Skip to main content

Build Status

Living status of the golemsec build. Updated at every stage.

Last updated: 2026-06-08 (gap-closure pass — SuiteCRM federated, Jenkins hardened, Zabbix provisioned).

7 of 8 line-of-business apps now authenticate against company AD identity (Grafana, GitLab, Nextcloud via Keycloak OIDC; Zabbix, ERPNext, Jenkins, GLPI via direct AD LDAP). Akaunting remains on local auth by decision (paid LDAP module).

✅ Done​

  • Network plane — VPC 10.50.0.0/16, 7 segmented subnets + SGs, pfSense edge router/NAT/firewall, egress for all tiers, private (no public ingress).

  • Active Directory — 2-DC forest corp.golemsec.io, 200 users across 10 department OUs, DNS/DHCP, NPS/RADIUS.

  • Exchange 2019 CU15 — fully installed (27/27 services), accepted domain golemsec.io, 200 mailboxes, outbound via SES.

  • Central PII DB — golemsec_corp (~42k rows: employees, clients, policies, claims, brokerage, holdings, trades, transactions).

  • Core app fleet deployed — Keycloak, Nextcloud, Zabbix/Grafana/Uptime-Kuma, GLPI/SuiteCRM/OrangeHRM/Akaunting, ERPNext, GitLab/Jenkins, Wazuh, PostgreSQL/MySQL, SQL Server, WSUS.

  • Endpoints — 6 Windows workstations domain-joined.

  • Identity bridge (SSO) — Keycloak federates all 200 AD users; login verified by username and email.

  • App SSO live — Grafana (NOC), GitLab (dev), Nextcloud (files) authenticate AD employees via OIDC, all verified end-to-end.

  • Zabbix repaired + on AD — fixed a broken/half-imported backend DB (crash-looping server), then wired direct AD LDAP; itai.williams + david.cohen login verified.

  • ERPNext on AD — Frappe built-in LDAP Settings → AD; employees log in and are JIT auto-provisioned as ERPNext users (verified itai.williams, david.cohen, both granted System Manager).

  • Jenkins on AD — LDAP plugin + init.groovy.d AD security realm (setup wizard bypassed); itai.williams authenticates with AD group resolution (GG-Executive).

  • GLPI installed + on AD — was stuck at its setup wizard; installed against data-tier MySQL, then added the AD LDAP directory (GLPIKey-encrypted bind password) and imported all 200 employees.

  • Authorization wired for ERPNext — AD group → role mapping (Sales/IT/Finance/Executive), least-privilege default; verified Sales can transact, IT can administer, CEO can read business data. CISO role hired (none existed). See Operational Walkthrough.

  • SuiteCRM federated to AD — LDAP auth in config_override.php (LDAPAuthenticate + auto-create); Sales/Marketing sign in with company creds.

  • Jenkins authorization hardened — replaced "any-authenticated = admin" with AD-group matrix (GG-IT = admin, GG-RnD = build/configure, everyone else read-only); verified IT admins, Sales read-only.

  • Zabbix fully provisioned — closed the v6.0 no-auto-provision gap by pre-creating all 199 employees (least-privilege User role + host-group read); any employee now logs in (verified eden.taylor).

  • Wazuh SIEM — full estate onboarded — Wazuh agent (v4.9.2) deployed to all 20 hosts (7 Linux + 12 Windows + manager), all Active; archives enabled (every event indexed, not just alerts); centralized log collection ships every product's logs (all Docker container logs = ERPNext/GitLab/Jenkins/GLPI/Keycloak/Nextcloud/Zabbix/SuiteCRM, DB logs, OS/auth/audit, Windows Security & AD audit) + file-integrity monitoring + vulnerability detection. Verified: 7.4k alerts + 13k archive events/day, all 20 agents reporting.

Gap closure status​

GapStatus
ERPNext authorization (group→role)✅ Closed (all 10 depts)
SuiteCRM → AD (CRM)✅ Closed
Jenkins over-permissioned✅ Closed (matrix authz)
Zabbix no auto-provisioning✅ Closed (all staff provisioned)
Wazuh SIEM — all hosts onboarded✅ Closed — 20 agents Active, archives on, every product's logs/audit indexed
PII DB reachable cross-tierⓘ Intentional — crown-jewel scan/IR-drill target, by design
Akaunting✅ Installed & working on standalone local auth (by decision — LDAP is a paid module); admin admin@golemsec.io, login at /auth/login
Keycloak → Grafana roles✅ Closed — realm roles admin/editor; IT/NOC → admin, dev/exec → editor; verified token carries role (Grafana maps realm_access.roles)
Wazuh dashboard → AD login✅ Closed — LDAP authc/authz in config.yml (real AD values; the shipped ldap: domain was a disabled template) + roles_mapping (GG-IT/GG-Executive→all_access); verified eitan.cohen auth 200, backend role GG-IT → all_access. Security team logs into the SIEM with AD.
OrangeHRM (HR)✅ Installed & working (CLI installer cli_install.php; admin Admin/local). AD LDAP = final 1-form step in Admin → LDAP Configuration (known values: host 10.50.20.10:389, bind Administrator@corp.golemsec.io, base OU=golemsec,…, user attr sAMAccountName) — left to the UI to avoid a blind serialized-JSON write breaking the install

🔜 Other backlog​

  • OrangeHRM / Wazuh — finish LDAP via their admin consoles (browser).
  • Keycloak hardening — fixed hostname, production mode, H2 → PostgreSQL.
  • Veeam Backup & Replication — finish unattended install + first backup job.
  • Keycloak hardening — fixed hostname, production mode, H2 → PostgreSQL.

🧩 Known issues / notes​

  • GLPI OIDC client redirect URI was created against the wrong IP (10.50.20.105); GLPI actually lives on app-lamp 10.50.20.38 — fix when wiring GLPI.
  • Windows Admin Center MSI didn't register its gateway service (distribution-format change) — WSUS covers patch management; left as a known issue.
  • Network segmentation is intentional: DMZ (Nextcloud) cannot reach data-tier DBs — Nextcloud therefore runs on local SQLite.
  • Cost control: stop instances when idle (~$0.87/hr running; pfSense Plus adds ~$0.24/hr).

Change log​

DateChange
2026-06-08Security + DR: locked OpenVPN edge rule from 0.0.0.0/0 → operator IP (no world-open inbound remains); created full DR AMI set for all 21 instances; verified power-switch start/stop/status all work.
2026-06-08Final gap pass: Wazuh dashboard AD login closed (verified eitan.cohen→all_access via GG-IT); Keycloak→Grafana roles; Akaunting & OrangeHRM installed+working (CLI). Only OrangeHRM LDAP toggle left as a UI step.
2026-06-08SIEM rollout: Wazuh agents on all 20 hosts (Active), archives on, centralized log collection of every product's logs/audit; verified 7.4k alerts + 13k archive events/day.
2026-06-08Gap-closure pass: SuiteCRM federated to AD, Jenkins authz hardened to AD-group matrix, all 199 employees provisioned in Zabbix. PII-DB exposure confirmed intentional; Akaunting LDAP confirmed paid-only; OrangeHRM/Wazuh LDAP deferred to admin-console config.
2026-06-08Day 3: completed ERPNext company setup; generated real activity as employees — Sales (7 quotes, NIS 13,800), Customer Service (7 tickets), Dev (GitLab repo + Jenkins green builds), IT (6 tickets). Org is live.
2026-06-08Day 2: extended AD group→role mapping to all 10 departments; 15 employees across every function verified doing job-appropriate work in ERPNext, with least-privilege holding (Legal/R&D correctly denied).
2026-06-08Operated the org as its own users (sales/IT/dev/CISO/CEO); hired a CISO; fixed the #1 blocker (authorization) for ERPNext via AD group→role mapping. Added Operational Walkthrough page.
2026-06-07GLPI installed (from setup wizard) on data-tier MySQL and wired to AD LDAP; 200 employees imported. 7 of 8 apps on company identity; Akaunting left on local auth (paid LDAP).
2026-06-07Jenkins wired to AD (LDAP plugin + init.groovy.d realm, wizard bypassed, AD group resolution); 6 apps now on company identity.
2026-06-07ERPNext wired to AD via Frappe LDAP Settings with JIT user provisioning; 5 apps now on company identity.
2026-06-07Zabbix backend DB repaired (clean atomic schema+data re-import) and wired to AD LDAP; NOC now functional and on company identity.
2026-06-07Documentation published. Identity bridge (Keycloak↔AD) solved; Grafana/GitLab/Nextcloud SSO live; demo-org docs created.

Doc maintenance rule: update this page (and the relevant sub-doc) at every build stage so docs.binarynetworks.ai always reflects reality.