# Rampart - Complete + Onboarding

$300 one-time. Every component, plus a 1:1 session.

## What this is

A working, pinned Docker Compose stack for hardening and monitoring your own
infrastructure. Not a link dump - the integration layer: services wired
together, environment template, quickstart, runbook, and a script that fetches
the exact upstream sources at pinned commits.

## Included

- All twelve components
- 1:1 onboarding session
- Lifetime updates

## Components

| Component | Licence | Language | Role |
|---|---|---|---|
| caddy | Apache-2.0 | Go | Reverse proxy with automatic HTTPS |
| uptime-kuma | MIT | JavaScript | Uptime and service monitoring |
| crowdsec | MIT | Go | Collaborative intrusion prevention |
| gitleaks | MIT | Go | Secret scanning |
| trivy | Apache-2.0 | Go | Vulnerability scanner for images and filesystems |
| nuclei | MIT | Go | Template-based vulnerability scanning |
| authelia | Apache-2.0 | Go | Authentication and single sign-on portal |
| keycloak | Apache-2.0 | Java | Identity and access management |
| opa | Apache-2.0 | Go | Policy engine |
| vector | MPL-2.0 | Rust | Observability data pipeline |
| headscale | BSD-3-Clause | Go | Self-hosted mesh VPN control server |
| traefik | MIT | Go | Cloud-native edge router |

## Quickstart

```bash
cp .env.example .env
docker compose up -d
./verify.sh
```

Endpoints:
- `caddy` -> http://localhost:80
- `traefik` -> http://localhost:8083
- `uptimekuma` -> http://localhost:3001
- `crowdsec` -> http://localhost:8080
- `authelia` -> http://localhost:9091
- `keycloak` -> http://localhost:8081
- `vector` -> http://localhost:8686
- `headscale` -> http://localhost:8082

Scanner tools (Gitleaks, Trivy, Nuclei, OPA) are CLIs, not services. See
`docs/` for how to run each.

## Getting the sources

```bash
./fetch-sources.sh ./sources
```

All components are MIT, Apache-2.0, BSD-3-Clause or MPL-2.0. See
`ATTRIBUTION.md`.

## Requirements

- Docker Engine 24+ with the Compose v2 plugin
- 4 GB RAM for the light tiers, 16 GB+ for the full stack

## Support

See `RUNBOOK.md`.