The Lab

This page is a living reference architecture for the wwwombat lab: a fully self-hosted, private AI execution environment and cybersecurity detection pipeline running on enterprise hardware.

The core objective: zero-cost, 100% private local inference for processing sensitive data assets like security logs, vulnerability maps, and custom source code, bridged with governed cloud infrastructure only when local VRAM ceilings demand it.

Last updated: July 2026

Deployment Topology

┌─────────────────────────────────────────────────────────────────┐
│  SonicWall TZ270 (Perimeter Firewall / DHCP)                    │
│  Production Network: 10.20.1.0/24                               │
└──────┬──────────┬──────────┬──────────┬──────────┬──────────────┘
       │          │          │          │          │
 ┌─────┴────┐ ┌───┴────┐ ┌───┴────┐ ┌───┴────┐ ┌───┴────┐
 │  FLOKI   │ │  ODIN  │ │VALKYRIE│ │ FREYR  │ │ FREYJA │
 │10.20.1.10│ │  .200  │ │  .100  │ │  .101  │ │  .102  │
 │ Windows  │ │Proxmox │ │Proxmox │ │Proxmox │ │Proxmox │
 │  Dev     │ │  HV    │ │ vLLM   │ │Graylog │ │ Attack │
 └──────────┘ └───┬────┘ └────────┘ └────────┘ │ Range  │
                  │                            └────────┘
           ┌──────┴──────┐
           │ wwwombat-ai │◄─── HEIMDALL (10.20.1.30)
           │ 10.20.1.20  │     RPi 3B · Suricata sensor
           │ Ubuntu 24.04│
           │ Docker Stack│
           └──────┬──────┘
                  │
      Cloudflare Zero Trust Tunnel
           (No open ports)

Physical Hardware

FLOKI

Windows workstation. Primary development and administration node. All lab management, SSH sessions, and code work originate here.

ODIN

ASRock bare-metal server running Proxmox VE. Primary hypervisor host for the AI stack and general VM workloads.

VALKYRIE

Dell PowerEdge R740xd running Proxmox VE 9.2. Commissioned June 2026. Role: dedicated vLLM production inference host.

• OS: Proxmox on BOSS-S1 RAID1 (dual M.2)
• Storage: PERC H740P with 6x 3.84TB SAS SSDs in RAID10, approximately 10.5TB usable via LVM thin pool
• GPU: Dual Tesla V100 PCIe 32GB — fully operational, driver 580.159.03, CUDA 13.0
• Active inference: Qwen3.6-27B-AWQ via 1Cat-vLLM (SM70 fork) on wwwombat-ai-vllm VM
• iDRAC: 10.20.1.254, least-privilege operator account, Redfish power control via fleet-power.py

FREYR

Dell PowerEdge R230. Commissioned July 2026. Role: Graylog logging node (planned).

• CPU: Intel Xeon E3-1280 v6 (4C/8T, 3.9GHz)
• RAM: 64GB DDR4
• Storage: H330 RAID10 across 4x 1.6TB SATA SSDs (~3.2TB usable) + 120GB SSD OS volume via optical bay caddy
• OS: Proxmox VE 9.2-1
• iDRAC: 10.20.1.253

FREYJA

Dell PowerEdge R230. Commissioned July 2026. Role: attack range / Kali / isolated VMs (planned).

• CPU: Intel Xeon E3-1280 v6 (4C/8T, 3.9GHz)
• RAM: 64GB DDR4
• Storage: H330 RAID10 across 4x 1.6TB SATA SSDs (~3.2TB usable) + 120GB SSD OS volume via optical bay caddy
• OS: Proxmox VE 9.2-1
• iDRAC: 10.20.1.252

Both R230s also carry a surprise quad-port Intel addon NIC, reserved for future storage and attack-range traffic isolation.

HEIMDALL

Raspberry Pi 3B running Debian 13 (Trixie). Dedicated network intrusion detection sensor. Runs Suricata 7.0.10 in passive mode on the production network, feeding the Tattle detection pipeline. Local rules only.

Virtual Infrastructure

wwwombat-ai (10.20.1.20)

Ubuntu 24.04 VM on ODIN. 24GB RAM, 12 vCPU. Hosts the full Docker Compose AI stack, the Tattle intrusion detection pipeline, and the mjolnir fleet control bot.

Active containers:

• Ollama — Local LLM inference engine
• Open WebUI — Browser interface with custom WWWOMBAT branding
• LiteLLM — Unified API proxy for local and cloud model routing
• SearXNG — Private metasearch engine for RAG pipelines
• Kokoro TTS — Local text-to-speech synthesis
• Tattle — Intrusion detection pipeline (Suricata ingest, dedup, LLM triage, Slack delivery)
• Mjolnir — Slack-driven fleet power control bot

wwwombat-ai-vllm (10.20.1.21)

Ubuntu 24.04 VM on VALKYRIE. 512GB RAM, 20 vCPU. Dual V100s passed through via vfio-pci. Runs 1Cat-vLLM serving Qwen3.6-27B-AWQ on port 8000.

Detection Pipeline (Tattle)

A passive intrusion detection pipeline running end-to-end on lab hardware. No commercial SIEM. No cloud dependency.

HEIMDALL (Suricata) → eve_forwarder → woop_dedoop → LLM triage (LiteLLM) → Slack

• HEIMDALL captures network events and writes structured JSON logs
• eve_forwarder ships events to the Tattle service on wwwombat-ai
• woop_dedoop deduplicates and episodes repeated events within rolling time windows
• LLM triage agent classifies events, scores severity, and formats structured alerts
• Slack receives the final TriageResult in the #tattle-alerts channel

Trigger inventory: port scan detection, WordPress admin canary, environment file canary, backup archive canary, and honeytoken credential callbacks. Honeytoken callbacks are always-fire: any use of a decoy credential generates an immediate critical-severity alert regardless of deduplication state.

Fleet Power Control (Mjolnir)

Remote power control for the Dell fleet via iDRAC Redfish, driven from Slack.

/mjolnir <verb> <host>  →  challenge token  →  confirm <token>
                        →  fleet-power.py (iDRAC Redfish)
                        →  result to #fleet-control
                        →  audit event to Tattle pipeline

• fleet-power.py supports wake, sleep, kill, and status against any host or all
• Each iDRAC uses a least-privilege operator account scoped to Login, Logs, and System Control only
• TLS verification is enforced on every Redfish call: SAN-bearing certs use hostname assertion; CN-only certs use SHA-256 fingerprint pinning
• A bedtime timer posts a Slack warning at 01:50 Central and gracefully shuts the fleet down if not cancelled
• Unauthorized command attempts cross-post to #tattle-alerts as critical security events

Public ingress via Cloudflare tunnel: mjolnir.wwwombat.tech

Model Inventory

Security Tooling

Open WebUI tool functions that extend the local AI stack with structured security intelligence:

• ATT&CK Mapper v1.5.0 — Queries the MITRE ATT&CK STIX 2.1 bundle locally. Resolves detection strategies and data sources via the v14+ detection-strategy graph. Ranked search by name specificity. Part of open-webui-security-toolkit.
• NVD CVE Lookup — Live CVE data from the National Vulnerability Database API.

Data Hygiene

A custom filter function intercepts all uploads before they reach model inference or persist to the database. The middleware uses Python regex patterns to scrub administrator credentials, VPN pre-shared keys, serial numbers, and license keys, replacing them with mask tags in transit.

[User Upload] → [Filter: Regex Scrubber] → [Masked Tokens] → [LLM Inference]
                                         → [Clean Data]    → [Local DB]

Edge Access

Cloudflare Zero Trust Tunnel routes encrypted sessions directly into the container stack on wwwombat-ai. No ports are forwarded on the local perimeter. External access is authenticated through Cloudflare Access policies. Zero open inbound ports on the SonicWall.

Public hostnames currently active: chat.wwwombat.tech (Open WebUI), mjolnir.wwwombat.tech (fleet control).

Roadmap

• Graylog on FREYR — Persistent SonicWall syslog ingestion and downstream agentic triage pipeline
• Attack range on FREYJA — Isolated vmbr1 network, Kali attacker node, vulnerable targets, logs routed into Tattle for detection validation (purple team loop)
• LLM Benchmarking Portal — Self-hosted web app for capturing and visualizing benchmark results across VALKYRIE, ODIN, and cloud models; judge model pattern for quality scoring alongside performance metrics
• Wildcard SSL — *.lab.wwwombat.tech via Certbot + Cloudflare DNS plugin across all internal services
• R730xd storage node — TrueNAS on 12x 3.84TB SSDs (~46TB usable all-flash), NFS/iSCSI backend for the fleet

This page is periodically updated as the lab evolves. For the full technical deep-dive on any component, check the blog.