Deployment & Security
Managed documentation for Deployment & Security.

Deployment Topology
Deployment Topology
Field
Value
Distribution
BSS — OpenSOF
Product
OpenSOF
Release
0.15.1
Deployment
opensof.bss.dev
Source
/srv/bss/releases/OpenSOF-v0.15.0-20app
Evidence
Release and readable host configuration
Source fingerprint
cda583b42f2a0d296b268ab5b174932a378c8be6fb52ffa1af14af896e990f6e
Status
Generated baseline — human review required
Verification boundary: This page combines platform design guidance with static evidence from the release. It does not prove that every detected interface is enabled, reachable, secure, or operational in the deployed environment.
Observed services
Service
Working directory
ExecStart
Evidence
opencybersec-agent.service
—
/opt/opencybersec-agent/opencybersec_agent.py --config /etc/opencybersec-agent.json
edge/opencybersec/systemd/opencybersec-agent.service
openlvc-ais-bridge.service
/opt/opensof/edge/openlvc
/usr/bin/python3 /opt/opensof/edge/openlvc/ais_nmea_bridge.py --opensof ${OPENSOF_URL} --token [REDACTED] --bind 0.0.0.0 --port 10110
edge/openlvc/systemd/openlvc-ais-bridge.service
openlvc-dis-bridge.service
/opt/opensof/edge/openlvc
/usr/bin/python3 /opt/opensof/edge/openlvc/dis_udp_bridge.py --opensof ${OPENSOF_URL} --token [REDACTED] --bind 0.0.0.0 --port 3000
edge/openlvc/systemd/openlvc-dis-bridge.service
openlvc-flightgear-bridge.service
/opt/opensof/edge/openlvc
/usr/bin/python3 /opt/opensof/edge/openlvc/flightgear_bridge.py --opensof ${OPENSOF_URL} --token [REDACTED] --bind 0.0.0.0 --port 5505
edge/openlvc/systemd/openlvc-flightgear-bridge.service
openlvc-rti-gateway.service
/opt/opensof/edge/openlvc
/usr/bin/python3 /opt/opensof/edge/openlvc/rti_openbus_gateway.py --opensof ${OPENSOF_URL} --token [REDACTED] --federation ${OPENLVC_FEDERATION} --federate ${OPENLVC_FEDERATE} --sidecar-command ${OPENLVC_RTI_SIDECAR_COMMAND}
edge/openlvc/systemd/openlvc-rti-gateway.service
openpnt-phc2sys@.service
—
/opt/openpnt/bin/openpnt-linuxptp run phc2sys --instance /etc/openpnt/linuxptp/instances/%i.json --bin-dir /opt/openpnt/linuxptp/bin
edge/openpnt-linuxptp/systemd/openpnt-phc2sys@.service
openpnt-ptp4l@.service
—
/opt/openpnt/bin/openpnt-linuxptp run ptp4l --instance /etc/openpnt/linuxptp/instances/%i.json --bin-dir /opt/openpnt/linuxptp/bin
edge/openpnt-linuxptp/systemd/openpnt-ptp4l@.service
openpnt-ts2phc@.service
—
/opt/openpnt/bin/openpnt-linuxptp run ts2phc --instance /etc/openpnt/linuxptp/instances/%i.json --bin-dir /opt/openpnt/linuxptp/bin
edge/openpnt-linuxptp/systemd/openpnt-ts2phc@.service
openrf-agent.service
/opt/openrf-agent
/usr/local/bin/openrf-agent --config /etc/openrf/openrf-agent.json
openrf/agent/systemd/openrf-agent.service
openc5isr-bss-opensof.service
/srv/bss/instances/opensof/current
/usr/local/bin/npm start
/etc/systemd/system/openc5isr-bss-opensof.service
Observed reverse-proxy topology
Source
Server names
Locations
proxy_pass
/etc/nginx/sites-available/opensof.bss.dev
opensof.bss.dev
opensof.bss.dev
/
http://127.0.0.1:3201/
Topology verification
Confirm which directory or symlink is the authoritative current release.
Confirm each public hostname terminates TLS and routes to the intended instance/port.
Document shared backends separately from edition-specific application instances.
Record network zones and firewall policy for public, management, data and sensor interfaces.
Maintainer Notes
Add human-reviewed deployment notes, corrections, decisions, screenshots, and links here. Content outside the generated block is preserved on future runs.

Security Architecture
Security Architecture
Field
Value
Distribution
BSS — OpenSOF
Product
OpenSOF
Release
0.15.1
Deployment
opensof.bss.dev
Source
/srv/bss/releases/OpenSOF-v0.15.0-20app
Evidence
Reference controls and static security indicators
Source fingerprint
cda583b42f2a0d296b268ab5b174932a378c8be6fb52ffa1af14af896e990f6e
Status
Generated baseline — human review required
Verification boundary: This page combines platform design guidance with static evidence from the release. It does not prove that every detected interface is enabled, reachable, secure, or operational in the deployed environment.
Security model
Security must be applied across identity, content, interfaces, transport, deployment and evidence—not bolted onto the user interface. Each module should authenticate subjects, authorize actions and data, protect transport, minimize secrets, emit audit events and preserve provenance.
Observed indicators
Indicator
Observed
Secret-designated environment variables
ANTHROPIC_API_KEY, OPENAAR_SIGNING_KEY, OPENAI_API_KEY, OPENBUS_API_TOKEN, OPENCYBERSEC_AGENT_TOKEN, OPENCYBERSEC_OPERATOR_TOKEN, OPENCYBERSEC_READ_TOKEN, OPENKNOWLEDGE_EDITOR_TOKEN, OPENLLM_ANTHROPIC_API_KEY, OPENLLM_OPENAI_API_KEY, OPENLLM_OPENWEBUI_API_KEY, OPENLLM_OPERATOR_TOKEN, OPENPNT_AGENT_TOKEN, OPENPNT_TOKEN, OPENRF_AGENT_TOKEN, OPENRF_OPERATOR_TOKEN, OPENRF_READ_TOKEN, OPENSSA_SENSOR_TOKEN, OPENWEBUI_API_KEY, ROCKETCHAT_AUTH_TOKEN, ROCKETCHAT_OUTGOING_TOKEN, TOKEN
Security term counts
TLS: 1960, authorization/RBAC: 172, audit: 101, authentication: 64, CORS: 19
Potential sensitive file names
—
Required controls
Boundary
Minimum control
User/API identity
Named accounts or service identities, least privilege, revocable tokens and MFA where supported.
Transport
TLS for public and management interfaces; authenticated/encrypted links for operational buses where threat requires.
Content
Handling/release labels, role/attribute policy, object-level authorization and protected exports.
Secrets
No secrets in source, documentation, URLs or logs; use protected environment/secret stores and rotation.
Audit/evidence
Record actor, action, target, result, source time and correlation identifiers with tamper-aware retention.
Supply chain
Pinned dependencies/images, vulnerability review, signed release artifacts and reproducible deployment records.
Immediate review actions
Rotate any token or password exposed in chat, shell history, logs or documentation.
Verify BookStack/API credentials are stored only in the protected generator configuration.
Test authorization for each edition so documentation and operational data do not cross unintended boundaries.
Document incident response, backup confidentiality and restore authorization.
Maintainer Notes
Add human-reviewed deployment notes, corrections, decisions, screenshots, and links here. Content outside the generated block is preserved on future runs.

Interface Boundaries
Interface Boundaries
Field
Value
Distribution
BSS — OpenSOF
Product
OpenSOF
Release
0.15.1
Deployment
opensof.bss.dev
Source
/srv/bss/releases/OpenSOF-v0.15.0-20app
Evidence
Reference architecture
Source fingerprint
cda583b42f2a0d296b268ab5b174932a378c8be6fb52ffa1af14af896e990f6e
Status
Generated baseline — human review required
Verification boundary: This page combines platform design guidance with static evidence from the release. It does not prove that every detected interface is enabled, reachable, secure, or operational in the deployed environment.
Interface selection
Need
Preferred mechanism
Reason
Manage/query a resource
REST/HTTP
Clear request/response semantics, authorization and idempotency.
Publish asynchronous operational state
OpenBus
Decouples producer and consumers and supports event-driven automation.
Interactive browser/device stream
WebSocket/WebRTC
Low-latency bidirectional session or media delivery.
Large artifact/evidence
OpenFiles/object storage
Avoids overloading messages while preserving metadata and access control.
Semantic query/constraint
SPARQL/RDF/SHACL
Queries meaning and relationships independently of application schemas.
High-rate radio/sensor samples
Local/edge stream plus derived products
Keeps raw bandwidth near processing and shares actionable results.
Boundary rule
Every integration should define ownership, schema, semantic type, authentication, authorization, time basis, error behavior, retry/idempotency, rate/size limits, retention and observability. A working URL alone is not an integration contract.
Maintainer Notes
Add human-reviewed deployment notes, corrections, decisions, screenshots, and links here. Content outside the generated block is preserved on future runs.