From 5f62afe6eb1523765d390383d9ed5b7d32947ed9 Mon Sep 17 00:00:00 2001
From: Nick Trochalakis <Chewbaccalakis@users.noreply.github.com>
Date: Tue, 22 Sep 2026 20:50:06 -0700
Subject: [PATCH] Add Flatcar VM for cisa-kev-rss on goose (#4)

Provision a dedicated Flatcar host that runs the CISA KEV RSS container
from GHCR, with a dozzle agent and hub remote entry like the other VMs.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
---
 butane/cisa_kev_rss.yaml | 52 ++++++++++++++++++++++++++++++++++++++++
 butane/monitor.yaml      |  2 +-
 terraform.tfvars         | 13 ++++++++++
 3 files changed, 66 insertions(+), 1 deletion(-)
 create mode 100644 butane/cisa_kev_rss.yaml

diff --git a/butane/cisa_kev_rss.yaml b/butane/cisa_kev_rss.yaml
new file mode 100644
index 0000000..98b21cd
--- /dev/null
+++ b/butane/cisa_kev_rss.yaml
@@ -0,0 +1,52 @@
+variant: flatcar
+version: 1.0.0
+
+# CISA KEV RSS feed. Turns the CISA Known Exploited Vulnerabilities catalog
+# into an RSS 2.0 feed (https://github.com/xsaveopt/cisa-kev-rss).
+#
+# Feed:  http://192.168.7.64:3000/rss
+# Health: http://192.168.7.64:3000/health
+#
+# Stateless: the container refreshes from CISA every ten minutes and keeps
+# nothing on disk, so it is safe to rebuild at any time.
+
+systemd:
+  units:
+    - name: cisa-kev-rss.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=CISA KEV RSS feed
+        After=docker.service
+        Requires=docker.service
+        [Service]
+        TimeoutStartSec=0
+        ExecStartPre=/usr/bin/docker pull ghcr.io/xsaveopt/cisa-kev-rss:latest
+        ExecStartPre=-/usr/bin/docker rm --force cisa-kev-rss
+        ExecStart=/usr/bin/docker run --rm --name cisa-kev-rss \
+          -p 3000:3000 \
+          ghcr.io/xsaveopt/cisa-kev-rss:latest
+        ExecStop=/usr/bin/docker stop cisa-kev-rss
+        Restart=always
+        RestartSec=5s
+        [Install]
+        WantedBy=multi-user.target
+    - name: dozzle-agent.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=Dozzle Agent
+        After=docker.service
+        Requires=docker.service
+        [Service]
+        TimeoutStartSec=0
+        ExecStartPre=-/usr/bin/docker rm --force dozzle-agent
+        ExecStart=/usr/bin/docker run --name dozzle-agent \
+          -v /var/run/docker.sock:/var/run/docker.sock \
+          -p 7007:7007 \
+          amir20/dozzle:v11.1.1 agent
+        ExecStop=/usr/bin/docker stop dozzle-agent
+        Restart=always
+        RestartSec=5s
+        [Install]
+        WantedBy=multi-user.target
diff --git a/butane/monitor.yaml b/butane/monitor.yaml
index 623215b..967f52e 100644
--- a/butane/monitor.yaml
+++ b/butane/monitor.yaml
@@ -44,7 +44,7 @@ systemd:
           --tmpfs /data \
           -p 8080:8080 \
           -e "DOZZLE_HOSTNAME=Oswald Logs" \
-          -e "DOZZLE_REMOTE_AGENT=192.168.7.60:7007|oswald-runner|Infra,192.168.7.61:7007|ai|Infra,192.168.7.62:7007|oswl-connector|Infra" \
+          -e "DOZZLE_REMOTE_AGENT=192.168.7.60:7007|oswald-runner|Infra,192.168.7.61:7007|ai|Infra,192.168.7.62:7007|oswl-connector|Infra,192.168.7.64:7007|cisa-kev-rss|Infra" \
           amir20/dozzle:v11.1.1
         ExecStop=/usr/bin/docker stop dozzle
         Restart=always
diff --git a/terraform.tfvars b/terraform.tfvars
index d58f2d7..627b4b1 100644
--- a/terraform.tfvars
+++ b/terraform.tfvars
@@ -251,6 +251,19 @@ nodes = {
         qemu_guest_agent = false
         butane_file      = "butane/monitor.yaml"
       }
+      # CISA Known Exploited Vulnerabilities catalog as an RSS feed.
+      # Stateless container; feed at :3000/rss.
+      "cisa-kev-rss" = {
+        hostname         = "cisa-kev-rss"
+        vmid             = 214
+        ip               = "192.168.7.64"
+        vlan             = 7
+        memory           = 1024
+        cores            = 1
+        disk_size        = 16
+        qemu_guest_agent = false
+        butane_file      = "butane/cisa_kev_rss.yaml"
+      }
     }
     machines = {
       "grist" = {