OpsFox
Monitoring, detection, identity and perimeter — and then the things you actually work in all day. Chat, files, photos, your own source forge, private inference. One suite, on metal you own, and none of it phones home.
- Observability
- Detection
- Identity
- Perimeter
- Chat
- Files
- Photos
- Source
- Backups
- Inference
Apache-2.0 at the base · Nothing phones home
Built, configured and tested with30 tools, all self-hostable
- Linux
- Debian
- Proxmox
- Docker
- Podman
- Kubernetes
- Raspberry Pi
- Parrot OS
- Android
- Terraform
- Ansible
- WireGuard
- OPNsense
- Traefik
- NGINX
- Pi-hole
- Let's Encrypt
- Authentik
- Vault
- Keycloak
- Grafana
- Prometheus
- OpenSearch
- Gitea
- Trivy
- MinIO
- BorgBackup
- Nextcloud
- Immich
- Ollama
The window where you’re undefended.
Three numbers the practice was built around. Every retainer closes one of these gaps.
- 96%Verizon DBIR 2026 · p.98of ransomware victims are small orgs
Not worth more — cheaper to reach. Under a thousand people counts as small.
- 247 daysIBM Cost of a Data Breach 2026 · p.15to identify and contain a breach
Identification alone accounts for 183 of them. Up 2.5%, reversing a five-year decline.
- 26%Verizon DBIR 2026 · p.17of known-exploited vulns fully patched
CISA-confirmed, exploited in the wild; three-quarters still open. Unfinished work, not sophistication.
Eleven services. No black boxes.
Every one of them runs on hardware you own, and none of them phones home. Four are built and the rest are specified in the open. Open any built one to see exactly what it is assembled from.
WATCHTOWER — SENTINEL · NIGHTWATCH · SENTRY · CHECKPOINT, the 4 built components, on a single node. Figures are representative of a two-dozen-host fleet; no client data appears on this site.
- Built
- 04
- Built and reviewed. Publishing one repository at a time as each clears review.
- Designed, not yet built
- 07
- Named, scoped and on the page before they exist, not after.
- critical0
- high1
- medium4
- low9
22 ok1 degraded1 maintenance
The eleven
Open a built one for its parts list.
Everything on the bench, listed before it works.
Nothing below claims to be finished. Each one gets a guide when it works end to end, and not before — the full register carries the parts, the reasoning, and the mistakes.
Build — all planned
Bill of materials
Time
- PWNAGOTCHIPlanned$60–$110
Hardware · WiFi
A Tamagotchi that eats WiFi handshakes.
Bill of materials
Raspberry Pi Zero 2 W · Waveshare 2.13" e-ink HAT · LiPo battery + charger board · microSD card · 3D-printed case
$60–$110
Time
An evening, plus print time
- RAGNARPlanned$70–$190 depending on the Pi
Hardware · Assessment
A pocket assessment box that fits in a jacket.
Bill of materials
Raspberry Pi Zero 2 W · Waveshare 2.13" e-Paper HAT · PiSugar 3 · microSD card · USB WiFi adapter
$70–$190 depending on the Pi
Time
An evening to build, considerably longer to use responsibly
- THIN CLIENT LABPlanned$75–$200 for the whole cluster
Homelab · Low power
A real homelab out of $25 corporate e-waste.
Bill of materials
2–3 thin clients or micro desktops · SATA or NVMe SSDs · RAM upgrade · Gigabit switch · Kill-A-Watt or smart plug
$75–$200 for the whole cluster
Time
A weekend
- OWN YOUR STACKPlannedFree — bring your own box
Self-hosting · Security
Replace the SaaS you're renting with things you run.
Built from
Docker Compose · Ansible · SENTINEL · NIGHTWATCH · SENTRY · CHECKPOINT
Free — bring your own box
Time
A weekend to stand up, ongoing to run
Your hardware, or your cloud account.
Never ours. No OpsFox tenancy holds your data, so you can revoke us and still have everything.
- Your boundary
- Revocable link
- The cut
YOUR METAL
On hardware you can physically touch.
YOUR CLOUD · INSTANCES
Templated into your own AWS account.
YOUR CLOUD · CONTAINERS
Managed containers, less to babysit.
The cut mark is the whole argument: sever the link and everything on your side of the boundary keeps running — what it costs to have us run it.
Every price
is on the page.
Four rungs, in the order you climb them. The monthly retainers are not on this screen — they are priced in full, with their per-environment add-ons, on the pricing page.
- Environments, max
- 12
- Hosts, max
- 120
- Client relationships
- 3
- Onboardings a quarter
- 1
2 of the 3 relationships are retainer seats. Above the ceiling, the work gets referred out.
- BaselinePublic repositoriesFreeApache-2.0
1 host, 1 tenant - FoxholeHardened fleet repo$249per month, per org · $2,490/yr
1 org · unlimited seats · 60 hosts - Takeover SprintFixed fee · two weeks$3,500one environment · flat
1 environment · 2 weeks · flat fee
Published · 2026.08
Three phases. Every engagement.
Bought one at a time, in the order shown. Inside every phase the work moves the same way: agents draft, a person reviews and owns the call, and nothing reaches you unreviewed.
Envision
Map the estate before building on it. Every gap ranked, in writing.
2–3 weeks
Create
Built, patched, watched, and written down as it goes.
2 weeks
Maintain
The tested monthly patch train, run in a window you pick.
Monthly · 3-month minimum
4business hours to acknowledge a triage request
Inside 09:00–18:00 ET, Mon–Fri. A miss costs us 5% of the monthly fee per missed acknowledgment, measured from a ticket log you can audit.
Sold with OUTPOST
Every engagement runs this arc, whether it stops after the first phase or continues for years. Each phase is bought on its own.
Worth a call if any of this is true.
You run client infrastructure with nobody owning security.
You inherited an environment nobody documented.
One engineer holds the architecture in their head.
A client asked a security question; you guessed.
You’d rather run metal than explain a cloud bill.
Whoever writes the fix should deploy it.
A fork gets you the files. It doesn’t get you next month.
The single-node stack, the audit tool, the build guides, and the weekly dispatch cost nothing and aren't gated. No asterisk. If you run it yourself and never get in touch, that's a perfectly good outcome.
If gating something would make a non-paying adopter easier to breach, it doesn’t get gated.
Browse the code- MFA enforcement
- TLS 1.2+ only
- Secrets handling
- Audit logging
- Least privilege
- Egress default-deny
- Tested backupBASELINE: Not published yet
Start with the free one.
The whole single-node baseline is Apache-2.0. Let your own engineer say whether it is any good — before any money changes hands.