High Availability

Deployments through kubernetes ensure high-availability, low-latency services to keep our mintranet functional under any load.

Stability

BSD has long proven the stalwart of stability, and OpenBSD is the most security-focused.

Security

OS

• OpenBSD includes numerous features designed to improve security, such as:
  • Secure alternatives to POSIX functions in the C standard library, such as strlcat for strcat and strlcpy for strcpy[35]
  • Toolchain alterations, including a static bounds checker
  • Memory protection techniques to guard against invalid accesses, such as ProPolice and the W^X page protection feature
  • Strong cryptography and randomization
  • System call and filesystem access restrictions to limit process capabilities

Certificate Authority

• https://www.pbdigital.org/openbsd/libressl/2019/10/14/offline-root-certificate-authority-openbsd.html

VPN

• WireGuard manages VPN traffic and serves as the edge server

Encryption

• LibreSSL with AES-256 cypher
• At rest: VeraCrypt

Public Key Infrastructure

• OpenXPKI: Features | GitHub

Architecture

• Serverless design / Microservices
• Each microservice is containerized to ensure security, dependency compliance, low-bloat, and high-availability

OS

• OPENBSD 6.8: https://www.openbsd.org/68.html

TARGET DEVICES

• Raspberry Pi 4: https://www.raspberrypi.org/products/raspberry-pi-4-model-b/

  Allwinner A64/H5 Pine64 Pine 64/64+ Pine64 Pinebook NanoPi A64 Orange Pi PC2 Orange Pi Zero Plus AMD Opteron A1100 (Seattle) AMD Seattle Development Board SoftIron OverDrive 1000 SoftIron OverDrive 3000 Amlogic G12B/SM1 Hardkernel ODROID-N2 Hardkernel ODROID-C4 Hardkernel ODROID-HC4 Ampere eMAG Lenovo ThinkSystem HR330A Lenovo ThinkSystem HR350A Broadcom BCM2837/BCM2711 Raspberry Pi 3 Raspberry Pi 4 Marvell ARMADA 7K/8K SolidRun/Marvell MACCHIATObin Rockchip RK3328/RK3399 Pine64 ROCK64 Pine64 ROCKPro64 Pinebook Pro Firefly-RK3399 FriendlyElec NanoPC-T4 Theobroma Systems RK3399-Q7 Socionext SC2A11 Socionext SynQuacer-E Developerbox

DEV VM

• FreeBSD: https://download.freebsd.org/ftp/releases/VM-IMAGES/12.2-RELEASE/amd64/Latest/FreeBSD-12.2-RELEASE-amd64.vmdk.xz

DEPLOYMENT

• Docker: curl -sSL https://get.docker.com | sh
• MicroK8s: https://microk8s.io/docs

VPN/EDGE SERVER

• WireGuard Whitepaper: https://www.wireguard.com/papers/wireguard.pdf
• WireGuard Protocol: https://www.wireguard.com/protocol/

COMMS

• ircd.js: https://github.com/alexyoung/ircd.js