Web server is outside the home network, so it is not in the diagram.

Web server

This site runs on a small cloud server, far from the home network and with no way into it: no VPN, no tunnel, no shared accounts or keys. Every connection between the two starts at home: to publish the site, and every 15 minutes to fetch its logs.

System: Debian 13 on a small cloud server
Serves: Static files with nginx, TLS 1.2 and 1.3, strict headers
SSH: Keys only, from one address, no root
Firewall: nftables: SSH, HTTP and HTTPS in, nothing else
Updates: Automatic, with a reboot at night when one is needed
Logs: Fetched by the SIEM every 15 minutes, read-only

One way only#

The laptop publishes with a key that can only write files into the web root. The cluster fetches the logs with a key that can only read the journal. Both are locked to one command on the server, and neither direction gives the server anything at home to connect to. If it were ever taken over, it would lead nowhere.

Nothing for strangers#

A request for the server's bare address, or for any name that is not the site's, gets no answer on port 80 and no certificate on 443. Scanners find a new server within minutes; they leave without learning which site lives here. The SIEM sees them anyway: everything the catch-all turned away is logged with status 444.

Its logs in the SIEM#

nginx writes every request to the journal as JSON, next to SSH, sudo and the updates. A job in the cluster logs in as a user that may read the journal and nothing else, and Vector parses what is new into the same fields as the firewall's logs, with the country and network owner of every visitor.

In the configuration#

~logpull/.ssh/authorized_keys

command="/usr/local/sbin/logpull-journal",restrict ssh-ed25519 AAAA… logpull www.azit.se

Whatever the key asks for, sshd runs this one script, which prints the journal entries since the last pull. restrict rules out forwarding and terminals.