natoascode/zero-trust-cockpit repository overview

⁠OFFICIAL: zero-trust-cockpit

This is the Zero Trust Cockpit app, from Cloud Underground.

⁠Nexus Creator Vault — Zero-Trust-Cockpit v5.1

The Sovereign Exocortex. The DEV command.

⁠⚠️ Production vs Test — Read This First

test-deploy.sh only ever touches the nexus0 container on port 2500. It will never remove, stop, or modify nexus-creator-vault.

⁠Architecture

Internet → Cloudflare Tunnel → Cerberus Manager (port 80/443)
                                    ↓ API: http://nexus-creator-vault:8000/invoke
                         Nexus Creator Vault (port 1050)  ← PRODUCTION
                                    ↓ mounts
                         /var/run/docker.sock → host Docker
                         /dev → host /dev/kvm (Tier 1 hardware KVM)
                         creator-vault0:/config → abc's home + Desktop

⁠v5.1 — What Was Fixed

⁠The Chrome Remote Desktop dpkg Cascade (v5 root cause)

Chrome RDP's postinst creates a system user named _crd_network. Ubuntu's default NAME_REGEX in /etc/adduser.conf rejects underscore-prefixed names. This left CRD in an iF (broken) dpkg state. Every apt-get call after that re-ran the broken postinst and exited code 1 — making it look like LibreOffice, OBS, Blender, VS Code all "failed", when they'd actually installed fine.

v5.1 STEP 0 pre-flight fixes this before any package installs:

1. Patches NAME_REGEX in /etc/adduser.conf to allow _ prefix
2. Pre-creates _crd_network user/group so the postinst finds them and skips
3. Installs CRD with dpkg --force-bad-name as backup
4. clear_dpkg_errors() runs after every install step

⁠Previous test-deploy.sh deleted production container

Earlier test-deploy.sh used CONTAINER_NAME="nexus-creator-vault", which replaced the production container. Fixed: test container is now nexus0 on port 2500 with a separate volume nexus0-config.

⁠Quick Deploy (Test)

Place nexus0.sh and test-deploy.sh in the same directory, then run:

bash test-deploy.sh

From inside cerberus-manager:

docker exec -it cerberus-manager bash
mkdir -p /tmp/ncv && cd /tmp/ncv
# Copy nexus0.sh and test-deploy.sh here
bash test-deploy.sh

Access the test desktop at: http://localhost:2500

Password: sovereign

⁠Cleanup (Test Container Only)

When testing is complete, remove the nexus0 test container:

bash test-deploy.sh --cleanup

This removes:

• Container: nexus0
• Volume: nexus0-config
• Build dir: /tmp/nexus0-test-build

nexus-creator-vault is never touched. After cleanup, verify production is intact:

docker ps | grep nexus-creator-vault

⁠Production Deploy (nexus-creator-vault)

After testing passes, deploy the same image as production:

docker run -itd \
    --name=nexus-creator-vault \
    --hostname=nexus-creator-vault \
    --privileged \
    -p 1050:3000 \
    -e PUID=1000 \
    -e PGID=1000 \
    -e TZ=America/Denver \
    --restart unless-stopped \
    -v /dev:/dev \
    -v creator-vault0:/config \
    -v /var/run/docker.sock:/var/run/docker.sock \
    natoascode/zero-trust-cockpit:creator-vault

⁠Access Methods

⁠1. KasmVNC (always works)

http://<host-ip>:1050     ← production
http://<host-ip>:2500     ← test
Password: sovereign

Open in browser after ~30 seconds — s6 needs time to start KasmVNC.

⁠2. Chrome Remote Desktop

docker exec -it nexus-creator-vault bash   # or nexus0 for test
su - abc
# Go to: remotedesktop.google.com/headless → Authorize
DISPLAY= /opt/google/chrome-remote-desktop/start-host \
  --code="<YOUR-CODE>" \
  --redirect-url="https://remotedesktop.google.com/_/oauthredirect" \
  --name=$(hostname)

Run as abc — never as root. Token expires ~30 min.

⁠3. SSH

ssh abc@<host-ip> -p 22
# Password: sovereign

⁠KVM Virtualization

During docker build: "Tier 2" in log = correct and expected (no /dev/kvm in build). Tier 1 activates at runtime.

# Verify KVM tier at runtime
docker exec nexus0 kvm-ok
docker exec nexus0 ls -la /dev/kvm

⁠User abc

UID is set by linuxserver's /init using PUID/PGID env vars — not usermod during build.

⁠Installed Arsenal

⁠s6 Services (start automatically at container boot)

cont-init scripts (run once at start):

⁠Post-Deploy Verification

# Replace "nexus0" with "nexus-creator-vault" for production checks

# Verify CRD is cleanly installed ('ii' = good, 'iF' = dpkg broken)
docker exec nexus0 dpkg -l | grep chrome-remote-desktop

# Full install log
docker exec nexus0 cat /tmp/nexus0-install.log | tail -40

# Arsenal summary
docker exec nexus0 grep -E '✓|✗' /tmp/nexus0-install.log

# Ollama responding
docker exec nexus0 curl -s http://localhost:11434/api/tags

# KVM tier
docker exec nexus0 kvm-ok

# Both containers at once
docker ps | grep -E "nexus0|nexus-creator-vault"

⁠Troubleshooting

Browser shows nothing at :2500 or :1050 immediately after deploy: Wait 30 seconds. KasmVNC and KDE take time to initialize via s6. The test-deploy.sh script waits 30s automatically.

Build log shows dpkg errors for LibreOffice/OBS/Blender/VS Code: Check if nexus0.sh v5.1 is being used:

grep "NAME_REGEX" nexus0.sh
# Must return a line. If not, you have the old v5 — replace with v5.1.

CRD shows 'iF' in dpkg:

docker exec nexus0 dpkg -l | grep chrome-remote-desktop
# If 'iF': nexus0.sh v5 was used. Rebuild with v5.1.

KVM not working:

docker exec nexus0 kvm-ok
# "cannot be used" → check host BIOS VT-x/AMD-V setting
# "permission denied" → missing --privileged or -v /dev:/dev in docker run

test-deploy.sh accidentally deleted nexus-creator-vault: This should not happen with the current script — it only removes nexus0. If using an old version of the script, redeploy production:

docker run -itd --name=nexus-creator-vault --hostname=nexus-creator-vault \
    --privileged -p 1050:3000 -e PUID=1000 -e PGID=1000 -e TZ=America/Denver \
    --restart unless-stopped -v /dev:/dev -v creator-vault0:/config \
    -v /var/run/docker.sock:/var/run/docker.sock \
    natoascode/zero-trust-cockpit:creator-vault

Your /config data is safe in the creator-vault0 volume.

Rebuild test from scratch:

bash test-deploy.sh --cleanup
bash test-deploy.sh

⁠Sovereign Network

docker network connect sovereign-net nexus-creator-vault
# Cerberus calls: http://nexus-creator-vault:8000/invoke

⁠Architecture Notes

⁠Why lscr.io/linuxserver/webtop:ubuntu-kde (not natoascode/nexus0:latest)

CA Pro architectural directive: natoascode/nexus0:latest is a stale derivative. It causes qemu-kvm installation failures and dbus-daemon permission denied errors during the build. The linuxserver base:

• Always has current Ubuntu packages
• s6-overlay pre-configured as PID 1
• PUID/PGID UID mapping built into /init
• KDE Plasma + KasmVNC pre-integrated

⁠Why COPY nexus0.sh (not RUN wget nexus0.sh)

Downloading at build time pulls whatever is on GitHub main — potentially the unfixed v5. COPYing ensures the patched v5.1 that you have locally is what runs in the build.

⁠Why Tier 2 during build is correct

/dev/kvm is not accessible inside docker build. The log line "Tier 2: QEMU TCG" during build is correct and expected. At runtime with --privileged -v /dev:/dev, the cont-init.d/01-kvm-permissions script runs and Tier 1 activates.