Voici l’architecture actuelle de Bojemoi Lab, telle qu’elle tourne en ce moment — pas un croquis de projet, mais le reflet de ce qui est déployé.

4 nœuds Swarm, 12 stacks, ~43 services. 6,15 millions d’hôtes scannés, 33,7 millions de services en base.

Vue d’ensemble

┌│││└┌│││└┌││││││││││││││││││││││││││││││││││││││││││││││││││└─────────────AS──NA──┌│││││││││││││││└┌││││││││││││││││││││││││││││└──Nh──gp────────So──ia────────Sd──nc───m┌││││││└┌││└──W┌│││└┌│││││└┌││││└┌│││└───Ia──xh───e──────O───────────/n──e───t──────R───────────C──(───a─PPAPP──TC───K─abu──FONST──rvdm──SEC────E•──8(───-orlor─rr───Ekmz─aWuas─aiol─uVr────R──08───7Bsoeso─Bao───RB41i─PrAcmu─Tzgz-─DrEo────TX──/0───6Atmrtv─Oew───SO72─EaSlss─Hviot─Eiw────-/──48───Sgetfi─Ofd───:R─NdPeoh─Reerh─Fced────FT──40───(Ertmis─TiS───O─Taini─Edr─EanS────Rw──3)───Mehaxi─ke───mD(((─EyZom─Ake─Ntre────i──)───ASSeno─Sc───eIxxx─SA(va─Taa─Saic────•t──•───NTQua•n─T(───tN113─T(P2─t─Ec────t──•───AALsgi─Ap(───aO55)─p5((─I─(h(────Te──c───GCePn─CrW───-))─Soia─N→→→→──heW────er──LGl──D─EK(t•rrg─KoA───6S─Trtmg─T──orA────l──Iio──O─Rmeo─xF───8T→→→─Atepg─EDCSM──sF────e•──Gtu──C─)─slG•tA──y)───,A─Cmor─LDEuL──t)────g──Hed──K──feroP──)───CNDM─K5pre─oRr──────rM──Ta-──E─—─,gaPnI─┐│┘──mKmee─9ltg──STis──m────IaI──Si──R──rfg─│──eaet──8a)a──-cc──o────NmT──A(n───I─taaAM(───t─ppa──5tt──pFao──d────TR──Igi──S─n─hmndaF─┌│└──a─s──)eo──rRtr──e────ECE──Lit──W─t─r_amia──│───-─Cfp──sr──eai──)────Rh┬│▼t/┬│▼A─e─ebils─────6─Iil──))──dbn─┐┘───NaA──(ec──R─l─ao•nt──C───9─Dno────iurg─│││───EnT──bao─S─M──ttBA─ml───,─Rgi────clu────TnT──o.n─S──i─_,L•rP─Mca────et────tll+─┌└───e&──jbf─H─C─9─ioiI─Cpu───m─sr────iee──│││────/lC──eoi─/─L─,─ndkcd,─P-d───e─cpe────otM──────sK──mjg─G─U──teiAg─se───t─arx─┐│││││┘─nigI──────E──oes─i─S─1─epdep─Se───a─nip──neT─mS→────X•f──im─t─T─6─ll•vo─TrC───-─nl──(nR─HeS────Te──.o•─O─E──,oi•r─Avo───7─→to─┌││││└─TmeE─OdHP────EVe──mi─p─R─G─yTst─Ced───0─i────eor─Nv/o────Rid──e.G─s──B─rmeoK─Kre────m+t────lnaA─EeHs────Nrs──)mi────aemro8─────ss──tRBG──eitT─YdTt────Au──et───R─znpu0──(i────fN─eeor──gtoT─PTg────Ls•──)e───A─vto•r0──pn────.S(─Tldto──ror&─O(Pr────T──a───M─ess0──ot────hEM─Eei:u──arC─The────oX──•────d,•nk→──re────oO─Lgsp──m(K─RS────te──A────ko2──tg────s→D─Er@:──(I──sDQ────an──Hc────aiAd(8──r────tE─GapB──cAom──tPL────lS──ut────,pler0──8a────sc_─RmueB──hNCa──/────e──gi────2l-s8──0t────/lR─A-bto──aSp──mS+────•r──oo────vloey0──0i────saU─Mbtj──nSfp──oM────v──n────ioyxn)──1o────esN─sye──nIei──dBF────Ae──bs────gcpc──)n────rs=──tu_m──een──e/a────br──l────iao)──────vi0──bBo──lRdg──)Fr────u──oC────etr──────if)──oi──sSs──Ta────s──gI────,it──────cy──m──S)──Pd────eo──────oe──────e──bP──H)──/a────In──────nr─┐┘───sh──eT──U──Ty────P-──────)─││───o──ra──/──e────Dp──────────s──sa──R──l────Br─────┐││││││┘───t──_S──U──n────e────────s──b──)──e────•m─────││─────o────t┘───)─────││───││──t───┐───O─────│││││││││──┐│┘┐┘─│┘││││───T────┐┘─││││┐││││───X────││─│││││││││────────│││││││││││││───────││┐││┘──────│││││││││││──││────│││││││││││││││││││││││││─┐│┘┐││┘┐│││││┘││││││││││

Flux de Données — Pipeline de Scan

ip2abuFSTlkmzaaeo41irmlc72asea│▼│▼│▼(│▼d│▼o│▼gt((xanrixmxh3yoao1s1o)vmn5f5s/).)tTBDhssoBo.utssstchsainm_adet←←a←←←←isdlMwinceseomoaetrptnp(akoisJssrfNSpptiCSOlacIENoc+aD)ietRftaisi+pgoneernvgcxnéieoptg+armleapmostcdreitiobintom_ntsnmntsami(nan+ddpgéesss(ca2acm5nta_incsvuatéeta)létlgueossr=i'ebsm)12_v2'

Stack Files → Services

StackServices clésPlacement
01-service-hl.ymlpostgres, prometheus, grafana, loki, alertmanager, postfix, provisioningmanager
boot stacktraefik, crowdsecmanager
40-service-borodino.ymlak47, bm12, uzi, faraday, zaproxy, nucleiworkers
45-service-ml-threat-intel.ymlml-threat-intel-apiworkers
46-service-razvedka.ymlrazvedkaworkers
47-service-vigie.ymlvigieworkers
48-service-dozor.ymldozor, eve-cleanerworkers
49-service-mcp.ymlmcp-servermanager
50-service-trivy.ymltrivy scannerCI/CD only
60-service-telegram.ymltelegram-bot, redisworkers
65-service-medved.ymlmedved honeypotmanager (host ports)
01-suricata-host.ymlsuricata, enricherhost compose (hors swarm)

Observabilité

SSSAAeeellrrrlevvvoriiiytcccmeee(assscnoa→→→lglemltereorctgat→rscoierPcsosusnt→→→iffiPLTixroeé/okm)Pmipreo→otthpoeinupBserli→→→idngGGGeerrraaat→fffoaaauEnnntmaaa-aeideenlaxx-sppuchllnhbooiorrfaeefrrdés

Bases de Données (PostgreSQL)

DatabaseUsageTaille estimée
msfMetasploit — hosts (6,15M), services (33,7M), vulns9 GB
bojemoi_threat_intelML scoring, OSINT cache, IoC~2 GB
ip2locationCIDRs géolocalisés pour scanning~500 MB
razvedkaMentions hacktivist, alertes DDoS~100 MB
vigieBulletins CERT-FR, watchlist matches~50 MB
telegram_botHistorique chats, commandes~500 MB
honeypot_eventsCaptures medved (SSH, HTTP, RDP…)~1 GB
deploymentsAudit orchestrateur + blockchain~100 MB

Réseaux Overlay (Swarm)

RéseauServices
backendpostgres, redis, tous les services data
monitoringprometheus, grafana, loki, tempo, alloy
proxytraefik, crowdsec
pentestfaraday, zaproxy, nuclei, samsonov, mcp-server
rsync_networkkoursk master/slave
mailpostfix, protonmail-bridge, alertmanager
telegram_nettelegram-bot

Résumé

  • 4 nœuds Swarm — 1 manager (meta-76) + 3 workers (meta-68/69/70)
  • 12 stacks — ~43 services distincts
  • 9 GB de données — 6,15M hosts scannés, 33,7M services
  • Pipeline CI/CD — GitLab + Trivy + Gitea Actions
  • Interfaces de contrôle — Telegram bot, MCP server (Claude), API REST
  • Threat Intel multi-sources — OSINT, ML, CTI feeds, honeypot, IDS

Tout est open source, versionné sur Gitea, déployé via CI/CD.

→ gitea.bojemoi.me