Date: 2026-07-22 · Author: Netmon (qwen3:14b-netmon) / Hermes Agent · Status: Active — shared with Claude PAI
# MentalCancer Network — Complete Operations Plan
> **Date:** 2026-07-22
> **Author:** Netmon (qwen3:14b-netmon) / Hermes Agent
> **Classification:** Internal — Shared with Claude PAI Agent
> **Living Docs:** `/opt/data/docs/network/architecture.md` · `build-log.md`
---
## 1. Strategic Overview
A multi-site WireGuard-meshed private network for **offensive security research, autonomous LLM inference, and AI-driven network operations**. The VPS (Hostinger, 2.25.84.191) is the central hub — all peers connect outbound since both home (Ziply Fiber, dynamic IP) and field (Mudi 4G LTE) lack static IPs.
### Core Principles
- **Hub-and-spoke WireGuard** — single static endpoint simplifies NAT traversal
- **VLAN segmentation** — 5 trust zones with pfSense firewall enforcement
- **Layered LLM inference** — SER8 (780M) for netmon ops, GTi15 (RTX 5060 Ti) for heavy compute
- **OpSec egress profiles** — traffic can exit via direct, VPN, Bright Data residential, or Tor
---
## 2. Network Topology
```
ISP (Ziply Fiber)
│
Protectli FW2B (pfSense) ─── WireGuard ─── VPS (2.25.84.191)
│ │
TL-SG108E (managed switch) │ WireGuard
│ │
├─ Port 1: Trunk (all VLANs to pfSense) │
├─ Port 2: VLAN 20 (Trusted) ▼
├─ Port 3: VLAN 30 (DMZ) Mudi GL-E750V2 (4G LTE)
├─ Port 4: VLAN 40 (IoT) │
├─ Port 5: VLAN 60 (Field Ops) 10.2.x.0/16 Field LAN
└─ Ports 6-8: Spare │
├── GTi15 Ultra (96GB, RTX 5060 Ti)
├── BOSGAME P3 (32GB, 780M)
├── Pi5-1 ALFA AWUS036ACM (attack)
├── Pi5-2 ALFA AWUS036ACM (deauth/recon)
├── Pi5-3 ALFA AWUS036ACM (scanning)
└── WiFi Pineapple Pager (rogue AP)
```
### Subnet Allocation
| Scope | Network | Purpose |
|-------|---------|---------|
| WireGuard Tunnel | 10.100.0.0/16 | All WireGuard peers |
| VPS Hub | 10.100.0.1 | Hermes, WWV, PentAGI C2, Traefik |
| Home (Protectli) | 10.100.1.1 | pfSense client |
| Field (Mudi) | 10.100.2.1 | 4G LTE client |
| Home VLANs | 10.1.0.0/16 | Behind Protectli |
| Field LAN | 10.2.0.0/16 | Behind Mudi |
---
## 3. VLAN Segmentation (pfSense + TL-SG108E)
| VLAN | ID | Name | Subnet | Access Policy |
|------|----|------|--------|---------------|
| Native | 1 | Management | 10.1.0.0/24 | Protected — network gear only |
| Trusted | 20 | LAN | 10.1.1.0/24 | Full LAN access |
| DMZ | 30 | Services | 10.1.2.0/24 | Admin from Trusted (SSH/HTTPS) |
| IoT | 40 | Untrusted | 10.1.3.0/24 | Internet-only, no LAN access |
| Field Ops | 60 | PentAGI Field | 10.1.4.0/24 | SSH from Trusted, TCP 11434 to DMZ |
### Switch Port Map (TL-SG108E)
| Port | PVID | VLANs Tagged | Untagged | Connected To |
|------|------|-------------|----------|--------------|
| 1 | 1 | 20,30,40,60 | — | pfSense trunk |
| 2 | 20 | — | 20 | Trusted devices |
| 3 | 30 | — | 30 | DMZ devices |
| 4 | 40 | — | 40 | IoT AP |
| 5 | 60 | — | 60 | Field Ops |
### pfSense Firewall Rules
| Source | Dest | Protocol | Purpose |
|--------|------|----------|---------|
| Trusted (20) | DMZ (30) | HTTPS, SSH | Admin services |
| Trusted (20) | Field Ops (60) | SSH | Control Pi 5s, BOSGAME |
| DMZ (30) | WAN | HTTP/S, DNS | Service outbound |
| Field Ops (60) | DMZ (30) | TCP 11434 | LLM queries |
| Field Ops (60) | WAN | HTTP/S | Updates, Shodan API |
| IoT (40) | WAN | HTTP/S | Internet-only |
| IoT (40) | LAN | Any | Block all RFC1918 |
---
## 4. WireGuard Configuration
### VPS Server (10.100.0.1)
```conf
[Interface]
Address = 10.100.0.1/16
ListenPort = 51820
PrivateKey = <server-key>
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# Home peer
[Peer]
PublicKey = <home-key>
AllowedIPs = 10.100.1.1/32, 10.1.0.0/16
PersistentKeepalive = 25
# Field peer (Mudi)
[Peer]
PublicKey = <mudi-key>
AllowedIPs = 10.100.2.1/32, 10.2.0.0/16
PersistentKeepalive = 25
```
### Home (pfSense WireGuard Client)
- Address: 10.100.1.1/16
- Endpoint: VPS:51820
- AllowedIPs: 10.100.0.0/16, 10.2.0.0/16
- PersistentKeepalive: 25
### Field (Mudi WireGuard Client)
- Address: 10.100.2.1/16
- Endpoint: VPS:51820
- AllowedIPs: 10.100.0.0/16, 10.1.0.0/16, 10.2.0.0/16
- Kill Switch: Enabled (prevents 4G leak)
- DNS: 1.1.1.1
### Route Table
| From | Can Reach | Through |
|------|-----------|---------|
| Home (10.100.1.1) | VPS, Field | VPS tunnel |
| Field (10.100.2.1) | VPS, Home | VPS tunnel |
| VPS (10.100.0.1) | Home, Field | Direct |
---
## 5. Hardware Inventory
| Device | Specs | Role | Location |
|--------|-------|------|----------|
| **Protectli FW2B** | Dual Core, 8GB, 120GB mSATA | pfSense edge router | Home |
| **TL-SG108E** | 8-port managed switch | VLAN segmentation | Home |
| **SER8 "netmon"** | 8745HS, 14GB, Radeon 780M | Network admin AI | Home (Mgmt VLAN) |
| **GTi15 Ultra** | 96GB DDR5, RTX 5060 Ti 16GB | Strategic C2, big LLM | Field |
| **BOSGAME P3** | 7840HS, 32GB, 780M | Field relay | Field |
| **Mudi GL-E750V2** | 4G LTE, WireGuard client | Field internet uplink | Field |
| **ThinkPad P15** | Mobile workstation | Portable ops | Mobile |
| **Pi 5 × 3** | + ALFA AWUS036ACM | Wireless attack/recon | Field |
| **Pineapple Pager** | Rogue AP | Payload delivery | Field |
---
## 6. VPS Services
| Service | Port | Domain | Access |
|---------|------|--------|--------|
| Hermes Agent | :4860 | — | WireGuard only |
| WWV Globe | :3000 | globe.mentalcancer.me | Public (Traefik) |
| Network Docs | nginx :80 | docs.mentalcancer.me | Public (Traefik) |
| PentAGI C2 | :8443 | — | WireGuard only |
| WireGuard | :51820/UDP | — | All peers |
| Traefik | :80/:443 | — | Public (Let's Encrypt) |
---
## 7. SER8 Netmon — Current State
### Hardware
- Beelink SER8, Ryzen 7 8745HS (16 cores), 14GB RAM, Radeon 780M iGPU
- Ubuntu 26.04 LTS, user alanscott (passwordless sudo)
### GPU Acceleration (ROCm)
```ini
HSA_OVERRIDE_GFX_VERSION=11.0.0
OLLAMA_IGPU_ENABLE=1
```
- 780M detected as gfx1100, 16 GiB VRAM total, 8-13 GiB available
- All models fully offloaded: 41/41 layers (14B), 37/37 layers (8B)
### Running Services
| Service | Port | Status |
|---------|------|--------|
| Ollama (systemd) | 11434 | ✅ Active, GPU accelerated |
| OpenWebUI (Docker) | 80 | ✅ Healthy |
| Netdata | 19999 | ✅ Active (replaced ntopng) |
| SSH | 22 | ✅ Open |
### Models Available
| Model | Size | GPU | Status |
|-------|------|-----|--------|
| qwen3:14b-netmon | 9.3 GB | 41/41 layers | ✅ Active (network admin persona) |
| qwen3:14b | 9.3 GB | 41/41 layers | ✅ Base model |
| qwen3:8b | 5.2 GB | 37/37 layers | ✅ Backup |
### LangChain Agent
**Script:** `/home/alanscott/netmon_agent.py`
**Model:** qwen3:14b-netmon
**Tools:** SSH to nodes, Ollama status, disk check, WireGuard check, Tailscale check, uptime check
**First run:** ✅ Passed — gathered real data, formatted structured report, identified SSH key path issue
---
## 8. Exit Profiles (OpSec)
| Mode | Path | Use Case |
|------|------|----------|
| **Open** | Direct → ISP/WAN | Admin, low-risk traffic |
| **VPN** | WireGuard → VPS → Internet | Standard network ops |
| **OpSec** | WireGuard → VPS → Bright Data (residential) | OSINT, Shodan recon |
| **High** | WireGuard → VPS → Bright Data → Tor | Attribution-critical |
### Bright Data Integration (Pending — credentials needed)
- SOCKS5 proxy on VPS → Bright Data residential exit
- Pi 5 traffic, Shodan API calls route through Bright Data
- Traffic appears as residential ISP, not VPS datacenter
---
## 9. LLM Inference Architecture
| Tier | Node | Accelerator | Models | Status |
|------|------|-------------|--------|--------|
| **Netmon** | SER8 | 780M (ROCm) | qwen3:14b, qwen3:8b | ✅ Active |
| **Heavy** | GTi15 Ultra | RTX 5060 Ti (CUDA) | 70B+ models | 🔜 Pending GPU install |
| **Field** | BOSGAME P3 | 780M (ROCm/Vulkan) | Bonsai 27B (TBD) | 🔜 Pending |
### Model Recommendations for GTi15
| Model | Size | Fits VRAM? | Notes |
|-------|------|-----------|-------|
| GPT-OSS 20B | ~14 GB Q4 | ✅ Full | OpenAI reasoning, agentic |
| Devstral 24B | ~14 GB Q4 | ✅ Full | #1 open-source coding agent |
| Qwen3 32B | ~19 GB Q4 | ⚠️ Partial | Needs 3 GB CPU spill at PCIe 5.0 |
| Llama 3.3 70B | ~40 GB Q4 | ❌ Spill | Usable via CUDA unified memory + 96 GB system RAM |
---
## 10. Multi-Model Architecture Review
5 models reviewed the network architecture on 2026-07-22:
| Model | Rating | Key Finding |
|-------|--------|-------------|
| **Nemotron 3 Ultra 550B** | HIGH risk | VPS services colocated with public attack surface |
| **Gemini 2.5 Flash** | Poor | VPS has no firewall — no UFW/iptables |
| **DeepSeek** (me) | Fair-Good | Tailscale/WireGuard overlap needs resolution |
| **Qwen3:8b** | Fair | HTTP exposure on OpenWebUI |
| **Lyria 3 Pro** | — | Brief confirmation |
### Cross-Model Consensus
1. **Docker bridge** — Fixed ✅
2. **Single VPS SPOF** — Needs HA discussion
3. **Missing monitoring** — Replaced with Netdata ✅
4. **VPS firewall** — Critical gap, Gemini flagged
5. **Tailscale role** — Needs architectural resolution
---
## 11. Known Issues & Backlog
| # | Issue | Priority | Status |
|---|-------|----------|--------|
| 1 | VPS has no firewall (UFW/iptables) | **Critical** | 🔴 Needs action |
| 2 | No Bright Data credentials in env | **High** | 🔴 Needs creds |
| 3 | SSH key not on SER8 for direct VPS access | **Medium** | 🟡 Needs copy |
| 4 | SER8 only 14GB RAM (spec 32GB) | Medium | 🔍 Investigate |
| 5 | Windows desktop can't reach SER8 via Tailscale | Low | Fix firewall |
| 6 | No HTTPS on OpenWebUI | Medium | Put behind Traefik |
| 7 | Tailscale vs WireGuard overlap | Low | Clarify architecture |
| 8 | BOSGAME P3 not yet deployed | Low | Pending hardware |
| 9 | GTi15 RTX 5060 Ti not yet installed | Low | Pending hardware |
---
## 12. Build Log (Abbreviated)
| Date | Action |
|------|--------|
| 2026-07-21 | Initial SER8 setup: OpenWebUI + Ollama + qwen3:14b |
| 2026-07-22 | ROCm GPU acceleration enabled (all layers offloaded) |
| 2026-07-22 | Passwordless sudo configured |
| 2026-07-22 | Docker bridge fixed (`systemctl restart docker`) |
| 2026-07-22 | Architecture reviewed by 5 models, feedback compiled |
| 2026-07-22 | Bonsai-27B removed (ROCm crash during generation) |
| 2026-07-22 | qwen3:14b-netmon created with baked network admin persona |
| 2026-07-22 | Netdata installed (replaced broken ntopng) |
| 2026-07-22 | LangChain agent deployed and tested on SER8 |
| 2026-07-22 | Living docs created: architecture.md + build-log.md |
Full build log: `/opt/data/docs/network/build-log.md`
---
## 13. Quick-Start Commands
```bash
# SSH to SER8 (from Hermes VPS container)
ssh -i ~/.ssh/vps_host root@172.17.0.1 ssh alanscott@100.107.171.43
# Check Ollama GPU offload
journalctl -u ollama --since "1 minute ago" | grep -E "offload|layer"
# Run Netmon agent
python3 /home/alanscott/netmon_agent.py "full health check"
# Test netmon model directly
curl -s http://127.0.0.1:11434/api/generate \
-d '{"model":"qwen3:14b-netmon","prompt":"Status?","stream":false}'
# Check Netdata dashboard
curl -s http://127.0.0.1:19999/api/v1/info
# View OpenWebUI
# http://10.0.0.22:80 (from home LAN)
# http://100.107.171.43:80 (via Tailscale)
```
---
## 14. For Claude PAI Agent
When you gain awareness of this network:
1. **Your counterpart** is `qwen3:14b-netmon` running on the SER8 with a LangChain agent. It handles routine monitoring and diagnostics.
2. **The VPS (2.25.84.191)** is the critical hub — it has zero firewall rules currently, which is the top risk.
3. **All field nodes** are behind the Mudi (4G LTE) on the 10.2.x.x subnet, reachable through the WireGuard tunnel.
4. **Bright Data credentials** need to be populated to enable OpSec egress profiles.
5. **GTi15 with RTX 5060 Ti** is the pending compute upgrade — once installed, heavy model inference moves there.
6. **Full docs** at `/opt/data/docs/network/architecture.md` and `build-log.md`.
7. **Exit profiles**: Open → VPN → OpSec (Bright Data) → High (Bright Data + Tor).