HoneyWire: Open-source, zero-agent cyber canaries for your homelab (Thinkst/OpenCanary alternative)

Submitted ⁨⁨3⁩ ⁨days⁩ ago⁩ by ⁨andreicscs@lemmy.world⁩ to ⁨selfhosted@lemmy.world⁩

https://lemmy.world/pictrs/image/0b268df3-f315-4a26-bcda-01a2a3c18fec.png

Hey everyone,

I wanted to run high-fidelity network canaries in my homelab, but I couldn’t justify enterprise pricing, and I wasn’t a fan of managing custom orchestration across all my VMs to make available oss solutions work.

So, I built HoneyWire. It’s a completely free, open-source distributed deception platform.

It uses a point-in-time CLI wizard to deploy hardened, distroless Docker traps. You run the command once, it spins up the decoy, registers it to your centralized Hub dashboard, and the setup agent completely exits. No persistent background daemons.

Features:

Zero-Agent: No ongoing background overhead on your hosts.

Centralized UI: View fleet health, uptime, and lateral movement alerts in dark mode.

Alerting: Built-in push notifications and SIEM forwarding.

Privacy: 100% free, open-source, and strictly zero telemetry.

GitHub Repo: github.com/andreicscs/HoneyWire Landing Page: honeywire.dev

Would love to hear your thoughts on the architecture or any feedback if you test it out!

original

Comments

Sort:hotnew top

curbstickle@anarchist.nexus ⁨3⁩ ⁨days⁩ ago
Just going to comment here because I don’t need to keep dismissing reports repeatedly - this post is entirely on-topic, breaks no rules, inclusive of the newly formed rule (not yet made official in the sidebar, but so far with rather consistent support as written) as its fully open and not paywalled in any way, and licensed under AGPLv3.

@andreicscs@lemmy.world I would recommend you add your AI disclosure to the post itself though, noting how you used it as you already have in the comments.

original
- andreicscs@lemmy.world ⁨2⁩ ⁨days⁩ ago
  Will do, my bad, thanks for the clarification!
  
  original
chronicledmonocle@lemmy.world ⁨1⁩ ⁨day⁩ ago
Another AI generated project from a person who has zero comment history beyond promoting said project and is likely to stop committing to the repo in a week.

original
- andreicscs@lemmy.world ⁨1⁩ ⁨day⁩ ago
  Thanks for the feedback! Not quite, but I get the skepticism with how many low-effort vibecoded projects are launching right now! I’d love for you to take a look at the project (or my other projects), I’m not a vibe coder, and I’m not new at coding at all. This project is 3 months old and as you can see from the commit history I’ve been consistently fixing things and adding new features to it since when it first launched. This is the v2.0 release, there were other releases before over the course of the last few months, this update in particular is a Security and UX update focused on improving supply chain security, and deployment friction. Feel free to check out the changelogs for a closer look at the changes: github.com/andreicscs/HoneyWire/…/CHANGELOG.md
  
  I’m sharing this tool because it fixed a personal problem, and i noticed many others had the same feelings regarding available deception technology options especially in OSS.
  
  original
  - chronicledmonocle@lemmy.world ⁨1⁩ ⁨day⁩ ago
    Appreciate you taking the time to respond. I’m so jaded by the low effort posts here that it’s made me grumpy 😂
    
    original
    -> View More Comments
philanthropicoctopus@thelemmy.club ⁨1⁩ ⁨day⁩ ago
Is this for homelab penetration testing?

original
- andreicscs@lemmy.world ⁨18⁩ ⁨hours⁩ ago
  Well, you could use it for blue team simulations i guess, but not really, it is a Deception platform, meaning it is a tool used to deploy micro honeypots, or as i like to call them, tripwires, that report back to the hub as soon as they are tripped. Since these tripwires offer no real services or value every interaction with them is pretty suspicious, meaning that if something for example tries to poke around a server that has been deployed with HoneyWire tripwires, it will report back to the hub reporting back what touched it, when, where, and what was done. Check the project’s official website for more details: honeywire.dev You can also check out the concept of Canaries on Thinkst Canary s website i think they do a great job explaining the idea canary.tools.
  
  original
irmadlad@lemmy.world ⁨3⁩ ⁨days⁩ ago
Do I understand correctly that with HoneyWire you deploy ‘false assets’? I guess along the lines of a honeypot but the ability to deceive bots and other nefarious actors into thinking there are specific assets that they might want to exploit?

original
- andreicscs@lemmy.world ⁨3⁩ ⁨days⁩ ago
  That’s exactly how it works. You deploy these low-interaction decoys (traps) across your internal network to act as tripwires. Since legitimate users have no reason to touch them, any interaction is a high-fidelity alert indicating a potential breach or lateral movement. Right now, you can spin up a few different types of traps, like a network scan detector that sits completely quietly and triggers an alert if it detects a port or network scan hitting that specific node, or a Web Router Login Page, that looks like a legacy admin interface and instantly alerts you if someone tries to brute-force or log in. The best part about HoneyWire’s architecture is that developing new sensors is the easiest part, so the ecosystem is designed to be highly extensible as the community grows.
  
  original
  - irmadlad@lemmy.world ⁨3⁩ ⁨days⁩ ago
    That’s very interesting. Thanks.
    
    Now for the burning question on everyone’s mind…was this vibe coded, or AI assisted in any way? I don’t outright reject AI assisted projects, but of course my concerns are always security. Also, what is the depth of your experience coding?
    
    Thanks
    
    original
    -> View More Comments
- rainwall@piefed.social ⁨3⁩ ⁨days⁩ ago
  Looks like the following from github:
  
  Suite of Official HoneyWires: Includes native TCP Tarpit, Web Router Decoy, File Canary (FIM), ICMP Canary, and Network Scan Detector.
  
  I don’t see any AI disclosure on github or here OP. Can you specificy how AI has been used on this project?
  
  original
  - andreicscs@lemmy.world ⁨3⁩ ⁨days⁩ ago
    AI Disclosure: As a student and solo developer/maintainer, I used AI as a “junior dev” during project development to help accelerate boilerplate writing and documentation. All core architecture, system structure, and security logic were fully designed and implemented by me.
    
    original
    -> View More Comments
  - irmadlad@lemmy.world ⁨3⁩ ⁨days⁩ ago
    
    Can you specificy how AI has been used on this project?
    
    I cannot. I’m not the dev.
    
    original
Alfredolin@sopuli.xyz ⁨1⁩ ⁨day⁩ ago
Hi.

hw-sensor-tcp-tarpit crashes and that stops also the hub. I don’t know how to check the logs for that container.

I can’t open issues or anything on Github (this the reminder for every foss project participant: please use an alternative to github).

original
- andreicscs@lemmy.world ⁨1⁩ ⁨day⁩ ago
  Hi thanks for the report! What’s with github not accepting issues ?
  
  Could you provide details about the environment you are deploying in and what your honeywire-compose.yml file generated by the hub looks like?
  
  I’d love to look into your specific edge case it would be awesome if you could provide info that would help me debug it
  
  original
  - Alfredolin@sopuli.xyz ⁨22⁩ ⁨hours⁩ ago
    It doesn’t matter if Github is more convenient, I, for example, am straight banned from it with no possibility to sign-up. (Issue with arkoselabs not working from my ip/device, which is required to complete captcha for signup, and the support is non existent, see [this post](edit coming).
    
    Ok, issue is clear: tcp-tarpit is trying to use an already occupied port. I was not sure how to check the containers log, your command was correct.
    
    Yes, I was trying to deploy everything on the same machine as starter.
    
    I found that I could change the port from the hub, under fleet management, now it seems to work.
    
    I still don’t get why the hub stopped working though. Cpntainer log is only showing from the last start.
    
    original
    -> View More Comments