Work / Nexus / Changelog / Day 12

Day 12 Document 6 min

Day 12: Where core-nexus Actually Is

Catch-up Document day: the platform spine moved under us — R2 overlay, Vault in nexus-hashistack, SOC k8s Gateway/Console/Wazuh, gated Day 9 bridge. Approvals and real agent SSE are still deferred Builds.

Calendar Day 12 was supposed to be typed Gateway approvals. The repo did something else for a few days: it grew a deployable SOC spine. This entry records that state so the challenge log matches git, not the original Build brief.

The approvals Build is deferred (see Day 13). This day is documentation.

Object store

Lab still defaults to MinIO. Non-lab gets Cloudflare R2 via NEXUS_GW_OBJECT_STORE_BACKEND=r2 and the SOC k8s overlay under deploy/kubernetes/soc/overlays/r2/. Same S3 client (minio_client.py); Day 7’s browser CORS + public-endpoint rewrite still matters for MinIO. R2 does not retire that pipe — it changes where the bucket lives.

Secrets

In-cluster Vault packs are gone from this repo’s ownership story. nexus-hashistack owns Vault. Gateway hydrate uses AppRole. Console lab bypass and a local-user allowlist exist for dev. Prod-shaped SOC wires Wazuh Deployments to Vault-synced wazuh-secrets.

SOC on Kubernetes

What is real in deploy/kubernetes/soc/:

  • API Gateway and Nexus Console Deployments on the SOC base
  • Wazuh indexer TLS/security lab overlay
  • Jupyter workbench + Athena range overlay (agent profiles still live in nexus-athena)
  • webtop-soc remote retired from the k8s base — Console is the operator UI here
  • Flux/Argo image pins and a D1 artifact-index Worker beside the gateway (nexus-metadata)

What is not Day 14: no recorded “Athena traffic → real Wazuh alerts → triage in Console” Use run.

Agent Feed still on a bridge

scripts/day9-console-bridge.py remains. Compose gates it (NEXUS_ENABLE_DAY9_BRIDGE). Gateway SSE proxy is real; athena-agents still does not expose production /sessions + /events. Until that lands, Console Agent Feed without the bridge is silence.

Approvals

Console panel + badge poll. Gateway routes/approvals.py is a thin proxy (raw dicts, stringly errors). No models/approvals.py, no Property 8. Empty pending is the honest default.

What I am not claiming

  • Detection coverage is still — in the tracker
  • Act executes tools in athena-agents now (post–Day 4 stub era), but that does not equal Suricata/Wazuh catching Juice Shop in this challenge’s Phase 2 sense
  • Architecture docs that say Chroma RAG / Plan skill injection / TUI write-back are “implemented” are ahead of the code — called out on Day 13

Next

Day 13: full audit vs the 100 Days list. Then either the deferred Approvals/SSE Builds or Day 14 Use against the SOC spine.