Skip to content

System Architecture Overview

Bedrock is a tactical situational-awareness system: operators and devices share position, chat, drawings, and voice over a resilient mesh, with cryptographic identity and classification enforcement. It is 8 independent git repos (no umbrella monorepo).

The repos

Repo Language Role
directory TypeScript (AdonisJS) Identity authority — FIDO2 login, signs IdentityToken/ServerToken, issues group keys, publishes the revocation list. The root of trust.
common Rust (waypoint_common) Canonical shared crate — AuthEnvelope pack/verify, token protos, SIDC parser, outbox policy. The contract every client/server mirrors.
server Rust (waypoint node) Zenoh transport router — relays + stores traffic, federates router↔router (mTLS), enforces the per-message classification gate.
android Kotlin Tactical client — engine + Zenoh transport + MapLibre map UI.
web TypeScript (AdonisJS + Inertia) COP / decision-support browser client — Zenoh-over-WSS, server-side recorder tier. Hosts the targeting board, detections, client-side track fusion (server-side fusion deferred), EW/control-measure authoring, planning (estimate/sync matrix/comms-net/versioning/replay export), and the /api/feed/* force-tracking ingest API.
node Rust Headless GPS / sensor daemon — peer-mesh publisher (position/heartbeat).
gateway Rust Interop bridge — translates to/from CoT/TAK, ADatP-3, NFFI, etc.
infrastructure Terraform GCE/KMS provisioning + PKI/TLS for deployments.

Feed ingestion is handled by an additional component, bedrock-nifi-processors (Apache NiFi), which is not one of the 8 core repos but produces feed data into web: it normalises external AIS / ADS-B / GeoJSON feeds and writes them into the track_hits Postgres table via the least-privilege nifi_ingest role, from where web fans them out to the COP.

How they fit

flowchart TB
    DIR["<b>directory</b><br/>identity authority"]
    COMMON["<b>common</b><br/>canonical contract<br/>(compiled by all)"]

    subgraph clients [ ]
        direction LR
        AND["android"]
        WEB["web"]
        NODE["node<br/>(GPS daemon)"]
    end

    R1["<b>server</b><br/>router A"]
    R2["<b>server</b><br/>router B"]
    GW["gateway"]
    EXT["CoT/TAK, ADatP-3,<br/>NFFI … (external)"]
    NIFI["<b>NiFi</b><br/>(bedrock-nifi-<br/>processors)"]
    FEEDS["AIS / ADS-B /<br/>GeoJSON feeds<br/>(external)"]
    PROD["force-tracking<br/>producers (external)"]

    DIR -->|"FIDO2 login, tokens,<br/>group key, revocations · HTTPS"| AND
    DIR --> WEB
    DIR --> NODE

    AND <-->|"Zenoh TLS"| R1
    WEB <-->|"Zenoh WSS"| R1
    NODE <-->|"peer mesh"| R1
    R1 <-->|"gossip / mTLS"| R2
    R1 --> GW --> EXT

    FEEDS -->|"AIS/ADS-B/GeoJSON"| NIFI
    NIFI -->|"INSERT track_hits<br/>(nifi_ingest role)"| WEB
    PROD -->|"/api/feed/* · JWT"| WEB

    COMMON -.->|contract| AND
    COMMON -.-> WEB
    COMMON -.-> NODE
    COMMON -.-> R1
    COMMON -.-> R2
    COMMON -.-> GW

End-to-end flow

  1. Login (HTTPS → Directory). Operator authenticates with a FIDO2 assertion (devices use a single-use registration token). The Directory returns a 5×7-day IdentityToken batch and the device's Ed25519 signing key (public half = principal_sign_key in the token). See security/pki.md.
  2. Connect (Zenoh). The client opens a server-cert-TLS Zenoh session to a router and gets the waypoint/global/auth/** queryable for the router's ServerToken (classification ceiling + coverage cells). Group keys come from /api/group-key.
  3. Send. Each message content is sealed with AES-256-GCM under the deployment group key (SealedContent), wrapped in an AuthEnvelope — Ed25519 device_signature over signed-cleartext classification + owner_principal_id fields plus the sealed payload — and put on a cell-routed key expression (waypoint/<cell>/<topic>/...). Heartbeats remain plaintext. See protocol/wire-protocol.md.
  4. Relay / store. The router verifies the envelope, reads the signed-cleartext classification envelope field for the classification gate (min(sender, server)), stores durable prefixes (chat/drawings as opaque ciphertext), and fans out to subscribers + federated routers. The router never decodes the payload and holds no group key. Late joiners get the durable prefix to catch up.
  5. Receive. Every receiver runs the full envelope verify + revocation gate before any DB write or UI event. See security/model.md.
  6. Interop. The gateway subscribes to the mesh and translates to/from external tactical formats. See protocol/interop-standards/.
  7. Feed ingestion (HTTP, into web). Two seams feed external tracks into the web COP: external AIS / ADS-B / GeoJSON feeds flow through NiFi, which writes them into the track_hits Postgres table (least-privilege nifi_ingest role); and external force-tracking producers post to /api/feed/* authenticated by a signed HS256 JWT (API credential). Web then fans the tracks out to operators and applies client-side track fusion (server-side fused_tracks is deferred). See protocol/ingest-api.md.

Where each concern is documented

Note: identity is token-only — the Directory's Ed25519 signature over the token, with no per-app X.509 client certificate (see pki.md). Member content is AES-256-GCM sealed under the deployment group key before it enters the envelope (server-blind E2E confidentiality); the router is payload-blind and group-key-free. This is live and uniform across all clients (android, web, node, gateway) — only heartbeats travel plaintext, and there is no plaintext-content fallback. See security/model.md and architecture/status-roadmap.md.