OPERATION ANANSI

Overview

Anansi is a self-hosted, real-time geospatial dashboard built for the Hampton Roads / Historic Triangle region of Virginia — a self-hosted n8n automation server handling intelligence ingestion, feeding into God's Eye View, an open-source CesiumJS 3D globe platform, so live public data — traffic, weather, local news — renders as one operational picture instead of five separate tabs.

The goal wasn't just a pretty map. It's closer to a lightweight SOC-style situational awareness tool: multiple independent feeds, normalized into one schema, polled continuously, rendered without a manual refresh.

Assets & Methods

Operational Timeline

ENTRY 002 — AUTOMATION

Self-Hosted Automation Server (n8n)

n8n runs as a Docker container with its workflow data persisted in a named volume, so nothing gets wiped on restart. Each data source is its own workflow, triggered on-demand by webhook rather than a fixed schedule — the intent being upstream APIs only get hit when the dashboard's actually being viewed, not burning quota in the background for no reason.

ENTRY 003 — TRAFFIC INTEL

Traffic Data Pipeline

Live incident data comes from TomTom's Traffic Incident Details API (v5), bounded to Norfolk, Virginia Beach, Chesapeake, Portsmouth, Suffolk, Newport News, and Hampton, normalized into a consistent {lat, lng, label, type, metadata} schema so it lines up with everything else in the pipeline. Static incidents were the starting point — getting the TomTom flow API working came later, and that's what actually drives the live vehicle-tracking overlay: individual moving markers on real Williamsburg-area streets, continuously updating rather than a stale snapshot.

ENTRY 005 — LOCAL NEWS INTEL

Local News Pipeline — Historic Triangle

The original target was a Williamsburg news outlet's RSS feed directly, but the source actively blocks automated requests at the network level — 403 regardless of what headers get sent. Pivoted to a location-filtered Google News RSS query instead, which meant writing a raw regex-based XML parser rather than trusting n8n's built-in conversion node, since the actual output shape didn't match what the documentation implied. Obituary and real-estate listing noise gets filtered out at parse time — not useful for a situational-awareness feed.

ENTRY 007 — COVER IDENTITY

Rebrand: Anansi

Full rebrand of the base platform — UI, page title, config/branding strings (AI prompts, User-Agent headers, console messages). Project docs and the original repo/YouTube links stayed untouched, since those point to the real public source and deserve credit as-is. Logo replaced everywhere — favicon, title bar, loading screen — with an original red spider-mark SVG. Full color pass: black/near-black backgrounds, gold text (#d4af37 primary, #a8842a dimmer for secondary/hint text — checked both against WCAG contrast, 9.4:1 and 5.6:1), red (#c81e1e) for buttons, borders, and active states.

A follow-up pass caught a few spots the first sweep missed — icon SVGs with colors baked directly into the file instead of driven by CSS, the voice-control widget's waveform, the first-run modal, the command-dock borders, CCTV panel indicators. Subtitle changed to "I'm everywhere. And nowhere."

ENTRY 008 — AI SECURITY INTEL

New Module: AI Security Intelligence Dashboard

Anansi picked up a second area of operations: the AI/ML attack surface. The new AI Security module is a remake of CYBERMED1C's AI-Tracker — an AI-maintained dashboard that lives entirely in a GitHub README — rebuilt as a structured, interactive Anansi panel. It tracks actively exploited vulnerabilities in AI/ML infrastructure, AI security research and incidents, frontier-model releases, and AI-related executive orders, each linked to its primary source (maintainers, CISA, the CVE Program, OWASP, and the AI labs).

Same normalize-first approach as the n8n pipelines: every advisory is a record in data/ai-security.json with one shape — {id, product, status, cvss, affected, fixed, exposedIf, doNow, lookFor, exploitation, sources[]}. The triage board sorts by exploitation evidence first (CISA KEV → public PoC → vendor-disclosed) and CVSS second, so an exploited 8.6 outranks an unexploited 10.0. Clicking a row expands Exposed if / Do now / Look for / Exploitation; filter chips and search narrow the board. Research, model, and policy intel sits in a right-rail tabbed panel — the same layout lesson learned from the 757 redesign.

The page fetches the JSON when served and falls back to a seed copy embedded by build.py when opened from disk, so it runs on any static host with no API key. Open the live AI Security dashboard →

System Architecture

TRACK 1 — n8n (Docker, self-hosted)
  ├── Traffic  → TomTom Incident API   ─┐
  ├── Weather  → NOAA Alerts API        ├─→ normalized JSON via webhook
  └── News     → Google News RSS       ─┘
                                              │
                                              ▼
                    Hampton Roads 757 panel (right rail, live feed)

TRACK 2 — Native platform integrations
  ├── TomTom Flow API   → live vehicle position tracking on the globe
  └── Overpass API      → real road geometry (self-hosted proxy, mirror-ordered)

                         Anansi (CesiumJS 3D globe, in-browser)

TRACK 3 — AI Security Intel module
  ├── Maintainer advisories / CISA KEV / CVE records  ─┐
  ├── AI lab research, OWASP GenAI                     ├─→ data/ai-security.json
  └── Frontier-model releases, executive orders       ─┘          │
                                                          build.py (seed embed)
                                                                    ▼
                    AI Security dashboard (triage board + right-rail intel feed)

The n8n track is fully webhook-triggered rather than cron-scheduled — upstream APIs only get called when the panel's actually being viewed. The native track (TomTom flow, Overpass) runs independently inside the platform itself, with its own self-hosted proxy layer handling mirror selection and request headers.

What Actually Went Wrong

• Norton Antivirus's SSL inspection — its own certificate wasn't trusted by Node, causing intermittent UNABLE_TO_VERIFY_LEAF_SIGNATURE failures on outbound HTTPS calls. Not a firewall issue — confirmed by testing with the firewall fully disabled and seeing identical behavior. Fixed via NODE_EXTRA_CA_CERTS pointed at Norton's own certificate bundle.
• Overpass mirror hanging at the TCP level — the first-tried mirror ate the entire 22-second timeout before ever reaching a working one, which made it look like a total failure when really only one mirror was broken.
• A stale pre-rebrand User-Agent, silently 406'd by Overpass's abuse filter — looked identical to the mirror-timeout symptom from the outside. Only isolated by swapping the header alone and re-testing.
• NOAA's undocumented User-Agent requirement — a silent 403 with no clue as to why, until cross-referencing NOAA's own docs directly.
• Source-level bot blocking — the original news source's protection couldn't be bypassed with header spoofing, so the fix was pivoting to a different feed entirely.
• n8n's XML node output shape — didn't match assumed conventions three separate times; ended up dumping the raw HTTP response and parsing the actual structure directly instead of trusting the built-in node.
• n8n's empty-array execution behavior — a workflow returning zero results (a perfectly valid state) was silently halting execution before it reached the response node. Had to explicitly enable "Always Output Data" to fix it.
• A layer-level failure mode — one failed poll on enable was reverting the whole Hampton Roads toggle to OFF instead of degrading gracefully; fixed to retry automatically instead of failing hard.
• Google Cloud billing — the Photorealistic 3D Tiles API needs a linked payment method even for free-tier usage, which blocked the optional Google 3D imagery layer. Still an open item.

Three of the traffic-related failures above looked identical from the outside — all presented as "coverage stuck at 0%." Isolating them meant changing one variable at a time — firewall off/on, header swap, mirror order — instead of assuming a single cause and stopping there.

What's Next

• Enable the Google Photorealistic 3D Tiles imagery layer once billing's sorted out.
• Persist historical snapshots of each layer (SQLite/Postgres) to support basic before/after trend queries instead of only showing current state.
• Add a lightweight alerting hook (Discord/Telegram webhook) for high-severity weather or traffic events.
• Automate the AI Security module's daily refresh with an n8n workflow that pulls CISA KEV and maintainer advisories into ai-security.json, keeping a rolling 30-day history.
• Link the AI Security module into the main globe UI as its own panel.

Skills Applied

• Automation / ETL engineering — self-hosted n8n workflows normalizing three independent, differently-shaped public APIs into one consistent schema.
• API integration & troubleshooting — diagnosing auth/header requirements, bot protection, and inconsistent response shapes across multiple third-party services.
• Full-stack extension of an existing platform — writing and wiring new application code into an open-source base project.
• Root-cause network debugging — isolating three unrelated failures (SSL trust store, TCP-level mirror hang, abuse-filter header block) that presented identically from the outside, by changing one variable at a time instead of guessing.
• Self-hosted infrastructure — Docker-based deployment, container persistence, local network configuration on Windows.
• Threat intelligence & vulnerability management — an AI/ML advisory board prioritized by exploitation evidence (CISA KEV, public PoC) rather than CVSS alone.
• Product / UI work — end-to-end rebrand including original logo design, color theming, and consistent naming across a codebase.

Files Touched

A non-exhaustive list of what actually changed, for anyone who wants to check the work directly:

index.html
style.css
vite.config.js
src/main.js
src/ui.js
src/hud.js
src/locations.js
src/data/traffic.js
src/data/cctv.js
src/data/bikeshare.js
src/data/hamptonRoads757.js        (new)
src/voice/gevRealtime.js
src/styles/anansi-logo.svg
public/*.svg
.env / .env.example
ai-security/index.html             (new)
ai-security/src/dashboard.html     (new)
ai-security/data/ai-security.json  (new)
ai-security/build.py               (new)
images/ai-security-dashboard.png   (new)

On the Use of AI

Claude (Anthropic) was used throughout this project as a coding and debugging assistant — working through n8n workflow errors, writing and wiring the custom CesiumJS data layer, walking through the Docker and environment setup, and helping design the rebrand (logo concepts, color system, UI pass). It was also used to help write this debrief itself, and to build the AI Security module (schema, dashboard, build script, and screenshot).

The architecture decisions, the actual debugging (including isolating the three stacked network failures in Entry 006B), testing, and every commit pushed to this repo were done directly — Claude functioned as a pair-programming and research tool, not an autonomous builder. Being upfront about that split felt more honest than presenting this as solo work from scratch, and more useful than pretending AI assistance wasn't part of how modern development actually happens.

Credit

Where This Leaves Things

A public, general-purpose open-source visualization platform got turned into a purpose-built, live regional intelligence tool — designing the ETL pipeline, working through real API and infrastructure issues as they came up, extending the platform's actual codebase with new functionality, and finishing with a fully custom identity. What's live now is a working, self-hosted, real-time dashboard built entirely on free-tier public data sources — now with a second module covering the AI/ML attack surface alongside the Hampton Roads picture.