Systems Inventory
The full instance fleet (21 EC2 instances) and the services running on each. All in VPC vpc-018f15d8bc3e88255, region us-east-1.
Instance fleet
| Name | Instance ID | Private IP | Tier | Role |
|---|---|---|---|---|
| golemsec-pfsense | i-0c779ea25c7dd773c | 10.50.0.119 | public | Edge router / NAT / firewall (pfSense Plus) |
| golemsec-dc01 | i-0f14950d69df764c5 | 10.50.20.10 | server | AD forest root, DNS, DHCP |
| golemsec-dc02 | i-0388afba5ac516296 | 10.50.20.11 | server | AD replica, NPS/RADIUS |
| golemsec-exchange | i-009996d47147b4609 | 10.50.20.128 | server | Exchange 2019 CU15 |
| golemsec-keycloak | i-0fbc556c90e7a91b6 | 10.50.20.133 | server | Keycloak (IdP / AD federation) |
| golemsec-app-lamp | i-05777bb29d4004aa8 | 10.50.20.38 | server | GLPI, SuiteCRM, OrangeHRM, Akaunting |
| golemsec-erpnext | i-0ac05d6eb54ec8c0e | 10.50.20.164 | server | ERPNext (ERP/finance) |
| golemsec-dev-server | i-0b6c6caad15c7d350 | 10.50.20.107 | server | GitLab + Jenkins (RnD) |
| golemsec-nextcloud | i-08f5b26fea34f8d93 | 10.50.10.51 | dmz | Nextcloud (file sharing) |
| golemsec-db-pgmy | i-0d1427a40c48df29f | 10.50.30.12 | data | PostgreSQL + MySQL (incl. golemsec_corp PII DB) |
| golemsec-db-mssql | i-019443dd4350a48d0 | 10.50.30.38 | data | SQL Server 2022 Developer |
| golemsec-wazuh | i-06375e954d3761899 | 10.50.40.63 | security | Wazuh SIEM/XDR (all-in-one) |
| golemsec-zabbix | i-0375999e03b73101e | 10.50.50.213 | mgmt | Zabbix + Grafana + Uptime-Kuma (NOC) |
| golemsec-mgmt-win | i-0d154d22dd7c638d7 | 10.50.50.95 | mgmt | WSUS (patch), Windows Admin Center |
| golemsec-veeam | i-02d992bafdc154cec | 10.50.50.49 | mgmt | Veeam Backup & Replication |
| golemsec-endpoint-pc-01 | i-0437741a4eddc7765 | 10.50.60.167 | endpoint | Domain-joined workstation |
| golemsec-endpoint-pc-02 | i-0e19402678425975f | 10.50.60.102 | endpoint | Domain-joined workstation |
| golemsec-endpoint-pc-03 | i-0e3cce217b5d0ba9a | 10.50.60.137 | endpoint | Domain-joined workstation |
| golemsec-endpoint-pc-04 | i-0fc48753592a125be | 10.50.60.47 | endpoint | Domain-joined workstation |
| golemsec-endpoint-pc-05 | i-03e54f40a5667c8d8 | 10.50.60.170 | endpoint | Domain-joined workstation |
| golemsec-endpoint-pc-06 | i-0228132682f4b42e1 | 10.50.60.207 | endpoint | Dev workstation (RnD) |
Service endpoints
| Service | URL / endpoint | Host | Purpose | SSO |
|---|---|---|---|---|
| Active Directory (LDAP) | ldap://10.50.20.10:389 | dc01 | Identity source of truth | n/a |
| Keycloak | http://10.50.20.133:8080 | keycloak | IdP, realm golemsec | n/a |
| Exchange / OWA | https://10.50.20.128 | exchange | Mail (200 mailboxes) | AD |
| Grafana | http://10.50.50.213:3000 | zabbix | NOC dashboards | ✅ OIDC |
| Zabbix | http://10.50.50.213 | zabbix | Monitoring | ✅ AD LDAP |
| Uptime-Kuma | http://10.50.50.213:3001 | zabbix | Uptime checks | local |
| GitLab | http://10.50.20.107 | dev-server | Source control | ✅ OIDC |
| Jenkins | http://10.50.20.107:8080 | dev-server | CI | ✅ AD LDAP |
| Nextcloud | http://10.50.10.51 | nextcloud | File sharing | ✅ OIDC |
| GLPI | http://10.50.20.38 | app-lamp | Asset mgmt / helpdesk | ✅ AD LDAP |
| SuiteCRM | http://10.50.20.38:8081 | app-lamp | CRM | ✅ AD LDAP |
| OrangeHRM | http://10.50.20.38:8082 | app-lamp | HR | installed (local; LDAP=UI step) |
| Akaunting | http://10.50.20.38:8084/auth/login | app-lamp | Accounting | installed (local; LDAP=paid) |
| ERPNext | http://10.50.20.164:8080 | erpnext | ERP/finance | ✅ AD LDAP |
| Wazuh | https://10.50.40.63 | wazuh | SIEM/XDR | ✅ AD LDAP |
| PostgreSQL | 10.50.30.12:5432 | db-pgmy | golemsec_corp + app DBs | n/a |
| MySQL | 10.50.30.12:3306 | db-pgmy | App DBs | n/a |
| SQL Server | 10.50.30.38:1433 | db-mssql | MSSQL | n/a |
| WSUS | http://10.50.50.95:8530 | mgmt-win | Windows patch | n/a |
SSO column: ✅ = live and verified · "client ready" = Keycloak OIDC client created, app-side wiring pending · "pending" = still on local auth. See Identity & SSO.
SIEM coverage (Wazuh)
A Wazuh agent (v4.9.2) runs on all 20 hosts (7 Linux + 12 Windows + manager), all Active. The SIEM collects, per host: OS/auth/audit logs, all Docker container logs (= every app's activity), database logs, Windows Security & AD audit events, file-integrity monitoring, and vulnerability detection. Archives are enabled (every event indexed to wazuh-archives-*, not just alerts). Security staff (AD group GG-IT) log into the dashboard with their AD credentials.
Deployment notes
- Most Linux apps run as Docker containers (default/lightweight configs).
- Windows-app-as-domain-user via SSM requires a scheduled task with
-User/-Password(SSM runs asSYSTEM, which can'tStart-Process -Credentialor mount ISOs into a user session). - Databases needed a bind-config re-apply to listen on the tier network; reachable from the app tier (not from pfSense, due to the isolated-subnet design).