Cyberlab: Hardening, Defense & Compliance

Declarative, Ansible-driven security hardening, audit automation, and infrastructure monitoring for an isolated local laboratory running on macOS via UTM.

---

Table of Contents

• Overview
• Tech Stack
• Architecture & Network Topology
• Repository Structure
• Getting Started & Bootstrap
• Configuration & Security Practices
• Virtual Machine Management
• CI/CD Pipelines
• Contributing
• License

---

Overview

This repository serves as the single source of truth for an isolated local cybersecurity and infrastructure hardening laboratory. macOS (Apple Silicon) acts as the host hypervisor using UTM, while Ansible automates reliable, idempotent security baselines across virtualized Linux nodes. Infrastructure as Code principles are enforced throughout the configuration management layer, utilizing Gitea for source control and Woodpecker CI for execution pipelines.

---

Tech Stack

Layer	Technology
Hypervisor Host	UTM (QEMU virtualization engine on Apple Silicon / macOS)
Guest Operating Systems	Ubuntu Server (ARM64 native architecture)
Configuration Management	Ansible (playbook-driven, idempotent automation)
Security & Hardening	UFW, Fail2ban, Auditd, Unattended-Upgrades
Audit & Compliance	Bash audit scripts, File Integrity Monitoring (FIM)
Source Control & CI/CD	Gitea, Woodpecker CI (paired with local GitHub Actions linting)

---

Architecture & Network Topology

The laboratory uses an isolated internal bridge managed via UTM, ensuring that virtual nodes can communicate with the host control machine and each other without exposing services to the external physical network.

Node Inventory & Layout

Hostname	Role	IP Address (Static)	Assigned Ports / Services
cyber-ctrl	Control Station (macOS Host / UTM Bridge)	192.168.64.2	SSH (Mgmt)
cyber-node01	Hardened Linux Target / Server	192.168.64.10	Custom SSH Port
cyber-node02	Monitoring / Audit Node	192.168.64.20	Auditd / Log collection

For a visual breakdown of the workflow, refer to the Architecture Diagram.

---

Repository Structure

cyberlab/
├── .github/
│   └── workflows/
│       ├── ci.yml                     # Syntax and linting validation
│       └── cd.yml                     # Deployment simulation workflow
├── ansible/
│   ├── inventory.yml                  # UTM virtual machine target definitions
│   └── hardening.yml                  # Baseline security hardening playbook
├── audit/
│   └── security-check.sh              # Local system audit script
├── docs/
│   ├── diagram.md                     # Visual architecture diagram (Mermaid)
│   ├── network.md                     # Network topology and IP mapping
│   └── vm-management.md               # UTM virtual machine guide
├── monitoring/
│   └── auditd-rules.md                # File Integrity Monitoring (FIM) configurations
├── scripts/
│   ├── bootstrap.sh                   # Local environment setup script
│   └── vm-manager.sh                  # VM connectivity and status utility
├── .gitignore
├── LICENSE
└── README.md

---

Getting Started & Bootstrap

1. Environment Bootstrap

Initialize local control dependencies (Ansible, ansible-lint, yamllint) on your macOS host:

./scripts/bootstrap.sh

2. Verify VM Connectivity

Check that the virtual machines running inside UTM are reachable and responsive:

./scripts/vm-manager.sh

3. Run Security Hardening

Execute the Ansible hardening playbook against the defined UTM inventory:

ansible-playbook -i ansible/inventory.yml ansible/hardening.yml

---

Configuration & Security Practices

• Access Control: Plaintext passwords are disabled; SSH access is restricted exclusively to public-key authentication (Ed25519) with direct root logins prohibited.
• Perimeter Defense: Inbound traffic is strictly blocked by default (DENY) using UFW, with explicit allowance only for necessary management ports.
• Intrusion Mitigation: Automated brute-force prevention via Fail2ban is deployed across target nodes.
• File Integrity Monitoring (FIM): Critical system files (/etc/passwd, /etc/shadow, /etc/sudoers) are actively monitored for unauthorized modifications via Auditd rules.

---

Virtual Machine Management

• Recommended Specs: Ubuntu Server 24.04 LTS (ARM64), 2 vCPUs, 2 GB - 4 GB RAM, and 20 GB QCOW2 dynamic storage per node.
• Static Addressing: Netplan configurations inside guest OS instances ensure fixed IP assignments matching the Ansible inventory.

---

CI/CD Pipelines

Pipelines automatically validate codebase health across local and remote runners:

• CI Linting: Verifies YAML file syntax (yamllint) and Ansible playbook correctness (ansible-lint).
• CD Simulation: Runs syntax checks against inventory configurations to ensure deployment readiness.

---

Contributing

Review internal security guidelines and code formatting standards before opening pull requests or proposing adjustments.

---

License

Licensed under the terms outlined in the LICENSE file.