infra-audit

# zuvo:infra-audit > Audit the security of LIVE servers/infrastructure the user owns, over SSH, plus > external exposure verification through a proxy. This is the orthogonal companion > to `security-audit` (repo-resident IaC config), `db-audit` (DB as a data layer), > and `pentest` (app-code exploitability). Routing boundary: **"is my server > secure?" → infra-audit**. > > Architecture (DD-5): a **deterministic collector** (`scripts/infra-collect.sh`) > gathers everything per host into a normalized JSON bundle; **parallel LLM > analysts** each see only their layer's normalized findings; **deterministic** > dedup/scoring/report assembly. The LLM **interprets, never detects**. ## Argument Parsing | Argument | Meaning | |----------|---------| | `[path/to/hosts.yaml]` | Fleet audit from inventory (default: `zuvo/infra/hosts.yaml` if present) | | `--host user@addr[:port]` | Single ad-hoc host, no inventory file needed | | `--quick` | IS1 + IS3 (internal) + IS4 only; < 3 min/host target | | `--dimensions IS1,IS3,…` | Explicit dimension subset | | `--no-install` | Hard read-only: never offer tool installation (disables the DD-3 gate) | | `--dry-run` | Print every SSH/local command without executing; no connections beyond DNS | | `--resume <run-dir>` | Continue an interrupted run from `state.json` | | `--proxy <url>` | External-scan proxy override (else hosts.yaml `defaults.proxy`, else `$ZUVO_SCAN_PROXY`) | | `--scan-via <ssh-target>` | Run the external leg FROM this SSH host via...