Technical Specification: Multi-Cloud & Cross-VPC Sentinel Audit Toolkit (SAT)

Document ID: SAT-SPEC-002

SDLC Reference: [SAT-2]

Target: Sentinel Audit Toolkit (SAT) Engine v2

Scope: Automated Security, Sovereign Isolation, and Compliance Auditing for Any Cloud VPC (Hetzner, Scaleway, AWS, GCP, Azure, Bare-Metal / Colocation)

1. Executive Summary & Objective

The Sentinel Audit Toolkit (SAT) is expanding from single-node local lab auditing (signexus / silab) into a cloud-agnostic, multi-VPC audit engine.

As Sentinel Integrations transitions to a 2-node cloud topology (Public Web/Sales Edge + Private GPU/LLM Worker) and deploys sovereign client enclaves across various cloud providers, SAT must verify zero-trust posture, ensure no accidental internet exposure of AI/database services, audit Tailscale/WireGuard mesh ACLs, and generate verifiable audit artifacts for client governance.

2. Supported VPC Provider Matrix

| Provider | Supported Infrastructure Types | Ingress Model | Target Mesh Overlay |

| :--- | :--- | :--- | :--- |

| Hetzner Cloud | Cloud VPS (CX/CPX), Dedicated GPU Root Servers | Hetzner Cloud Firewall + Caddy Reverse Proxy | Tailscale / Sovereign WireGuard |

| Scaleway | Elastic Metal, Dedibox, GPU Instances | Security Groups + Traefik | Tailscale / Sovereign WireGuard |

| AWS (Amazon) | EC2, VPC Peering, ECS/EKS Enclaves | AWS Security Groups & Network ACLs | AWS VPC Enclave + Tailscale |

| GCP (Google) | Compute Engine, Vertex Enclaves, GKE | GCP VPC Firewall Rules + Cloud Armor | Tailscale / Tailnet Node Router |

| Azure | Azure VMs, NV-series GPU Nodes | Azure Network Security Groups (NSGs) | WireGuard Mesh Overlay |

| Colocation / SFF | Sovereign Bare-Metal / Mini PC Lab Nodes | Local pfSense / UDR7 Hardware Firewall | Tailscale Point-to-Point Mesh |

3. Core Audit Modules & Check Registry

SAT v2 organizes audits into five modular check suites that run agentically or via scheduled cron:

Suite 1: Boundary & Ingress Isolation (DMZ vs. Private Enclave)

• SAT-VPC-001 - Public Interface Binding Check:

* Ensures critical internal services (Ollama (11434), vLLM (8000), PostgreSQL (5432), NATS (4222), ComfyUI (8188), Paperclip (3100)) are strictly bound to 127.0.0.1, UNIX sockets, or the private 100.x.y.z (Tailscale) interface.

Alert Condition:* Critical finding if any AI model server or internal database listens on 0.0.0.0 or a public IPv4/IPv6 interface.

• SAT-VPC-002 - Host Firewall Verification (UFW / iptables / nftables):

* Verifies default incoming policy is DENY.

* Verifies public exposure is restricted strictly to ports 80 (HTTP redirect) and 443 (TLS) on Edge nodes, and 22 (SSH with key-only auth or disabled in favor of Tailscale SSH).

• SAT-VPC-003 - Reverse Proxy Boundary (Caddy / Nginx):

* Validates TLS 1.3 enforcement, HSTS headers, and ensures internal administrative proxy routes require Tailscale auth headers or mTLS.

Suite 2: Encrypted Mesh & Tailnet Governance

• SAT-VPC-004 - WireGuard / Tailscale Tunnel Health:

* Checks active peer status, interface encryption, and MTU optimization.

* Validates that inter-node traffic (Edge Node 1 -> GPU Compute Node 2 -> Local Orchestrator Node) traverses solely through encrypted wire tunnels.

• SAT-VPC-005 - Mesh ACL & Route Audit:

* Validates Tailnet ACL rules to confirm that public web workers cannot initiate unauthorized lateral SSH or root-level database access to backend compute nodes.

• SAT-VPC-006 - Ephemeral Key & Auth Key Expiry:

* Detects expiring Tailscale authentication keys or unapproved node joins.

Suite 3: Sovereign Key, Secret & Provider Leakage Prevention

• SAT-VPC-007 - Secret Vaulting & Runtime Injection:

* Audits environment variables, systemd service files, and app configs to ensure no raw API keys are committed to disk.

* Confirms integration with Infisical or encrypted environment secrets.

• SAT-VPC-008 - Cloud Provider Training & Telemetry Opt-Out:

* Scans outbound LLM API requests and provider headers to verify zero-retention flags ("training_opt_out": true, Google Cloud SAIF compliance, no telemetry leaks).

• SAT-VPC-009 - Git & Workspace Secret Scanning:

* Runs lightweight automated regex/trufflehog scans across local repositories (~/src/, ~/topics/) for staged tokens.

Suite 4: Database & Storage Sovereignty

• SAT-VPC-010 - PostgreSQL Authentication & pg_hba.conf Audit:

* Verifies local peer authentication for local users and scram-sha-256 over TLS for mesh connections.

* Confirms remote passwordless connections are explicitly denied.

• SAT-VPC-011 - Sovereign Backup Verification:

* Checks status, encryption, and sync timestamp of scheduled sovereign backups (/srv/usb/OPERATIONS or remote encrypted rsync/Borg repos).

Suite 5: Automated Self-Healing & Remediation Engine

• --harden Mode Execution:

* Automated user-space remediation (e.g. tightening permissions on ~/.ssh/, ~/.openclaw/, .env files to 0600 / 0700).

* Generates ~/harden_vpc_system.sh containing system-level remediation commands (UFW rules, binding modifications, service restarts) for human review and execution.

4. Architectural Implementation & CLI Interface

# General VPC scan targeting local node
sat-audit --vpc

# Scan a remote cloud node over the sovereign mesh
sat-audit --node 100.x.y.z --provider hetzner --role compute-gpu

# Run full cross-VPC mesh audit with JSON and Markdown export
sat-audit --mesh --output ~/topics/research/sat_vpc_audit_latest.json --report-md

# Dry-run automated self-healing script generation
sat-audit --vpc --harden --generate-script ~/harden_vpc.sh

5. Next Milestones & Deliverables

1. Refactor Core Engine (sat-audit.py):

- Extract provider detection logic (checks for Hetzner Cloud metadata, AWS IMDSv2, Scaleway API, generic Linux VPC).

2. Interface Binding Validator:

- Integrate ss -tuln socket scanner checking all listening ports against public IP addresses.

3. Automated Weekly SAT VPC Cron:

- Schedule weekly automated health and security posture checks across all active cloud nodes.