⬡ Ideal Setup Order
1
Windows 11 Pro Base
PATH, tools (Git, Python, Node, Nmap, Wireshark, BurpSuite, KeePassXC, ShareX), DNS → Quad9 DoH
✅ DONE
2
WSL2 Engine
DISM features, .wslconfig (mirrored networking, 4GB RAM cap), LxssManager service
✅ DONE
3
Ubuntu 24.04
wsl --install, DNS fix (9.9.9.9), pip/nmap/git, Shadow313 repo clone, pyspx
⚠ DNS FIX NEEDED
4
Kali Linux 2026.2
wsl --install -d kali-linux, full package install, Metasploit DB, wordlists, DNS fix
⚠ DNS FIX NEEDED
5
Docker Desktop
WSL2 backend, Open WebUI container (port 3000), Shadow313 API (port 8000), PostgreSQL
⚠ NEEDS RESTART
6
Ollama + Models
ollama serve, pull llama3.2:3b / mistral:7b / codellama:7b / shadow313-nexus, Open WebUI connection
✅ DONE
7
Shadow313 CLI v4
pip install -e .[full], 2858 tests GREEN, 313-BIND active, FIPS 203/204/205
✅ DONE
8
Hetzner VPN
€3.29/mo VPS, WireGuard server, kill-switch, bug bounty tools, NOT needed for local dev
⏳ NEXT
9
Telegram Bot
@BotFather token, TELEGRAM_BOT_TOKEN + CHAT_ID in .env, docker compose --profile telegram up
⏳ READY TO DEPLOY
☁️ INTERNET / CLOUD LAYER
🤖 Claude (Anthropic)
api.anthropic.com:443
This chat. No security data sent.
HTTPS · TLS 1.3
This chat. No security data sent.
🐙 GitHub
github.com:443
piyyy314/Shadow313-Nexus
CI/CD via Actions
HTTPS · git push/pull
piyyy314/Shadow313-Nexus
CI/CD via Actions
🦙 Ollama Registry
ollama.com:443
matarmohamad313/shadow313-nexus
Model pull only
HTTPS · model download
matarmohamad313/shadow313-nexus
Model pull only
🌐 IPFS Network
ipfs.io:443
313-BIND receipt anchoring
Public hashes only
HTTPS · opt-in
313-BIND receipt anchoring
Public hashes only
WireGuard UDP:51820 (encrypted tunnel)
↕
HTTPS:443 (direct)
🖥️ HETZNER VPS — €3.29/mo · CX22 · Helsinki · NEXT TO SET UP
🔐 WireGuard Server
wg0 interface
10.8.0.1/24 VPN subnet
Kill-switch for clients
Port 51820 UDP
UDP:51820
10.8.0.1/24 VPN subnet
Kill-switch for clients
Port 51820 UDP
🛡️ Hardening Stack
UFW firewall
fail2ban
Suricata IDS
Wazuh agent
Honeypot tripwires
SSH:22 (key-only)
fail2ban
Suricata IDS
Wazuh agent
Honeypot tripwires
🔍 Bug Bounty Tools
Nuclei, subfinder
httpx, amass
Remote scan targets
Results → local Shadow313
Internal only
httpx, amass
Remote scan targets
Results → local Shadow313
⚠️ NOT NEEDED for local Shadow313 development. Set up AFTER Ubuntu/Kali/Docker are stable.
Purpose: IP masking for bug bounty recon, remote scan infrastructure, VPN for mobile devices.
WireGuard client tunnel
↕
All traffic encrypted
🪟 WINDOWS 11 PRO HOST — Dell Latitude 5490 · 16GB RAM · 476GB SSD
🦙 Ollama Engine
localhost:11434
4 models loaded
CPU inference
~13.3GB storage
HTTP:11434
4 models loaded
CPU inference
~13.3GB storage
🔐 WireGuard Client
wg0 tunnel
→ Hetzner VPS
Kill-switch capable
UDP:51820
UDP:51820 outbound
→ Hetzner VPS
Kill-switch capable
UDP:51820
🔍 Burp Suite 2026
localhost:8080
HTTP proxy
Web app testing
Configure browser → 8080
HTTP:8080
HTTP proxy
Web app testing
Configure browser → 8080
🔒 Quad9 DoH DNS
9.9.9.9:443
149.112.112.112
Encrypted DNS
Malware blocking
DoH:443
149.112.112.112
Encrypted DNS
Malware blocking
🐳 Docker Desktop
WSL2 backend
Manages all containers
host.docker.internal gateway
host.docker.internal
Manages all containers
host.docker.internal gateway
💻 VS Code
Remote WSL extension
Opens Ubuntu/Kali files
Python + Docker extensions
Local editor
Opens Ubuntu/Kali files
Python + Docker extensions
📁 shadow313-nexus/
C:\Users\shiatoali\shadow313-nexus
939 files · git repo
Synced with GitHub
Local filesystem
939 files · git repo
Synced with GitHub
WSL2 hypervisor (Hyper-V)
↕
Shared filesystem /mnt/c/
↕
host.docker.internal:11434
🐧 WSL2 LAYER — .wslconfig: memory=4GB · networkingMode=mirrored · dnsTunneling=true
🐧 Ubuntu 24.04 LTS
User: shiatoali
Python 3.12 · pip · nmap · git
Shadow313 CLI v4 (pip install -e .)
pyspx · scapy · fastapi · uvicorn
DNS: 9.9.9.9 / 8.8.8.8 (fixed)
/mnt/c/Users/shiatoali/shadow313-nexus
wsl -d Ubuntu-24.04
Python 3.12 · pip · nmap · git
Shadow313 CLI v4 (pip install -e .)
pyspx · scapy · fastapi · uvicorn
DNS: 9.9.9.9 / 8.8.8.8 (fixed)
/mnt/c/Users/shiatoali/shadow313-nexus
⚠ DNS FIX NEEDED: run fix-wsl-docker-dns.ps1
🐉 Kali Linux 2026.2
User: shia313
Metasploit Framework · PostgreSQL
nmap 7.99 · wordlists · SecLists
pwntools · impacket · scapy
DNS: 9.9.9.9 / 8.8.8.8 (fixed)
Bug bounty + red team tools
wsl -d kali-linux
Metasploit Framework · PostgreSQL
nmap 7.99 · wordlists · SecLists
pwntools · impacket · scapy
DNS: 9.9.9.9 / 8.8.8.8 (fixed)
Bug bounty + red team tools
⚠ DNS FIX NEEDED: run fix-wsl-docker-dns.ps1
Docker socket
↕
Container networking
↕
Ollama via host.docker.internal:11434
🐳 DOCKER CONTAINERS — Network: shadow313_net · WSL2 backend
💬 Open WebUI
ghcr.io/open-webui/open-webui:main
ChatGPT-like UI for Ollama
Connects → host.docker.internal:11434
Volume: open-webui:/app/backend/data
localhost:3000
ChatGPT-like UI for Ollama
Connects → host.docker.internal:11434
Volume: open-webui:/app/backend/data
⚡ Shadow313 API
FastAPI event bus
6 routes · 313-BIND receipts
NEXUS detection pipeline
Audit server · SARIF export
localhost:8000
6 routes · 313-BIND receipts
NEXUS detection pipeline
Audit server · SARIF export
📱 Telegram Bot
shadow313.integrations.telegram
Polls shadow313-api:8000/api/events
Forwards HIGH/CRITICAL alerts
Profile: --profile telegram
No port (outbound only)
Polls shadow313-api:8000/api/events
Forwards HIGH/CRITICAL alerts
Profile: --profile telegram
🗄️ PostgreSQL
Metasploit database backend
Initialized in Kali WSL2
msf / msf_test databases
localhost:5432
Initialized in Kali WSL2
msf / msf_test databases
🌐 Nginx (HTTPS)
Reverse proxy for Shadow313 API
SSL: docker/nginx/shadow313.crt
Ports 7313 (HTTP) / 7314 (HTTPS)
localhost:7313 / 7314
SSL: docker/nginx/shadow313.crt
Ports 7313 (HTTP) / 7314 (HTTPS)
pip install -e .[full]
↕
shadow313 CLI commands
↕
313-BIND receipts → IPFS
⬡ SHADOW313 CLI v4.0.0 — 2,4,107 tests GREEN · 29 detectors · POSTURE GREEN
V1 Core (30 MODULES)
recon · vuln · exploit
network · defense · quantum
plugins · cicd · docs
network · defense · quantum
plugins · cicd · docs
V2 Advanced (13)
RAG · agent · EPSS/KEV
ATT&CK · ML anomaly
JA3 · campaign · graph
ATT&CK · ML anomaly
JA3 · campaign · graph
V3 Extended (10)
browser-recon · container
AD auditor · SIEM
LSTM · malware sandbox
AD auditor · SIEM
LSTM · malware sandbox
V4 NEXUS (28)
313-BIND · Ghost-Watch
VSAT · CEQS · QE-BIM
AEON · NVL72 · C-SBOM
VSAT · CEQS · QE-BIM
AEON · NVL72 · C-SBOM
🔐 313-BIND Protocol
ts...313 nanosecond entropy
SLH-DSA (FIPS 205) signing
SHA3-512 chain hash
IPFS anchor (opt-in)
SLH-DSA (FIPS 205) signing
SHA3-512 chain hash
IPFS anchor (opt-in)
🛡️ PQC Stack
ML-KEM-768 (FIPS 203)
ML-DSA-65 (FIPS 204)
SLH-DSA (FIPS 205)
AES-256-GCM · Argon2id
ML-DSA-65 (FIPS 204)
SLH-DSA (FIPS 205)
AES-256-GCM · Argon2id
👁️ Ghost-Watch CADL
L1 Monitor → L5 Neutralize
WE-FORGE lure docs
AETHER decoy traffic
CHRONOS reversion
WE-FORGE lure docs
AETHER decoy traffic
CHRONOS reversion
⬡ Port & Service Registry
⬡ What Depends on What
Shadow313 CLI → requires: Python 3.12, pyspx, cryptography, scapy (optional)
Open WebUI → requires: Docker Desktop + Ollama running on host:11434
Shadow313 API → requires: Docker Desktop + shadow313 Python package
Telegram Bot → requires: Docker Desktop + Shadow313 API healthy + BOT_TOKEN + CHAT_ID
Ubuntu apt-get → requires: WSL2 DNS fix (networkingMode=mirrored + 9.9.9.9)
Kali tools → requires: WSL2 DNS fix + Kali package install
Hetzner VPN → requires: nothing local — independent VPS setup
Bug bounty recon → requires: Hetzner VPN (for IP masking) + Kali tools
313-BIND IPFS anchor → requires: internet access (opt-in) or local-only mode
GitHub CI/CD → requires: git push + GitHub Actions (vercel.json valid)