Platforms

A platform is YAML: packages, services, ZFS, jails, firewall. fleetctl apply synthesizes it onto a host.

Shipped in the fleet-platforms package, selected at enrollment. Overlays carry per-device config.

Platforms

hosting In production

Web and mail hosting, each application isolated in its own jail, with WAKE on the host reading every jail's access logs.

  • Jails: Nextcloud, WordPress, Dolibarr, and Stalwart mail
  • MariaDB backend external, on a MarlinOS nas
  • On-host detection over each jail's /var/log
  • Dual-stack IPv4 + ULA IPv6, NPTv6 at the site firewall
  • certbot TLS per virtual host
FreeBSD · Bastille jails
soc-console In production

The central SOC operator console. Receives detection events from every edge in the fleet and surfaces them through one UI.

  • rsyslog with mmenrich / mmsigma / mmwake + TurboVM
  • waked-edge + waked-collector side by side
  • wakeweb NiceGUI console, auth delegated to fleet
  • Operator-managed transport (no fleet WireGuard)
Linux · host services
racing-boat In production

NMEA 2000 telemetry edge. Five jails, native CAN, NATS, TimescaleDB, onboard dashboards.

  • Jails: gateway, core (NATS), compute, persistence, vis
  • NetCAN on the gateway, Fast Packet in-kernel
  • Works with the satellite uplink down
  • WAKE optional on the host
FreeBSD · Bastille jails
wake-edge Shipped

Dedicated detection sensor. Full WAKE stack on the host, no jails. For resource-constrained edges.

  • rsyslog + the WAKE modules (mmenrich / mmsigma / mmwake)
  • waked behavioral engine, with immesh (rsyslog) for pheromone gossip
  • fleetd
FreeBSD or Linux · host services
nas Shipped

Shared storage, the fleet backup target, and the control plane itself. A single host, no jails.

  • NFSv4 server + shared MariaDB backend
  • ZFS backup target - sanoid snapshots, fleet-backup
  • Hosts the fleetserver control plane
FreeBSD · host services
identity Shipped

An isolated identity host - a Keycloak OIDC provider with a co-located PostgreSQL store.

  • Keycloak OIDC in the keycloak-db jail
  • Co-located PostgreSQL store
  • Host baseline: WAKE auth edge, sanoid backups, SSH transport key
FreeBSD · Bastille jail
vpn-hub Shipped

The fleet WireGuard hub. Kernel WireGuard on wg0, driven entirely from FleetDB. No jails, no apps - tunnel only.

  • fleetserver renders wg0.conf on every peer mutation
  • wg syncconf reloads without dropping the tunnel
  • No operator-set key material
Linux · host services
build-worker Shipped

An amd64 CI build host: a GitLab runner with Poudriere and the full C/C++/Rust toolchain.

  • gitlab-runner + Poudriere (owns its own build jails)
  • C/C++/Rust toolchain
  • Runner registration + poudriere.conf stay operator-managed
FreeBSD · host services

Write your own

A platform is YAML the fleet can synthesize: packages, sysrc, ZFS with sanoid retention, Bastille jails, PF, WireGuard. Ship it as a package, fleetctl apply a host into it.

Platforms & overlays → What's in the base →