[STATUS // OPEN_SOURCE MIT]

Enterprise security for those who protect others

The same Kubernetes security infrastructure used by Fortune 500 companies — free, open source, and deployed in a single command. Built specifically for journalists, activists, and human rights organizations.

DEPLOY NOW → VIEW SOURCE
$ git clone github.com/JoseLorenzana272/fortress-in-a-box && ./install.sh
[SECTION 01 / THREAT INTEL]

NGOs get hacked.
Constantly.

This is not theoretical. These are real operations targeting critical entities with life-or-death consequences.

Red Cross Breach // 2022

515,000+ Records Stolen

The "Restoring Family Links" program was compromised, shutting down humanitarian workflows designed to reunite missing relatives in conflict zones.

Amnesty International Breach // 2022

State-Sponsored Intrusion

An organization dedicated to exposing human rights abuses was itself monitored and compromised by highly funded threat actors.

Bellingcat Ongoing Target

Persistent Harassment

The investigative team exposing international war crimes faces continuous cyber espionage aimed at burning sources and deleting archives.

$0

The average dedicated security budget for a standard civil society organization. In contrast, hostile state actors deploy millions in cyber weaponry.

"Small team, critical datasets, zero margin for error. Fortress is designed to close the asymmetric defense gap."
[SECTION 02 / ARCHITECTURE]

Defense in Depth

Four decoupled operational layers. Each layer isolates and catches whatever threats bypass the previous boundaries.

[L_01] CI/CD Scanning

Every single container image is automatically audited for CVEs before it reaches the pipeline. Build fails on high vulnerabilities.

Trivy Engine
[L_02] Admission Control

Validates requests to the K8s API against highly strict security profiles. Rejects misconfigured manifests prior to deployment.

Kyverno Guard
[L_03] Runtime Auditing

Monitors system calls and behaviors directly inside the kernels of active containers. Instantly flags shell spawns or privilege elevation.

Falco Daemon
[L_04] GitOps Recovery

Maintains Git as the strict state of truth. Automatically rolls back unauthorized configuration drifts or deletions inside 180 seconds.

ArgoCD Core
[SECTION 03 / MITIGATION MATRIX]

Active Threat Coverage

Practical security solutions matching real exploitation scenarios. Straightforward verification with zero security-theater.

Active Security Assertions // Matrix
Vector / Attack Vector
Fortress Handling Protocol
An attacker executes a shell inside a container
// DETECTED: Falco registers system call, triggers instant Discord Alert
A pod is scheduled to execute with root privileges
// BLOCKED: Kyverno admission controller rejects the configuration
An image containing critical CVSS vulnerabilities is pushed
// TERMINATED: Trivy halts the CI/CD pipeline build phase immediately
Unmanaged users delete crucial security constraints
// RESTORED: ArgoCD reconciles and self-heals state from git source
Mutable image tags (e.g. :latest) are specified
// REJECTED: Admission engine mandates fully pinned digest checksums
Container host namespace exploitation attempt
// IMMUNIZED: HostNetwork and HostPID access are strictly forbidden
[SECTION 04 / DATAFLOW MAP]

Automated Pipeline

Fully declarative architecture. No state is configured manually after executing the primary script.

[GitHub Repository] ← strictly declared state │ ▼ [GitHub Actions Engine] ├── pipeline builds images ├── [trivy vulnerability scan] ── fails build if CVEs detected ├── safe images pushed to GHCR └── declarative manifest updated │ ▼ [ArgoCD Core Engine] ← compares live vs git every 180s, self-heals │ ▼ [Target Kubernetes Cluster] ├── [Kyverno Admission Control] ── blocks unsafe runtimes ├── [Falco Runtime Daemon] ── flags live threats │ └── Falcosidekick → Discord alerts └── [Grafana Dashboards] ── analytical visualization
[SECTION 05 / COMPLIANCE RULES]

Enforced Security Directives

Kyverno-enforced rules mapped straight to global Kubernetes hardening standards. No exceptions tolerated.

RULE_01 // SECURE_UID

disallow-root-user

Forces non-root identity within the container runtimes. Neutering standard root-based escape vectors entirely.

RULE_02 // SYSTEM_KERNEL

disallow-privileged

Restricts root access onto host hardware namespaces, denying containerized applications direct hardware kernel control.

RULE_03 // DIGEST_LOCK

disallow-latest-tag

Blocks mutable container tags. Forces pinned, predictable deployment artifacts protecting against upstream supply-chain shifts.

RULE_04 // DOS_SHIELD

require-limits

Enforces explicit limits on host CPU and memory consumption. Defends cluster against hypervisor starvation and denial of service.

RULE_05 // IMMUTABLE_FS

readonly-root-fs

Forces container storage to be strictly read-only at the system level. Prevents arbitrary payload injection and persistent file manipulation.

RULE_06 // NET_ISOLATION

disallow-host-net

Disables direct access from container space to the raw host network interface. Negates packet sniffing and lateral cluster traversal.

[SECTION 06 / DEPLOYMENT]

Setup Instructions

Deploy a hardened infrastructure in under five minutes. No custom configuration templates required.

[01]

Prerequisites Validation

Verify active access onto a running Kubernetes instance configured with kubectl and helm v3+.

[02]

Clone Target Repository

Download and clone the Fortress codebase locally onto your terminal workspace.

[03]

Execute Interactive Installer

Initialize the interactive automation script. The setup engine will request your target Git repo config, optional alerts configurations, and system passwords.

[04]

Operational Validation

Secure tunnels map directly to control portals (Grafana dashboard, ArgoCD, and Falcosidekick runtime view).

Standard Execution Shell
# Pull deployment codebase
$ git clone https://github.com/JoseLorenzana272/fortress-in-a-box.git
$ cd fortress-in-a-box

# Elevate execution rights and build
$ chmod +x install.sh && ./install.sh

# Define Git Repo, Grafana access, Discord Webhook
# Deploying components to cluster namespaces...

[+] SUCCESS: FORTRESS IS DEPLOYED AND ACTIVE
[SECTION 07 / BUILT BY]

Created by
José Lorenzana

Computer Engineer · Support Engineer · International Speaker

Speaking on Fortress in a Box at Blue Team Con in Chicago, USA and SecTor in Toronto, Canada.

GITHUB LINKEDIN

Tactical Security for Vulnerable Missions

MIT Licensed. Completely Free. Fully Transparent Auditable Code.

GET STARTED ON GITHUB SUBMIT AN ISSUE