Diagnosing DHCP Starvation Attacks at Home

graph LR
 A[Agent Orchestrator - SPIFFE SVID] --> B[Tool Gateway]
 B -->|OPA decision + task_id| C[Credential Broker]
 C -->|AssumeRole w/ session policy| D[AWS STS]
 D -->|60s scoped token| C
 C --> B
 B -->|scoped call| E[External Tool API]
 B -->|token fingerprint| F[Action Ledger]

graph LR
 A[Pod A - no sidecar] -- redirected via iptables/eBPF --> Z1[ztunnel node1]
 Z1 -- HBONE mTLS tunnel --> Z2[ztunnel node2]
 Z2 --> W[Waypoint proxy - L7 policy]
 W --> B[Pod B - no sidecar]

module "bench_hetzner" {
  source        = "./modules/hetzner-instance"
  server_type   = "cpx31"
  location      = "fsn1"
  image         = "ubuntu-22.04"
  ssh_keys      = [var.ssh_key_id]
}

module "bench_digitalocean" {
  source   = "./modules/do-instance"
  size     = "s-4vcpu-8gb"
  region   =...

apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
 name: gha-runner-scaler
 namespace: arc-runners
spec:
 scaleTargetRef:
 apiVersion: actions.summerwind.dev/v1alpha1
 kind: RunnerDeployment
 name: default-runner-deployment
 pollingInterval: 15
 cooldownPeriod: 120
 minReplicaCount: 0
 maxRe...