ssl-proxy

ssl-proxy is a WireGuard-first transparent proxy with wireless audit, Redpanda-backed processing, TiDB persistence and vector search. The Rust proxy and Linux Atheros Sensor publish events; the Scala Octopus coordinator owns durable ingestion and maintained projections; the Go Atheros Search service owns query APIs and embedding workers; and the SolidJS Atheros Search UI is the Integration Console.

The canonical runtime model and data ownership are documented in System Architecture. Kubernetes desired state lives only in cyber-stack/ and is rendered with Kustomize and reconciled by Argo CD.

Component ownership

Component	Responsibility	Documentation
ssl-proxy	WireGuard ingress, transparent proxying, classification and sync publishing	Architecture
sync-plane	Shared Redpanda producer configuration and contracts	crates/sync-plane/
Atheros Sensor	Monitor-mode wireless capture and indirect persistence through Redpanda	Sensor README
Octopus	Durable ingestion, dedupe, evidence, leases, batching, outbox, TiDB load/results and maintained projections	Octopus README
Atheros Search	HTTP/gRPC search, ETL health, embedding-job claims and vector writes	Search README
Integration Console	SolidJS UI for Search, graph, inventory and ETL health	atheros-search-ui
Schema Migrator	Migration authoring/execution and TiDB-backed internal control state	Schema Migrator README
WireGuard key rotator	Staged WireGuard key rotation and optional notifications	Rotator README

java-coordinator remains an image and Kubernetes resource identity for the Octopus service. Likewise, sync.oracle.load and sync.oracle.result are locked legacy topic names; both carry coordinator-owned TiDB work and results.

Data boundaries

Canonical DDL lives in sql/tidb/ for four application databases:

• octopus_core
• atheros_search
• integration_console
• schema_migrator

The in-cluster identity service uses a separate keycloak database. PostgreSQL is supported only as an external Schema Migrator target. Oracle is deprecated compatibility or historical material, not a runtime dependency.

Get started

Initialize every nested repository first:

git submodule update --init --recursive

Run the targeted tests for the components you change. Validate all canonical GitOps inputs with:

make docs-check
make gitops-check

Build and publish first-party images to the configured registry with:

make publish-all REGISTRY=192.168.1.221:5000

Publishing does not mutate a cluster. Argo CD Image Updater records new dev digests through a pull request. Production promotion is a separate reviewed pull request that copies the exact tested dev digests. See the GitOps guide and operations runbook.

Local development

Docker Compose is an optional local test harness only. It is not a Kubernetes management, promotion or production workflow.

REGISTRY=local IMAGE_TAG=dev \
  docker compose -f docker-compose.yaml -f docker-compose.build.yaml up -d --build

Local health only proves the development harness is running. Kubernetes readiness is determined from the rendered environment overlays and Argo CD application health.

Topic contracts

Topic	Current meaning
sync.scan.request	Producer-to-Octopus work discovery
sync.oracle.load	Octopus-owned TiDB load dispatch; legacy name
sync.oracle.result	Octopus-owned TiDB load outcome; legacy name
wireless.audit	Sensor-published schema-versioned wireless events

Delivery is at least once after the signed cutover boundary, with durable TiDB dedupe and topic/partition/offset evidence.

Common checks

cargo test -p ssl-proxy
cargo test -p sync-plane
cargo test -p atheros-sensor
(cd services/atheros-search && go test ./...)
(cd services/octopus && sbt test)
(cd apps/schema-migrator && sbt test)
python3 -m unittest discover -s scripts/tests -p 'test_*.py' -v

Operational references

• GitOps management and onboarding
• System architecture
• Operations runbook
• TiDB runtime and cutover
• Observability architecture
• Secret management
• Threat model