TL;DR: A hardened Kasm Workspace deployment where every research session runs in an isolated, egress-controlled, throwaway container. Four layers (server hardening, VPN egress, instances and tools, monitoring), built so sensitive workloads never weaken the host.
The architecture:
Layer 1 Server hardening -> locked-down base, secure headers, minimal mgmt surface
Layer 2 Egress VPN -> all instance traffic through encrypted tunnels, no raw outbound
Layer 3 Instances + tools -> AlmaLinux / Parrot / Ubuntu, Brave, SpiderFoot, Forensic OSINT
