Edge node security architecture

1Summary

Putting a physical node on an internal segment is a meaningful ask, and the honest way to answer it is to document what the node can and cannot do rather than assert that it is safe. This brief covers the transport model, what happens to data before it is stored, how the runtime is isolated, and how we detect the node changing underneath us.

2Transport: outbound only

The node opens zero inbound ports. It establishes an encrypted WireGuard or Headscale tunnel outward to the collection infrastructure and syncs over that. Your perimeter firewall needs no new rule, no port forward, and no NAT exception.

The security consequence is that the node is not reachable from outside your network at all. A scan of your perimeter finds nothing new, because there is nothing new listening.

3Sanitisation at ingest

Captured data passes through an inline sanitisation gateway before it is committed to any index. The gateway runs an air-gapped Microsoft Presidio deployment — presidio-analyzer and presidio-anonymizer — which flags and redacts credentials, social security numbers, financial identifiers, and other regulated values.

This happens on the way in, not as a cleanup job. Regulated content is never written to durable storage, so there is no window during which it exists and no purge to prove you ran.

4Runtime isolation

Log aggregation, routing pipelines, and network tooling all execute in rootless namespaces. Daemons drop Linux capabilities explicitly with cap_drop: ALL, adding back only what a given collector genuinely needs.

The assumption behind this is that a container will eventually be compromised. When it is, the blast radius is that container — there is no privileged path from it to the host.

5Drift auditing

Every 15 minutes a background task hashes critical configuration, system files, and Caddy rulesets against a hardened baseline. Any deviation pushes a metric to a Prometheus Pushgateway, which raises an alert.

This is aimed at the quiet case: not an attacker tripping an IDS rule, but a configuration that changed without a corresponding change record. Those are the ones that otherwise surface months later.