Write to us
OpsFox

OpsFox

For the tinfoil-hat crowd. We bring dead machines back, watch everything, trust nothing that phones home, and write down every step so you can do it too.

  • Monitoring
  • Detection
  • OPSEC
  • Tradecraft
  • Intelligence
  • Counter-intelligence
  • Local AI
  • Self-hosting
  • Human in the loop
Enter AthanorHow we work

Envision · Create · Maintain

  1. Pulled from the pile.

    Somebody threw this out. It still has years in it.

  2. Open it up.

    A fresh CMOS cell. The tired disk swapped out. You don't need anyone's permission to open a case.

  3. Power it on.

    One amber light, then the fan, then the boot log. Hearing it spin up never gets old.

  4. Lock it down.

    Updates, keys only, MFA, egress denied by default, an encrypted disk. And a backup you've actually restored.

  5. Put it to work.

    Monitoring, a local model, a DNS filter. Whatever it's good for.

  1. Watch everything.

    Logs, metrics, alerts, and the weird stuff in between. On your own metal, where nothing phones home.

  2. Run it on your own machine.

    Even an old one, dug out of the computer graveyard. Run it local and nothing leaves the room.

  3. A human holds the key.

    AI proposes. We decide. Anything that can't be undone waits for a person.

  4. Then we write down how.

    Every lab, every mistake, every fix. So you can do it too.

Built, configured and tested with

30 tools. Sorted by what they do.

  1. Watch

    • Grafana
    • Prometheus
    • OpenSearch
    • Trivy

  2. Perimeter

    • WireGuard
    • OPNsense
    • Traefik
    • NGINX
    • Pi-hole
    • Let's Encrypt

  3. Identity

    • Authentik
    • Vault
    • Keycloak

  4. Platform

    • Linux
    • Debian
    • Proxmox
    • Docker
    • Podman
    • Kubernetes
    • Raspberry Pi
    • Parrot OS
    • Android

  5. Build

    • Terraform
    • Ansible
    • Gitea

  6. Keep

    • MinIO
    • BorgBackup
    • Nextcloud
    • Immich

  7. Local AI

    • Ollama

  1. How long they’re in before anyone notices.

    Identification alone accounts for 183 of them. Up 2.5%, reversing a five-year decline. Most of it is spent not knowing.

    247 days to identify and contain a breach

    IBM Cost of a Data Breach 2026 · p.15

  2. Small is not a shield.

    Not worth more. Just cheaper to reach. Under a thousand people counts as small. So we write for the small ones.

    96% of ransomware victims are small orgs

    Verizon DBIR 2026 · p.98

  3. The door was already open.

    CISA-confirmed, exploited in the wild; three-quarters still open. Unfinished work, not sophistication. We publish how to finish it.

    26% of known-exploited vulns fully patched

    Verizon DBIR 2026 · p.17
Where it runs

  1. Your hardware.

    A machine in a room you control, inside a line you drew. Start here.

  2. Or your cloud account.

    Instances or containers, in an account you opened and pay for. Still yours.

  3. Most stacks phone home.

    A licence check. A vendor console. A little telemetry. Each one is someone else's off switch.

  4. Cut it.

    Sever the link. Both sides keep running.

  5. Never ours.

    There's no OpsFox server in the middle, nothing to log into, and nothing phoning home.

The rack you ownIsometric drawing of a server rack standing inside a boundary line drawn on your premises: patch panel, switch, a stack of three servers, one of them running metrics, and a UPS. One uplink cable leaves the boundary through a cut mark labelled revocable, the only thing in the picture that is not yours to keep.YOUR PREMISESREVOCABLESERVERSMETRICSUPS

YOUR METALOn hardware you can physically touch.

YOUR CLOUD ACCOUNTINSTANCESCOMPUTEVOLUMESCONTAINERSTASKSOBJECT STORETHEIRSERVERREVOCABLE

YOUR CLOUD · INSTANCESYour account, your keys, your bill.

YOUR CLOUD · CONTAINERSContainers in your account. Less to babysit.

  1. An agent builds it.

    One story, one branch, its own worktree. Tests first. Agents commit. They never push.

  2. Three critics attack it.

    Code, security and QA. Three separate sessions. They recheck every fix until all three say Open findings: 0.

  3. Then it waits for you.

    Routine work merges once the critics sign off. This one is a security call. A call on security, money, law or taste waits for a person.

  4. You decided. It went through.

    AI proposes. We decide. An agent can pass on a yes. It can't give one.

Scrolling won't move it.Enter Athanor