# OSINT Box — iMac 2011
## Hardware
| Component | Spec | Status |
| ———– | —— | ——– |
| Model | iMac 2011 (Sandy Bridge) | ✅ On desk |
| CPU | Originally i3 → Upgrading to i7-2600S | ⏳ Ordered from China (1 week) |
| RAM | 16GB | ✅ Ready |
| Storage | 500GB Crucial SSD | ✅ Ready |
## Architecture (planned)
``` iMac (Debian 12 + XFCE) ├── Tailscale (LAN mesh — remote access from kaburuaibox) ├── WireGuard client → Hetzner CX22 (clean IP exit) ├── Tor proxy (per-tool or per-VM — TBD on build) │ ├── VM A: Hetzner WireGuard (daily OSINT — scrapers, recon, browsing) ├── VM B: Tor (dark web / forums) ├── VM C: Burner (per-operation, snapshotted, rollback on shutdown) │ └── MCP: kaburu-shell-mcp-osint.py (SSH via Tailscale) ```
## Egress Paths (multi-option)
| Path | Speed | Anonymity | Best For |
| —— | ——- | ———– | ———- |
| Hetzner CX22 | Fast | Medium | Daily ops |
| Tor (on iMac) | Slow | High | Threat actor forums, dark web |
| Open WiFi | Depends | Very high | Physical recon, burner ops |
| LoRa | kbps | Maximum | Exfil-only, emergency signal |
## OSINT Tool Baseline
| Category | Tools |
| ———- | ——- |
| Recon | theHarvester, Recon-ng, SpiderFoot, Amass, Sublist3r |
| Social/Persona | Sherlock, Holehe, Maigret, Twint |
| Infrastructure | Shodan CLI, Nmap, DNSRecon, whois, Dig |
| Browser | Firefox + Multi-Account Containers + FoxyProxy |
| Threat Intel | MISP light, feed-based, or OpenCTI (TBD) |
## Prep (Week 1 — waiting for CPU)
- [ ] TOMORROW: Configure Agent Reach channels on kaburuaibox (gh auth, cookies, Exa MCP) - [ ] TOMORROW: Research Clay.com integration — data enrichment for OSINT workflows - [ ] TOMORROW: Set up HA voice pipeline — custom conversation agent → Hermes API - [ ] TOMORROW: RustDesk + Divi collab workflow — guide Steve through visual builds - [ ] Spin up Hetzner CX22 on separate account (€3.99/mo) — no link to kaburu.cc - [ ] Install WireGuard server on CX22 - [ ] Write Debian 12 build guide - [ ] Pre-fab `kaburu-shell-mcp-osint.py` (MCP tool for iMac management) - [ ] Wiki page (done) - [ ] Syncthing installed — desktop/laptop connect syncthing - [ ] Agent Reach installed (4/13 channels) — config pending
## Voice Pipeline (HA → Hermes)
Goal: Steve speaks to any Home Assistant voice device and I hear/respond directly.
``` Device → HA Assist (STT) → Custom Conversation Agent → Hermes API → response → TTS ```
Devices available: - Home Assistant Voice 0935ac - M5Stack Atom Echo (ESP32-S3) - Echo Show 5 (via Alexa) - Pixel 9 / Motorola Edge 20 Pro (HA companion app)
## Divi Collab (RustDesk)
Goal: Steve remotes in via RustDesk, I guide real-time design decisions. - Steve: hands — clicks, drags, places modules in Divi Builder - Gwen: brain — design logic, colour theory, layout structure, responsive fixes - : We work as a two-person team on visual builds
## Separate Hermes Instance
The iMac will run its own Hermes instance with: - Different API key - Different model - Zero access to any Kaburu MSP infrastructure - If the box is popped, it leads to a burner Hetzner account and throwaway AI key — nothing else
## Notes
- Hetzner does NOT allow Tor exit relays — Tor stays on the iMac, not on any Hetzner instance - Tor routing decision deferred — will decide per-tool vs. transparent proxy when hardware is live - Blackbeard ISP research — started 2026-06-21, needs more info to identify - 10 spare machines available — if this rig burns, next one is ready