talos/README.md

TALOS

Legal warning: Talos runs real offensive security tools (Nmap, Nikto, Gobuster, sqlmap, Hydra, etc.). Use only against systems you own or have written authorization to test. Unauthorized access is illegal. The UI requires an explicit authorization checkbox before any scan starts.

Self-hosted pentest orchestrator with live tool output, WebSocket streaming, and Ollama-powered finding analysis.

What we use it for (Levkin)

Primary use: bulk-scan our own edge-facing sites (Caddy/*.levkin.ca) and LAN app ports before/after exposing them — headers, directory enum, Nikto, optional redteam profile. Scan results stay in local data/ (gitignored). Not a general internet scanner.

Homelab deployment (Levkin / Ansible)

From ~/Documents/code/ansible/inventories/production/hosts:

Host	IP	Use for Talos
devGPU	10.0.10.122:11434	Ollama + RTX 4080 — point OLLAMA_URL here (do not run bundled Ollama on a small host)
edge (LXC 222)	10.0.10.20	Caddy reverse proxy — add Caddyfile.snippet
automationlab (225)	10.0.10.45	Docker stacks already; disk ~85% full — possible but tight
PVE.BU.SVR (VM 200)	10.0.10.200	Lab VM — good candidate for heavy Kali-based container
dev02 (P53)	10.0.10.100	QA workstation — local dev / smoke tests
osiris (228)	10.0.10.40	OSINT (different tool) — not Talos
atlas (237)	10.0.10.71	Atlas brain — already uses devGPU for LLM

Recommended: Run Talos on PVE.BU.SVR or a new pve10 LXC in .40–.79, with:

OLLAMA_URL=http://10.0.10.122:11434
OLLAMA_MODEL=qwen2.5:14b

Verify Ollama from the LAN:

curl -s http://10.0.10.122:11434/api/tags

Quickstart

cd talos
docker compose --profile build-only build tools
docker compose build talos

# Option A: bundled Ollama (needs GPU profile on host)
docker compose --profile bundled-ollama up -d
docker exec -it $(docker compose ps -q ollama) ollama pull qwen2.5:14b

# Option B: homelab devGPU (recommended)
echo 'OLLAMA_URL=http://10.0.10.122:11434' >> .env
docker compose up -d talos

Open http://localhost:8000

First scan (loopback): set ALLOW_LOOPBACK=true in .env, target 127.0.0.1, Passive profile.

Legal external target: scanme.nmap.org, Standard profile, authorization checked.

Profiles

Profile	Tools
passive	nmap discovery, port scan, service detect, optional testssl
standard	passive + whatweb, curl headers, gobuster, nikto
redteam	standard + sqlmap, optional hydra SSH brute, searchsploit

Caddy

See Caddyfile.snippet on edge @ 10.0.10.20 for talos.levkin.ca. Use basic auth — this tool is dangerous.

Hardening

• Run on a management VLAN; no WAN exposure without auth
• Use BLOCKED_TARGETS for sensitive IPs
• Prefer devGPU for LLM to avoid OOM on small GPUs
• cap_add: NET_RAW required for nmap -sS

Tests

cd backend && pip install -e ".[dev]" && pytest tests
# or
docker compose exec talos pytest

Architecture

Browser ──WS/REST──► talos (FastAPI)
                         │
                         ├── subprocess ──► Kali tools (same image)
                         └── httpx ──────► Ollama (devGPU or container)
                         └── SQLite (/data)

Troubleshooting

Issue	Fix
nmap SYN scan fails	Ensure NET_RAW / NET_ADMIN in compose
Ollama OOM	Use devGPU; set OLLAMA_MAX_LOADED_MODELS=1 on host
sqlmap errors	Writable /tmp in container
Tools badge degraded	Rebuild tools image; check PATH