324 bansSep 21: 303 bansSep 22: 334 bansSep 23: 330 bansSep 24: 107 bansSep 25: 158 bansSep 26: 122 bansSep 27: 151 bansSep 28: 104 bansSep 29: 173 bansSep 30: 194 bansOct 1: 266 bansOct 2: 229 bansOct 3: 104 bansOct 4: 221 bansOct 5: 233 bansOct 6: 200 bansOct 7: 188 bansOct 8: 400 bansOct 9: 173 bans so far49,543 · suspected botnetSep 10Sep 17Sep 24Oct 1today

The tallest bar is clipped so normal days stay readable. The line marks the median day (186). The pale bar is today, still in progress.

View daily values
  • Oct 9173 so far
  • Oct 8400
  • Oct 7188
  • Oct 6200
  • Oct 5233
  • Oct 4221
  • Oct 3104
  • Oct 2229
  • Oct 1266
  • Sep 30194
  • Sep 29173
  • Sep 28104
  • Sep 27151
  • Sep 26122
  • Sep 25158
  • Sep 24107
  • Sep 23330
  • Sep 22334
  • Sep 21303
  • Sep 20324
  • Sep 19107
  • Sep 18183
  • Sep 17222
  • Sep 16182
  • Sep 1549,543
  • Sep 1463
  • Sep 13136
  • Sep 12146
  • Sep 11158
  • Sep 1073

Decision engine, active now

14-day ban274
24-hour ban22
Watching190

New in the last 24 hours: 19 14-day bans, 22 24-hour bans, 16 watching.

Most common reasons, last 24 hours

Single node only28
High severity single node24
Multi stage attack23

Fleet Resource metrics (Grafana) →

Ares Healthy · seen 2 min ago
Argus Healthy · seen 9 min ago
Hermes Healthy · seen 22 min ago
Iris Healthy · seen 28 min ago
Triton Healthy · seen 1 min ago
Vault Healthy · seen 7 min ago
Zephyrus Healthy · seen 8 min ago

Each node continuously compares its nftables firewall with CrowdSec's ban decisions and repairs any mismatch: 190 mismatches were detected and 190 repaired in the last 24 hours.

Backups and recovery

NodeLast backupVerificationRestore test
Triton
2.3 h ago5.28 GB, about every 8 h
Verified 18 h agofull data check 9 d ago
Passed 9 d ago11 passed
Ares
6.3 h ago1.23 GB, about every 8 h
––
Zephyrus
12 h ago782 MB, about every 12 h
Verified 18 h agofull data check 9 d ago
Passed 9 d ago11 passed

Verification checks repository integrity. A restore test restores a backup and checks its hashes and contents. A dash means that check is not set up for the node yet.

Software updates

2updates availableplus 3 held back, waiting on upstream
2patch and minoroldest released 22 h ago
0major, breakingneed a planned migration

Renovate checks container and chart versions against upstream releases (last scan ). Updates are reviewed and merged by hand. Package names are deliberately not published.

Change delivery

GitOps

Healthy3 of 3 clusters reconciled
0failing now
15 minsince the last change

Ares Triton Zephyrus

Flux reconciles each cluster from its Git repository. Failing now counts resources that were not ready at the last check (last check ).

CI

Green5 of 5 repos green on main
97%pass rate, 239 runs in 7 days
15 smedian run on main

Pushes and pull requests across my private repositories. The pass rate leaves out cancelled runs, and only the default branch decides whether CI is failing. Last run .

Engineering activity

30of 30 days active
Sep 9: 9 commitsSep 10: 6 commitsSep 11: 4 commitsSep 12: 5 commitsSep 13: 4 commitsSep 14: 7 commitsSep 15: 16 commitsSep 16: 4 commitsSep 17: 2 commitsSep 18: 4 commitsSep 19: 1 commitSep 20: 28 commitsSep 21: 23 commitsSep 22: 31 commitsSep 23: 17 commitsSep 24: 7 commitsSep 25: 22 commitsSep 26: 32 commitsSep 27: 3 commitsSep 28: 42 commitsSep 29: 37 commitsSep 30: 10 commitsOct 1: 17 commitsOct 2: 7 commitsOct 3: 18 commitsOct 4: 41 commitsOct 5: 26 commitsOct 6: 60 commitsOct 7: 39 commitsOct 8: 34 commitsOct 9: 37 commits so far

Commits across my repositories, last 30 days. The pale bar is today so far, as of 1:50 PM. Over the last year: 249 of 364 days.

View daily values
  • Oct 937 so far
  • Oct 834
  • Oct 739
  • Oct 660
  • Oct 526
  • Oct 441
  • Oct 318
  • Oct 27
  • Oct 117
  • Sep 3010
  • Sep 2937
  • Sep 2842
  • Sep 273
  • Sep 2632
  • Sep 2522
  • Sep 247
  • Sep 2317
  • Sep 2231
  • Sep 2123
  • Sep 2028
  • Sep 191
  • Sep 184
  • Sep 172
  • Sep 164
  • Sep 1516
  • Sep 147
  • Sep 134
  • Sep 125
  • Sep 114
  • Sep 106
  • Sep 99

Inspect the evidence