Cyber Deck
Threat-intelligence dashboard · deck.lankyonline.org ↗
Summary
A self-hosted infosec news & threat-intelligence dashboard that tracks security events as they break: new CVEs, data-breach reports, threat-actor activity and general infosec news, alongside live social feeds, pulled into one continuously updating board. It's the "what's happening right now" layer I check before the day starts.
01How it works
A background collector polls a curated set of security and social sources on a schedule, normalises them, and stores them in a database; the web front end renders them as a live, categorised board. RSS Bridge turns sources that don't offer a clean feed (Mastodon, Bluesky, Reddit and others) into structured feeds the collector can read. The whole thing is published securely through a Cloudflare Tunnel, so there are no open inbound ports.
02The stack
| Component | Image | Role |
|---|---|---|
| Web app | cyber-deck-web (custom) | The dashboard UI: renders the categorised, live-updating board (8098). |
| Collector | cyber-deck-collector (custom) | Scheduled worker that fetches, parses and de-duplicates sources into the database. |
| RSS Bridge | rssbridge/rss-bridge | Generates feeds from sites without native RSS (social platforms, etc.). |
| Database | postgres:16-alpine | Stores collected items, categories and de-dup state. |
| Cloudflare Tunnel | cloudflared | Publishes the site at deck.lankyonline.org with no open ports. |
03Why I built it
- Threat intelligence: a real, running feed of CVEs, breaches and threat-actor activity I use for context in defensive work.
- Data pipeline: scheduled collection, parsing, de-duplication and storage across multiple source types.
- Full-stack self-hosting: custom web + worker services, a database, and secure tunnelled publishing.