# Deployment & Security

Managed documentation for Deployment & Security.

# Deployment Topology

<!-- BOOKSTACK-DOCUMENT-RELEASE:BEGIN -->
# Deployment Topology

| Field | Value |
| --- | --- |
| Distribution | BSS — OpenC5ISR |
| Product | OpenC5ISR |
| Release | 0.15.1 |
| Deployment | `openc5isr.bss.dev` |
| Source | `/srv/bss/releases/OpenC5ISR-v0.15.0-20app` |
| Evidence | Release and readable host configuration |
| Source fingerprint | `93926e8c834f1ed79c9017a4096f70c76d73ce4f870f104fbd0cf54b2bed50ee` |
| Status | Generated baseline — human review required |

> **Verification boundary:** This page combines platform design guidance with static evidence from the release. It does not prove that every detected interface is enabled, reachable, secure, or operational in the deployed environment.

## Observed services

| Service | Working directory | ExecStart | Evidence |
| --- | --- | --- | --- |
| opencybersec-agent.service | `—` | `/opt/opencybersec-agent/opencybersec_agent.py --config /etc/opencybersec-agent.json` | edge/opencybersec/systemd/opencybersec-agent.service |
| openlvc-ais-bridge.service | `/opt/opensof/edge/openlvc` | `/usr/bin/python3 /opt/opensof/edge/openlvc/ais_nmea_bridge.py --opensof ${OPENSOF_URL} --token [REDACTED] --bind 0.0.0.0 --port 10110` | edge/openlvc/systemd/openlvc-ais-bridge.service |
| openlvc-dis-bridge.service | `/opt/opensof/edge/openlvc` | `/usr/bin/python3 /opt/opensof/edge/openlvc/dis_udp_bridge.py --opensof ${OPENSOF_URL} --token [REDACTED] --bind 0.0.0.0 --port 3000` | edge/openlvc/systemd/openlvc-dis-bridge.service |
| openlvc-flightgear-bridge.service | `/opt/opensof/edge/openlvc` | `/usr/bin/python3 /opt/opensof/edge/openlvc/flightgear_bridge.py --opensof ${OPENSOF_URL} --token [REDACTED] --bind 0.0.0.0 --port 5505` | edge/openlvc/systemd/openlvc-flightgear-bridge.service |
| openlvc-rti-gateway.service | `/opt/opensof/edge/openlvc` | `/usr/bin/python3 /opt/opensof/edge/openlvc/rti_openbus_gateway.py --opensof ${OPENSOF_URL} --token [REDACTED] --federation ${OPENLVC_FEDERATION} --federate ${OPENLVC_FEDERATE} --sidecar-command ${OPENLVC_RTI_SIDECAR_COMMAND}` | edge/openlvc/systemd/openlvc-rti-gateway.service |
| openpnt-phc2sys@.service | `—` | `/opt/openpnt/bin/openpnt-linuxptp run phc2sys --instance /etc/openpnt/linuxptp/instances/%i.json --bin-dir /opt/openpnt/linuxptp/bin` | edge/openpnt-linuxptp/systemd/openpnt-phc2sys@.service |
| openpnt-ptp4l@.service | `—` | `/opt/openpnt/bin/openpnt-linuxptp run ptp4l --instance /etc/openpnt/linuxptp/instances/%i.json --bin-dir /opt/openpnt/linuxptp/bin` | edge/openpnt-linuxptp/systemd/openpnt-ptp4l@.service |
| openpnt-ts2phc@.service | `—` | `/opt/openpnt/bin/openpnt-linuxptp run ts2phc --instance /etc/openpnt/linuxptp/instances/%i.json --bin-dir /opt/openpnt/linuxptp/bin` | edge/openpnt-linuxptp/systemd/openpnt-ts2phc@.service |
| openrf-agent.service | `/opt/openrf-agent` | `/usr/local/bin/openrf-agent --config /etc/openrf/openrf-agent.json` | openrf/agent/systemd/openrf-agent.service |
| openc5isr-bss.service | `/srv/bss/instances/openc5isr/current` | `/usr/local/bin/npm start` | /etc/systemd/system/openc5isr-bss.service |

## Observed reverse-proxy topology

| Source | Server names | Locations | proxy_pass |
| --- | --- | --- | --- |
| /etc/nginx/sites-available/openc5isr.bss.dev | openc5isr.bss.dev<br>openc5isr.bss.dev | /ws/raspbot<br>/ | http://127.0.0.1:8096/ws/raspbot<br>http://127.0.0.1:3202/ |

## Topology verification

- Confirm which directory or symlink is the authoritative current release.
- Confirm each public hostname terminates TLS and routes to the intended instance/port.
- Document shared backends separately from edition-specific application instances.
- Record network zones and firewall policy for public, management, data and sensor interfaces.
<!-- BOOKSTACK-DOCUMENT-RELEASE:END -->

---

## Maintainer Notes

<!-- BOOKSTACK-DOCUMENT-RELEASE:NOTES-BEGIN -->
Add human-reviewed deployment notes, corrections, decisions, screenshots, and links here. Content outside the generated block is preserved on future runs.
<!-- BOOKSTACK-DOCUMENT-RELEASE:NOTES-END -->

# Security Architecture

<!-- BOOKSTACK-DOCUMENT-RELEASE:BEGIN -->
# Security Architecture

| Field | Value |
| --- | --- |
| Distribution | BSS — OpenC5ISR |
| Product | OpenC5ISR |
| Release | 0.15.1 |
| Deployment | `openc5isr.bss.dev` |
| Source | `/srv/bss/releases/OpenC5ISR-v0.15.0-20app` |
| Evidence | Reference controls and static security indicators |
| Source fingerprint | `93926e8c834f1ed79c9017a4096f70c76d73ce4f870f104fbd0cf54b2bed50ee` |
| Status | Generated baseline — human review required |

> **Verification boundary:** This page combines platform design guidance with static evidence from the release. It does not prove that every detected interface is enabled, reachable, secure, or operational in the deployed environment.

## Security model

Security must be applied across identity, content, interfaces, transport, deployment and evidence—not bolted onto the user interface. Each module should authenticate subjects, authorize actions and data, protect transport, minimize secrets, emit audit events and preserve provenance.

## Observed indicators

| Indicator | Observed |
| --- | --- |
| Secret-designated environment variables | ANTHROPIC_API_KEY, OPENAAR_SIGNING_KEY, OPENAI_API_KEY, OPENBUS_API_TOKEN, OPENCYBERSEC_AGENT_TOKEN, OPENCYBERSEC_OPERATOR_TOKEN, OPENCYBERSEC_READ_TOKEN, OPENKNOWLEDGE_EDITOR_TOKEN, OPENLLM_ANTHROPIC_API_KEY, OPENLLM_OPENAI_API_KEY, OPENLLM_OPENWEBUI_API_KEY, OPENLLM_OPERATOR_TOKEN, OPENPNT_AGENT_TOKEN, OPENPNT_TOKEN, OPENRF_AGENT_TOKEN, OPENRF_OPERATOR_TOKEN, OPENRF_READ_TOKEN, OPENSSA_SENSOR_TOKEN, OPENWEBUI_API_KEY, ROCKETCHAT_AUTH_TOKEN, ROCKETCHAT_OUTGOING_TOKEN, TOKEN |
| Security term counts | TLS: 1960, authorization/RBAC: 172, audit: 101, authentication: 64, CORS: 19 |
| Potential sensitive file names | — |

## Required controls

| Boundary | Minimum control |
| --- | --- |
| User/API identity | Named accounts or service identities, least privilege, revocable tokens and MFA where supported. |
| Transport | TLS for public and management interfaces; authenticated/encrypted links for operational buses where threat requires. |
| Content | Handling/release labels, role/attribute policy, object-level authorization and protected exports. |
| Secrets | No secrets in source, documentation, URLs or logs; use protected environment/secret stores and rotation. |
| Audit/evidence | Record actor, action, target, result, source time and correlation identifiers with tamper-aware retention. |
| Supply chain | Pinned dependencies/images, vulnerability review, signed release artifacts and reproducible deployment records. |

## Immediate review actions

- Rotate any token or password exposed in chat, shell history, logs or documentation.
- Verify BookStack/API credentials are stored only in the protected generator configuration.
- Test authorization for each edition so documentation and operational data do not cross unintended boundaries.
- Document incident response, backup confidentiality and restore authorization.
<!-- BOOKSTACK-DOCUMENT-RELEASE:END -->

---

## Maintainer Notes

<!-- BOOKSTACK-DOCUMENT-RELEASE:NOTES-BEGIN -->
Add human-reviewed deployment notes, corrections, decisions, screenshots, and links here. Content outside the generated block is preserved on future runs.
<!-- BOOKSTACK-DOCUMENT-RELEASE:NOTES-END -->

# Interface Boundaries

<!-- BOOKSTACK-DOCUMENT-RELEASE:BEGIN -->
# Interface Boundaries

| Field | Value |
| --- | --- |
| Distribution | BSS — OpenC5ISR |
| Product | OpenC5ISR |
| Release | 0.15.1 |
| Deployment | `openc5isr.bss.dev` |
| Source | `/srv/bss/releases/OpenC5ISR-v0.15.0-20app` |
| Evidence | Reference architecture |
| Source fingerprint | `93926e8c834f1ed79c9017a4096f70c76d73ce4f870f104fbd0cf54b2bed50ee` |
| Status | Generated baseline — human review required |

> **Verification boundary:** This page combines platform design guidance with static evidence from the release. It does not prove that every detected interface is enabled, reachable, secure, or operational in the deployed environment.

## Interface selection

| Need | Preferred mechanism | Reason |
| --- | --- | --- |
| Manage/query a resource | REST/HTTP | Clear request/response semantics, authorization and idempotency. |
| Publish asynchronous operational state | OpenBus | Decouples producer and consumers and supports event-driven automation. |
| Interactive browser/device stream | WebSocket/WebRTC | Low-latency bidirectional session or media delivery. |
| Large artifact/evidence | OpenFiles/object storage | Avoids overloading messages while preserving metadata and access control. |
| Semantic query/constraint | SPARQL/RDF/SHACL | Queries meaning and relationships independently of application schemas. |
| High-rate radio/sensor samples | Local/edge stream plus derived products | Keeps raw bandwidth near processing and shares actionable results. |

## Boundary rule

Every integration should define ownership, schema, semantic type, authentication, authorization, time basis, error behavior, retry/idempotency, rate/size limits, retention and observability. A working URL alone is not an integration contract.
<!-- BOOKSTACK-DOCUMENT-RELEASE:END -->

---

## Maintainer Notes

<!-- BOOKSTACK-DOCUMENT-RELEASE:NOTES-BEGIN -->
Add human-reviewed deployment notes, corrections, decisions, screenshots, and links here. Content outside the generated block is preserved on future runs.
<!-- BOOKSTACK-DOCUMENT-RELEASE:NOTES-END -->