Homelab security on 512 MB: warden scores my logs and asks before it bans anything

I wanted a single place to monitor my homelab: who is accessing it from outside, which machines have known security vulnerabilities, what needs patching, and whether any new threats have appeared on the network. I wanted this all on a small box without installing an agent on every machine. The most obvious tools, such as Wazuh and CrowdSec, either require an agent or ban automatically without asking first.

So, I created a smaller solution called "warden" that combines existing scanners and adds its own logic. Warden is plain Python and uses an SQLite database to store data. It collects logs from the reverse proxy, authentication system, and Cloudflare tunnel, then scores potential issues like suspicious file paths, SQL injection attempts, scanner user agents, and login failures.

It also checks for vulnerabilities using trivy, patches systems over SSH, and monitors the network for threats using Suricata. Warden communicates with a Discord channel for user approval before taking any action. This approach allows it to run on minimal resources (1 vCPU and 512 MB RAM) while providing comprehensive monitoring and security for a small homelab environment.