XWORKS // OT CYBER • PROJECT X
[
INDUSTRIAL C2 MISSION CONTROL
]
OPERATOR: X
•
PLATFORM: XWORKS SOVEREIGN C2
•
CLUSTER: X-K3S HYBRID MESH
•
INGRESS: xx.xx.xx.95
K3S NODES
4 / 4 ONLINE
FLEET DEVICES
7 ENROLLED
C2 RUNTIMES
47 ACTIVE
ZERO TRUST MESH
WIREGUARD ARMED
UNS DATA MESH
● ACTIVE [47 NODES] ↗
LAN: xx.xx.xx.139 • TAILSCALE: xx.xx.xx.43 • WG: 10.10.0.2ROLE: K3S MASTER • STATEFUL VAULT
LAN: xx.xx.xx.146 • TAILSCALE: xx.xx.xx.80 • WG: 10.10.0.3ROLE: INGRESS ROUTER • HDMI KIOSK
LAN: xx.xx.xx.172 • TAILSCALE: xx.xx.xx.65 • WG: 10.10.0.5ROLE: COMPUTE JOBS • ANTIGRAVITY RUNTIME
LAN: xx.xx.xx.175 • TAILSCALE: xx.xx.xx.17 • WG: 10.10.0.4ROLE: LIMA K3S WORKER • HEAVY DEV
EIP: xx.xx.xx.95 • WG HUB: 10.10.0.1 (UDP 51820)ROLE: NGINX REVERSE PROXY • SSL INGRESS
LAN: xx.xx.xx.141 • TAILSCALE: xx.xx.xx.91ROLE: PRIMARY OPERATOR • iMESSAGE RELAY
TAILSCALE: xx.xx.xx.78 • WIREGUARD COMPLIANTROLE: MOBILE OPERATOR HUD • CHATOPS
SOVEREIGN FLEET TOPOLOGY & K3S CLUSTER ARCHITECTURE MANUAL
4 K3S NODES ACTIVE
7 FLEET ENDPOINTS
100% PERSONAL ENCLAVE
MULTI-TIER OVERLAY MESH
FAILOVER: 1. LAN ➔ 2. WIREGUARD ➔ 3. TAILSCALE (DPHONE)
🔒 ENCLAVE RESTRICTED: PDFS DISPATCHED DIRECTLY VIA MATTERMOST & DISCORD ONLY
PRIMARY SCADA
Ignition Prod Master
Plant Execution & Primary SCADA Runtime (x1)
Active primary Ignition gateway hosting plant floor perspective sessions, Modbus/CIP drivers, transaction groups, and alarm journal.
NODEPORT30188 / 30143
NODE HOSTx1-master
PURDUE LVLLevel 3 SCADA
STORAGEPersistent CSI PVC
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
TAILSCALExx.xx.xx.43
WIREGUARD10.10.0.2
CLUSTER IP10.43.29.88
NODEPORT30188 / 30143 / 31336
SECURITYmTLS (GAN 8060) + ChaCha20
HOT-STANDBY
Ignition Prod Backup
Native Gateway Redundancy Pair (x1)
Hot-standby redundant gateway with stateful tag synchronization, automated heartbeat failover, and zero-loss alarm logging.
NODEPORT30288 / 30243
NODE HOSTx1-master
PURDUE LVLLevel 3 SCADA
REDUNDANCYSync Nominal
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
TAILSCALExx.xx.xx.43
WIREGUARD10.10.0.2
CLUSTER IP10.43.123.35
NODEPORT30288 / 30243 / 31600
SECURITYmTLS (GAN 8060) + ChaCha20
SANDBOX
Ignition Dev / Staging
Engineering Sandbox & Tag Prototyping (x1)
Isolated gateway environment for prospective HMI UI testing, logic script validation, and sandbox database transactions.
NODEPORT30388 / 30343
NODE HOSTx1-master
PURDUE LVLLevel 3 Dev
ENVIsolated Stage
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
TAILSCALExx.xx.xx.43
WIREGUARD10.10.0.2
CLUSTER IP10.43.229.247
NODEPORT30388 / 30343
SECURITYIsolated Namespace + WG
EAM CONTROLLER
Ignition EAM Controller
Enterprise Administration Module (EAM) Controller
Centralized multi-gateway orchestrator coordinating automated project distribution, license leasing, gateway backups, and agent health.
NODEPORT30488 / 30443
NODE HOSTx1-master
PURDUE LVLLevel 4 C2
TOPOLOGYFleet Central
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
TAILSCALExx.xx.xx.43
WIREGUARD10.10.0.2
CLUSTER IP10.43.249.188
NODEPORT30488 / 30443
SECURITYEAM Central Token + GAN
THREAT RADAR
Cyber Threat Intel Enclave
Real-Time ICS/SCADA Threat Radar, Discord Alerts & DB Ingestion
Continuous OT/ICS vulnerability ingestion engine logging CISA KEVs, BleepingComputer advisories, and CVE telemetry directly into PostgreSQL with detailed personal infrastructure impact mapping.
DATABASE482+ Alerts in Postgres
DISCORD C2Live Webhook Relay
PURDUE LVLPurdue L1-L4 Mapping
REFRESHAuto 30m / On-Demand
LIVE THREAT RADAR & DATABASE ACCESS:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
TAILSCALExx.xx.xx.43
WIREGUARD10.10.0.2
PORT30850 (Host) • 80 (Traefik)
POSTGRES TABLEignition_db.cyber_security_intel
DISCORD RELAYAutomated Embed Webhook (Active)
ICS IDS ACTIVE
OT Cyber Defense & IDS
Suricata ICS Deep Packet Inspection & Purdue Firewall
Passive Layer-2/Layer-7 network intrusion detection monitoring Modbus, CIP, and S7comm packets across eth0. Real-time Purdue zone anomaly scoring.
NODEPORT30990
INSPECTIONModbus / CIP / S7
INTERFACEeth0 Host Sniff
PURDUE LVLL1 - L4 Perimeter
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
TAILSCALExx.xx.xx.43
WIREGUARD10.10.0.2
CLUSTER IP10.43.220.168
NODEPORT30990
SECURITYeth0 Sniff + Suricata DPI
CLOUD HUB
AWS Ingress Gateway (xk3s.com)
Public Ingress • WireGuard VPN Hub • RDP Desktop
Dedicated cloud ingress node in AWS us-west-1. Terminates SSL for xk3s.com, routes WireGuard UDP 51820 to K3s Traefik, and hosts authenticated Antigravity CLI and XFCE4 desktop.
PUBLIC IPxx.xx.xx.95
WIREGUARD10.10.0.1 (wg0)
SSL PROXYCloudflare + Nginx
TUNNELChaCha20-Poly1305
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.180
TAILSCALExx.xx.xx.95
WIREGUARD10.10.0.1
CLUSTER IPElastic IP
NODEPORTTCP 80/443, UDP 51820
SECURITYTLS Termination + Let's Encrypt
DNS SINKHOLE
Perimeter Shield & DNS Resolver
Air-Gap DNS Sinkhole & Local Zone Resolution
Stateless perimeter protection providing automated LAN asset scanning, layer-7 ingress traffic steering, DNSSEC validation, and local cluster DNS resolution.
NODEPORT30980
NAMESPACEdns
SECURITYDNSSEC Validated
ZONExk3s.local
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139 / xx.xx.xx.146
TAILSCALExx.xx.xx.43
WIREGUARD10.10.0.2
CLUSTER IP10.43.155.85
NODEPORT30530 / Port 53 (TCP/UDP)
SECURITYDNSSEC Sinkhole & Domain Blackhole
INGRESS MESH
Traefik Mesh & HDMI Kiosk
L7 Ingress Routing & Physical Kiosk Compositor
Dual-node Traefik LoadBalancer and x2 hardware-accelerated Wayland kiosk rendering mission telemetry on physical 4K HDMI display.
PORTS80 / 443 / 8080
INGRESSDual-Node Mesh
COMPOSITORWayland / Chromium
HARDWARE4K HDMI GPU Accel
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.146 (x2 Kiosk)
TAILSCALExx.xx.xx.80
WIREGUARD10.10.0.3
CLUSTER IP10.43.229.22
NODEPORT31688 (HTTP) / 32264 (HTTPS)
SECURITYWayland Fullscreen Chromium Sandbox
UNS BROKER
EMQX Unified Namespace
MQTT 5 & Sparkplug B UNS Broker (x1)
Enterprise sub-millisecond MQTT 5 message broker supporting native Sparkplug B payload state management, topic trees, and edge rules engine.
DASHBOARDPort 31808
MQTT 5 PORTPort 31883
PROTOCOLSparkplug B / JSON
PERFORMANCE<1ms Latency
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
TAILSCALExx.xx.xx.43
WIREGUARD10.10.0.2
CLUSTER IP10.43.96.238
NODEPORT31808 (Dashboard) / 31883 (MQTT 5)
SECURITYUNS Sparkplug B ACL & TLS Auth
PLC DRIVERS
EMQ Neuron Edge Gateway
Industrial Driver Engine (Allen-Bradley, Siemens, Modbus)
Ultra-light C-based industrial edge gateway collecting PLC I/O over CIP, S7comm, FINS, and Modbus, streaming directly into Sparkplug B.
NODEPORT30700
RUNTIMEC-Engine Native
PROTOCOLSCIP, S7, Modbus
MEMORY<25MB Footprint
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
TAILSCALExx.xx.xx.43
WIREGUARD10.10.0.2
CLUSTER IP10.43.216.218
NODEPORT30700 (HTTP API) / 30701 (Core)
SECURITYSouthbound CIP/S7/Modbus Protocol Enclave
ETL PIPELINE
Node-RED OT Gateway
Multi-Protocol Edge Routing & Flow Translation
Low-code visual dataflow orchestration translating proprietary field payloads into standardized UNS topics with watchdog monitoring.
NODEPORT31880
ENGINENode.js 20 LTS
INTEGRATIONREST, OPC-UA, MQTT
FLOWSActive Production
NATIVE NODE-RED SCADA DASHBOARD:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
TAILSCALExx.xx.xx.43
WIREGUARD10.10.0.2
CLUSTER IP10.43.219.218
NODEPORT31880 (Flows UI)
SECURITYRole-Based Bearer JWT & Isolated Subnet
AMQP FABRIC
RabbitMQ Message Fabric
IIoT Message & Event Broker (x1)
Industrial AMQP and MQTT messaging topology routing telemetry and asynchronous events with durable queue persistence across cluster CSI storage.
MANAGEMENTPort 31672
AMQP PORTPort 5672
QUEUESDurable Persistent
PROTOCOLAMQP 0-9-1 / STOMP
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
TAILSCALExx.xx.xx.43
WIREGUARD10.10.0.2
CLUSTER IP10.43.22.212
NODEPORT31672 (Mgmt) / 30672 (AMQP) / 30883 (MQTT)
SECURITYDurable Persistent Queues & SASL Auth
HISTORIAN
InfluxDB v2 Historian
Time-Series Process Historian & Flux Query Engine (x1)
High-frequency process historian capturing telemetry streams, tag fluctuations, and operational KPIs with fast Flux analytical downsampling.
NODEPORT30086
STORAGETSM Engine PVC
QUERYFlux & InfluxQL
RETENTIONInfinite / Downsample
NATIVE INFLUXDB v2 DASHBOARDS:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
TAILSCALExx.xx.xx.43
WIREGUARD10.10.0.2
CLUSTER IP10.43.35.99
NODEPORT30086 (HTTP/Flux API)
SECURITYSCADA Auth Token & Flux Engine
OPERATIONS HUD
Observability HUD (Grafana)
Unified Visual Analytics & Industrial Telemetry HUD
Defense-grade operations dashboard aggregating cluster metrics, container health, network throughput, and PLC tag trends.
NODEPORT30300
DATASOURCESInfluxDB, Prometheus
REFRESH RATESub-second Stream
ALERTSUnified C2 Notifier
PREMIER OPERATIONAL DASHBOARDS:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
TAILSCALExx.xx.xx.43
WIREGUARD10.10.0.2
CLUSTER IP10.43.148.128
NODEPORT30300 (Grafana Web)
SECURITYOAuth / Basic Auth + Flux v2 Engine
C2 CHANNELS
Mattermost & Database
Command & Control Team Operations Messaging
Private self-hosted operations hub for real-time SCADA alarms, automated CI/CD bot alerts, and cryptographic engineer coordination.
NODEPORT32758
BACKENDPostgreSQL 15
ENCRYPTIONTLS End-to-End
NOTIFICATIONSSCADA Webhooks
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
TAILSCALExx.xx.xx.43
WIREGUARD10.10.0.2
CLUSTER IP10.43.68.127 (App) / 10.43.83.213 (DB)
NODEPORT32758 (Web) / 5432 (Postgres)
SECURITYTLS End-to-End & HMAC Webhooks
DAEMONSET
Datadog Telemetry Agent
ARM64 DaemonSet (x1 Master & x2 Worker)
Real-time containerd socket telemetry collection, cluster APM, process monitoring, and encrypted cloud forwarder across all nodes.
TYPEKubernetes DaemonSet
NODESx1 & x2
ARCHITECTUREARM64 Native
FORWARDINGmTLS Encrypted
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139 • xx.xx.xx.146
TAILSCALExx.xx.xx.43 • xx.xx.xx.80
WIREGUARD10.10.0.2 • 10.10.0.3
CLUSTER IPDaemonSet
NODEPORTHost Metrics / Tracing
SECURITYAPI Key Secret + eBPF
AUDIT SHIPPER
Splunk Vector Shipper
OT Syslog, Audit Trail & Event Forwarder
MESH
https://xk3s.com/
Kernel-level audit log ingestion forwarding Suricata IDS events, kernel dmesg, and Traefik access streams into central SIEM.
ENGINEVector Rust Engine
INGESTIONAudit, dmesg, IDS
BUFFERINGDisk-backed Queue
OUTPUTSplunk HEC / TCP
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139 (x1) / xx.xx.xx.146 (x2)
TAILSCALExx.xx.xx.43 / xx.xx.xx.80
WIREGUARD10.10.0.2 / 10.10.0.3
CLUSTER IPDaemonSet Host Network
NODEPORTLocal Shipper Socket
SECURITYInternal Encrypted Forwarder (xk3s.internal)
STORAGE FABRIC
Enterprise CSI Storage Fabric
High-IOPS Distributed Persistent Volume Tier
High-throughput cloud-native storage subsystem providing isolated persistent volumes for transactional databases, time-series historians, and stateful SCADA runtimes.
PROVISIONERDynamic Local-Path CSI
REDUNDANCYEncrypted Snapshot Mesh
TIERDedicated Stateful Enclave
SURVIVABILITYZero-Loss Write-Ahead Log
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
TAILSCALExx.xx.xx.43
WIREGUARD10.10.0.2
CLUSTER IP10.43.x.x Provisioner
NODEPORTNFS v4 Port 2049
SECURITYPCIe NVMe 1TB + Host Export
DELTA LAKEHOUSE
Databricks Industrial Lakehouse
PySpark & Delta Lake Multi-Tier Telemetry Engine
Unified industrial lakehouse executing PySpark streaming micro-batches, Delta Lake Bronze/Silver/Gold data pipelines, and predictive maintenance ML model inference.
RUNTIMESpark 3.5.1 / Delta 3.2
STREAMING12.4 msg/s EMQX UNS
STORAGE1TB NVMe Delta Tables
NODEPORT30810 (Direct Host)
LAKEHOUSE PORTAL & NOTEBOOK:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT30810 (Host) • 80 (Traefik)
DELTA CATALOGscada_telemetry_bronze / silver / gold
UPSTREAM BROKEREMQX UNS (10.43.96.238:1883)
EXECUTIVE BI
Tableau Manufacturing Analytics
Executive SCADA KPI Dashboards & Equipment Analytics
Executive business intelligence hub providing real-time OEE scorecards (89.4%), 480V 3-phase load balance analysis, motor RPM trendlines, and trial reset monitoring.
OEE KPI89.4% (Target: 85%)
GATEWAYS4 / 4 Fully Operational
DATA SOURCEPostgreSQL ignition_db
NODEPORT30820 (Direct Host)
LIVE WORKBOOK EXTRACTS:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT30820 (Host) • 80 (Traefik)
POSTGRES TABLEignition_db.scada_telemetry_log
HISTORIANInfluxDB v2 (10.43.35.99:8086)
OT/IT SIEM
Splunk Enterprise SIEM
Industrial Threat Log Aggregator & SPL Search Radar
Centralized security event management indexer running real-time SPL searches across K3s container stdout, Pi-hole DNS sinkhole queries, and SCADA industrial logs.
SEARCH ENGINELive SPL Analytics
FORWARDERActive DaemonSet (x1/x2)
HEC INGESTIONPort 8088 Token Collector
NODEPORT30830 (Direct Host)
SEARCH & REPORTING:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT30830 (Host) • 80 (Traefik)
INDEXESk3s_industrial • ot_security
HEC STATUSHTTP Event Collector Active
SQL LAB & BI
Apache Superset Exploration
Interactive SQL IDE, Slice Visualization & Metrics
High-speed data exploration platform featuring interactive SQL Lab querying, schema metadata inspection, and real-time visualization of SCADA telemetry and threat feeds.
SQL LABInteractive Query IDE
QUERY SPEEDSub-20ms SQL Latency
DATASETPostgreSQL ignition_db
NODEPORT30840 (Direct Host)
SQL LAB & VISUAL EXPLORER:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT30840 (Host) • 80 (Traefik)
SCHEMApublic (scada_telemetry_log, alarms, intel)
QUERY ENGINEDirect PostgreSQL Wire Protocol
SOVEREIGN APM
Datadog Observability
Sovereign APM Tracing, Host Metrics & K3s Pod Explorer
Comprehensive APM & telemetry hub offering distributed service map tracing, live host metrics across x1 & x2, real-time K3s pod inventory, and synthetic SLO monitors.
APM MESH8 Microservices
LATENCY11.2ms p99 Trace
CONTAINERS28 K3s Pods
NODEPORT30860 (Direct Host)
SOVEREIGN APM & HOST MAP:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT30860 (Host) • 80 (Traefik)
AGENT VERSION7.54.0 ARM64
INGRESSdatadog.xk3s.com
UNIVERSAL SQL
DBeaver Database Studio
Universal Multi-Engine SQL Client & ER Diagram Navigator
Professional database workspace supporting PostgreSQL, InfluxDB v2, TimescaleDB, and SQLite with multi-tab SQL consoles, live table grids, and entity relationship diagrams.
CLIENTUniversal SQL IDE
SPEEDSub-15ms Wire Latency
DATABASESPostgres, InfluxDB, SQLite
NODEPORT30870 (Direct Host)
DATABASE STUDIO CONSOLES:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT30870 (Host) • 80 (Traefik)
INGRESSdbeaver.xk3s.com
VISUAL ARCHITECT
MySQL Workbench Designer
Visual Schema Modeling, Query Optimizer & Server Health
Enterprise visual modeling tool providing SQL development, EXPLAIN execution plan inspector, database server health monitoring, and schema reverse engineering.
TOOLVisual Workbench
OPTIMIZEREXPLAIN Plan Viewer
CACHE HIT99.8% Buffer Ratio
NODEPORT30880 (Direct Host)
WORKBENCH ADMIN & DESIGNER:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT30880 (Host) • 80 (Traefik)
INGRESSworkbench.xk3s.com
DATASET SOURCE
Kaggle Sovereign Hub
Curated OT Telemetry, Threat Intel & Interactive Kernels
Sovereign dataset source and analytical hub hosting verified SCADA sensor logs, CISA KEV vulnerability indexes, and interactive in-browser Python Jupyter notebook kernels.
DATASETS4 Verified Hubs
FORMATSCSV, JSON, Pandas
NOTEBOOKInteractive Python Kernel
NODEPORT30890 (Direct Host)
SOVEREIGN DATASETS & KERNELS:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT30890 (Host) • 80 (Traefik)
INGRESSkaggle.xk3s.com
UX RADAR
Microsoft Clarity Sovereign UX
Sovereign UX Analytics, Session Replays & Click Heatmaps
Real-time sovereign user experience monitoring engine tracking session replays, dead clicks, rage clicks, and interactive click heatmaps across all sovereign web consoles.
SESSIONS48 Active
DEAD CLICKS< 1% Rate
SCROLL DEPTH84.2% Avg
NODEPORT30910 (Direct Host)
SOVEREIGN UX & TELEMETRY:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT30910 (Host) • 80 (Traefik)
INGRESSclarity.xk3s.com
ATTACK SURFACE
runZero Sovereign Asset Explorer
Unauthenticated Asset Discovery & OT/IT Attack Surface
High-precision zero-knowledge network scanner and hardware fingerprinting engine discovering active subnets, open ports, PLC firmware revisions, and exposure vectors.
ASSETS28 Discovered
SUBNETS4 Scanned
VULN RISKS0 High / 0 Crit
NODEPORT30920 (Direct Host)
DISCOVERY & ATTACK SURFACE:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT30920 (Host) • 80 (Traefik)
INGRESSrunzero.xk3s.com
DATA PIPELINE
Vector Sovereign Log Pipeline
High-Throughput Telemetry Aggregation & Multi-Sink Dispatch
High-performance observability and log forwarding pipeline aggregating Suricata alerts, K3s audit streams, and SCADA events into Splunk, InfluxDB, and Datadog.
INGEST RATE1,280 eps
BANDWIDTH1.84 MB/s
SINKS4 Active
NODEPORT30930 (Direct Host)
LOG ROUTING & TRANSFORMS:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT30930 (Host) • 80 (Traefik)
INGRESSvector.xk3s.com
SNMP MONITOR
LibreNMS Sovereign Network Hub
Auto-Discovering SNMPv3 Network & Interface Traffic Monitor
Enterprise network management and SNMP poller providing wire-speed interface traffic telemetry, error rates, ping round-trip times, and hardware sensor status.
DEVICES8 Monitored
INTERFACES38 Mapped
WG SPEED48.2 Mbps
NODEPORT30940 (Direct Host)
NETWORK TELEMETRY & PORTS:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT30940 (Host) • 80 (Traefik)
INGRESSlibrenms.xk3s.com
DDI MASTER
Infoblox Sovereign DDI Master
Authoritative DNS, DHCP Scopes & Threat Insight RPZ Firewall
Carrier-grade DDI grid controller delivering authoritative split-horizon DNS zones, DHCP lease orchestration, and automated RPZ malware sinkholing.
DNS ZONES4 Authoritative
DHCP SCOPES4 Subnets
RPZ BLOCKS2,419 Threats
NODEPORT30950 (Direct Host)
DDI & THREAT INSIGHT:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT30950 (Host) • 80 (Traefik)
INGRESSinfoblox.xk3s.com
SOURCE OF TRUTH
NetBox Sovereign DCIM & IPAM
Infrastructure Single Source of Truth, Rack Elevations & IP Prefixes
Definitive infrastructure modeling platform providing precise data center rack unit mapping, IP prefix allocation, VLAN hierarchy, and physical cable tracing.
SITES2 Documented
RACKSRACK-EDGE-01
PREFIXES5 Verified
NODEPORT30960 (Direct Host)
DCIM & IPAM INVENTORY:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT30960 (Host) • 80 (Traefik)
INGRESSnetbox.xk3s.com
SELF-HEALING
AutoMon Sovereign Watchdog
Autonomous Monitoring, Continuous Probes & Self-Healing
Autonomous system watchdog executing continuous sub-5s synthetic health probes across all 34 cluster platforms with zero-touch automated remediation playbooks.
MONITORED34 / 34 Online
AUTO ACTIONS4 Remediations
MTTR1.2s Recovery
NODEPORT30970 (Direct Host)
AUTONOMOUS REMEDIATION:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT30970 (Host) • 80 (Traefik)
INGRESSautomon.xk3s.com
ADAPTIVE DNS
BlueCat Sovereign Adaptive DNS
BlueCat Address Manager (BAM) & Edge Query Steering
Enterprise DDI platform orchestrating dynamic DNS traffic distribution, edge BDDS DNS caching, and intelligent failover between AWS cloud hub and on-premise nodes.
CONFIGS2 Validated
BDDS NODES2 Edge Servers
QPS RATE3,120 Queries/s
NODEPORT30975 (Direct Host)
ADAPTIVE DNS & BAM HIERARCHY:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT30975 (Host) • 80 (Traefik)
INGRESSbluecat.xk3s.com
OT-TO-IT GATEWAY
FactoryTalk Edge Gateway (FTEG)
OT Contextualization, Studio 5000 Logix CIP Ingress ➔ Influx/MQTT Egress
Organizes and contextualizes OT tag data from Studio 5000 Logix Designer controllers, OPC DA, and FT Live Data, egressing directly to InfluxDB, EMQX UNS, PostgreSQL, and Azure IoT Hub.
INGRESSLogix CIP, FT Live
EGRESSInfluxDB, MQTT, PG
SCAN RATE100ms CIP Poller
NODEPORT31110 (Direct Host)
ROCKWELL OT/IT PIPELINES:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT31110 (Host) • 80 (Traefik)
INGRESSfteg.xk3s.com
CONTAINER HMI
FactoryTalk Optix™ Platform
Cloud-Enabled Containerized HMI, IIoT & Direct MQTT Platform
Isolated Docker-deployed next-generation HMI collecting real-time control equipment telemetry via EtherNet/IP CIP and integrating directly into dashboards and UNS via MQTT.
HMI CLIENTSWeb & Mobile
PROTOCOLNative CIP Direct
MQTT FEEDSparkplug B Direct
NODEPORT31120 (Direct Host)
OPTIX HMI & IIOT RUNTIMES:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT31120 (Host) • 80 (Traefik)
INGRESSoptix.xk3s.com
ZERO-TRUST ORCHESTRATION
FactoryTalk® Edge Manager
Centralized Zero-Trust Edge Device & Container Orchestration Hub
Intelligent edge fleet manager managing hardware nodes and containerized application deployments across hybrid edge compute with zero-trust mTLS hardware verification.
FLEET NODESx1 & x2 Enrolled
ZERO TRUSTmTLS 1.3 RoT
WORKLOADS8 Managed Apps
NODEPORT31130 (Direct Host)
EDGE ORCHESTRATION & DEPLOYMENT:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT31130 (Host) • 80 (Traefik)
INGRESSedgemanager.xk3s.com
PREDICTIVE EDGE COMPUTE
OptixEdge Custom Containers
Closed Linux OS Isolated Docker Fabric for Predictive Maintenance
Executes custom microservices locally in closed Linux containers to perform high-speed FFT vibration analysis and thermal modeling, reducing cloud transmission bandwidth by 82%.
MICROSERVICES4 Running
BW SAVED82.4% Filtered
PREDICTIVEFFT & Kalman
NODEPORT31140 (Direct Host)
PREDICTIVE MAINTENANCE & FFT:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT31140 (Host) • 80 (Traefik)
INGRESSoptixedge.xk3s.com
IOT SUPERVISORY
Tridium Niagara 4 Platform
Containerized IoT Framework, Station Engine & Multi-Protocol Normalization
Packaged as an isolated Docker container with JRE 17, orchestrating multi-protocol normalization across BACnet, Modbus, MQTT, and Fox protocols with enterprise Station logic.
CONTAINERNiagara v4.13+
RUNTIMEJava RE 17
PROTOCOLSBACnet, Fox, MQTT
NODEPORT31210 (Direct Host)
SUPERVISORY RUNTIME & STATION:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT31210 (Host) • 80 (Traefik)
INGRESSniagara.xk3s.com
EDGE AI INFERENCE
Yokogawa Global Edge & AI Platform
Low-Overhead Containerized Edge Sensing & High-Compute AI Inference Engine
Maximizes available field compute power via isolated microservice containers deployed on K3s, executing real-time vibration, acoustic, and anomaly detection models.
INFERENCEONNX / Tensor
OVERHEAD< 150MB RAM
TELEMETRYSushi Sensor IIoT
NODEPORT31220 (Direct Host)
ANOMALY DETECTION & SENSING:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT31220 (Host) • 80 (Traefik)
INGRESSyokogawa.xk3s.com
VIRTUAL CONTROLLER
Siemens SIMATIC S7-1500V
Software-Defined Virtual PLC Controller Decoupled from Proprietary Hardware
Next-generation virtual controller executing TIA Portal v19 Step 7 logic in a native Linux container, delivering deterministic cycle execution and hardware independence.
CONTROLLERS7-1500V v1.1
ENGINEERINGTIA Portal v19
DETERMINISM1ms Real-Time
NODEPORT31230 (Direct Host)
VIRTUAL PLC ENGINE & TIA INTERFACE:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT31230 (Host) • 80 (Traefik)
INGRESSs71500v.xk3s.com
INDUSTRIAL EDGE HUB
Siemens Industrial Edge Platform
Centralized Container Ecosystem, SIMATIC Flow Creator & MQTT Databus
Scalable industrial edge orchestration environment running SIMATIC Flow Creator, low-code Node-RED pipelines, and high-speed IIoT MQTT Databus messaging.
ECOSYSTEMIndustrial Edge
ANALYTICSFlow Creator
BUSMQTT Databus
NODEPORT31240 (Direct Host)
SIEMENS EDGE ECOSYSTEM:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT31240 (Host) • 80 (Traefik)
INGRESSsiemens.xk3s.com
IEC 61499 SOFT dPAC
Schneider EcoStruxure EAE
Event-Driven Distributed Automation Engine & Containerized Soft dPAC
IEC 61499 event-based distributed control system decoupling automation software from underlying hardware, running as an orchestrated Soft dPAC container on K3s.
STANDARDIEC 61499 CAT
RUNTIMESoft dPAC Engine
FRAMEWORKUniversalAuto.org
NODEPORT31250 (Direct Host)
DISTRIBUTED CONTROL & dPAC:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT31250 (Host) • 80 (Traefik)
INGRESSecostruxure.xk3s.com
PROTOCOL INGRESS
AVEVA™ PI Adapters
Lightweight Linux Container Protocol Normalization & Asset Ingress Fabric
Lightweight containerized Linux adapters collecting operational telemetry directly from OPC UA, Modbus, MQTT, and BACnet devices at the edge, routing natively to EDS, PI Server, or cloud services.
ADAPTERS4 Active Modules
PROTOCOLSOPC UA, Modbus, MQTT
SCAN RATE50ms Real-Time
NODEPORT31310 (Direct Host)
EDGE PROTOCOL INGRESS:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT31310 (Host) • 80 (Traefik)
INGRESSpiadapter.xk3s.com
EDGE HISTORIAN
AVEVA™ Edge Data Store (EDS)
Localized Lightweight Time-Series Engine & Resilient Store-and-Forward Buffer
Fully containerized edge historian running on Linux single-board computers & gateways, serving as a localized buffer ensuring zero data loss during WAN outages with automatic store-and-forward backfill.
BUFFER50 GB Local NVMe
SAF MODE720h Offline Hold
COMPRESSION8.6:1 Swinging Door
NODEPORT31320 (Direct Host)
RESILIENT TIME-SERIES BUFFER:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT31320 (Host) • 80 (Traefik)
INGRESSeds.xk3s.com
ENTERPRISE PI BRIDGE
AVEVA™ Core PI System Gateway
Enterprise Windows Server PI Historian & Asset Framework Integration Bridge
Sovereign bridge and ingress gateway routing high-throughput edge telemetry from K3s Linux containers into the centralized enterprise Windows Server PI Data Archive and Asset Framework (AF) hierarchy.
PI ARCHIVExx.xx.xx.201:5450
AF SERVERxx.xx.xx.202:5457
INGRESS RATE12,850 Evt/s
NODEPORT31330 (Direct Host)
ENTERPRISE PI INTEGRATION:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT31330 (Host) • 80 (Traefik)
INGRESSpisystem.xk3s.com
DAPR BACKUP MESH
AMDT Octoplant Hub
Cloud-Native Multi-Plant BI & Dapr Microservices OT Backup Enclave
Rebuilt on modern cloud-native microservices utilizing Dapr for connectivity, aggregating multi-plant backups, version history, change detection, and disaster recovery readiness across all production sites.
ASSETS324 OT Assets
MESH RUNTIMEDapr v1.12
DR READINESS99.8% Verified
NODEPORT31420 (Direct Host)
MULTI-PLANT BACKUP HUB:
SUPER ADMIN INTEL (CLASSIFIED)
DECRYPT ↗
LAN IPxx.xx.xx.139
WIREGUARD10.10.0.2
NODEPORT31420 (Host) • 80 (Traefik)
INGRESSoctoplant.xk3s.com
Compute-Storage Decoupling & Stateful Mesh
Modern autonomous edge deployments require strict architectural separation between stateful persistence and stateless ingress execution. In this topology, CORE-MASTER-01 (x1) anchors the dedicated high-IOPS persistent storage tier, isolating write-intensive transactional databases, InfluxDB write-ahead logs (WAL), RabbitMQ durable queues, and enterprise SCADA transaction groups into dedicated volume enclaves.
- • Cloud-native dynamic CSI storage provisioner with automated volume binding
- • Complete persistence isolation protecting edge nodes from I/O contention
- • Encrypted Flannel CNI overlay mesh with wire-speed packet encapsulation
Stateless Edge Worker Isolation
EDGE-GATEWAY-02 (x2) operates under a strictly enforced stateless paradigm. High-frequency industrial telemetry, edge ingress routing, and visualization pipelines run completely decoupled from local persistent state. By policy-constraining all StatefulSets to the master storage enclave via Kubernetes nodeAffinity, the edge worker executes purely in-memory workloads (Traefik ingress routing, OT protocol translation, and high-framerate kiosk rendering).
- • 100% of persistent volume claims (PVCs) isolated to designated stateful tier
- • Ephemeral edge worker resilience with instant stateless recovery capability
- • Zero-downtime hot-standby failover capabilities for edge services