nix-topology is a NixOS-based tool that automatically generates infrastructure and network diagrams as SVGs from NixOS configurations. It uses a global topology module to aggregate information from multiple NixOS hosts, extracting data about interfaces, services, containers, and virtual machines via specialized extractors. The gathered topology is then rendered using ELK for layout and converted to SVG via custom tools (elk-to-svg and html-to-svg), producing both a physical connection diagram (showing nodes as cards with hardware and service details) and a network-centric view (showing logical networks and their connections). The architecture is modular, with clear separation between information gathering, topology aggregation, and rendering.
T-Pot Community Edition (tpotce) is an all-in-one honeypot platform that orchestrates 20+ honeypots (e.g., cowrie, dionaea, conpot, heralding) alongside network security monitoring tools (p0f, Suricata, fatt) and the Elastic Stack (Elasticsearch, Logstash, Kibana) for centralized log storage, analysis, and real-time attack visualization. The system is deployed via Docker Compose with an Ansible-based installer supporting multiple Linux distributions. It offers several deployment flavors (standard, sensor, mini, LLM, tarpit, mobile) and supports a distributed Hive/Sensor architecture where remote sensors forward encrypted logs to a central Hive over HTTPS. Architecturally, each honeypot runs in an isolated container with read-only filesystems, non-root user, and dedicated networks. The ELK stack processes all telemetry: Logstash ingests JSON logs from persistent volumes, Elasticsearch indexes them, and Kibana provides dashboards and an attack map. A custom p0f (passive OS fingerprinting) fork is bundled and compiled from C source, demonstrating deep network-level analysis. The update and backup system (`update.sh`) is a robust, self-contained script that handles version pinning, configuration backups, Elasticsearch state exports, and image rollouts. The codebase includes a reusable test harness (`docker/_tests/lib/common.sh`) for validating individual honeypot containers with protocol-specific probes.
This is a comprehensive e-commerce backend platform built with Spring Boot 3.5+, JDK 17, and a multi-module Maven architecture. In production, it serves two distinct APIs: `mall-admin` (admin management) and `mall-portal` (customer-facing storefront), plus a dedicated `mall-search` module for Elasticsearch-powered product search. The system handles product cataloging, order lifecycle management, user registration/authentication, coupon and promotion calculations, shopping cart operations, payment integration (Alipay), and content management (home page banners, recommendations). It uses MySQL as the primary database via MyBatis (with generated mappers), Redis for caching and session management, MongoDB for user activity data (browsing history, favorites), RabbitMQ for delayed order cancellation, and MinIO/Aliyun OSS for file storage. Security is implemented with Spring Security and JWT, including dynamic path-based authorization. The codebase follows a layered architecture (Controller → Service → Mapper/DAO) with shared modules `mall-common` and `mall-security` providing reusable utilities for API responses, pagination, exception handling, Redis caching, and authentication. While heavily reliant on MyBatis Generator for data access objects and includes some long service methods, the overall structure is well-organized and modular, making it suitable as a reference for similar e-commerce projects. No data research or analytical components are present; this is purely an application codebase.
OpenUBA is a full-stack User and Entity Behavior Analytics (UEBA) platform for security anomaly detection, investigation, and response. It provides a complete lifecycle for ML models (install, train, infer, version, share) via a pluggable registry supporting OpenUBA Hub, GitHub, HuggingFace, and local filesystem. The platform includes a rule engine with a visual DAG-based builder (ReactFlow), case management, real-time dashboards, multi-backend visualization (matplotlib, plotly, bokeh, etc.), and an LLM-powered assistant. The backend is built on FastAPI with PostgreSQL, SQLAlchemy, JWT/RBAC authentication, and optional Spark/Elasticsearch integrations. The frontend uses Next.js 14 (App Router), Apollo Client (GraphQL), shadcn/ui, and Recharts. A Python SDK enables programmatic access to all features. The system runs on Kubernetes with a Kopf operator managing custom resources (UBATraining, UBAInference, UBAWorkspace, UBAPipeline) for containerized model execution in isolated Docker images per ML framework (sklearn, PyTorch, TensorFlow, NetworkX). While primarily an application, it includes research-oriented components like experiment tracking, feature store, and Jupyter notebook workspaces, making it a hybrid tool for both security operations and data science workflows.