Human ↔ Server
Crossed by WebAuthn/FIDO2 plus a server-side session. The only boundary a human crosses directly, and the only one with no password fallback in normal operation.
Architecture
Vitrinode is a control plane, an agent that runs on each managed host, and a small privileged process the agent talks to locally. Agents are outbound-only — nothing is ever opened for the control plane to connect in — so every channel below is agent-initiated.
On this page: Diagram·Trust boundaries·Transport
Component diagram
Solid lines are implemented today; dashed lines are planned integrations. The dotted box marks one physical or virtual host — the agent and executor are separate processes on that single machine, not separate hosts.
Implemented
Planned
Same host, separate processes
Trust boundaries
Each crossing point below uses a different mechanism. Collapsing them into one shared trust model would mean one failure compromises everything downstream of it.
Server ↔ Agent
Crossed by mutual TLS with server-issued device certificates. Neither side trusts DNS or network position — identity is cryptographic on both ends, and revoked certificates are rejected on every request, not just at handshake time.
Agent ↔ Executor
Crossed by a permission-checked local Unix domain socket restricted to a fixed, typed operation set — so that a compromised network-facing agent process doesn't automatically gain arbitrary root execution on the host.
Server ↔ Proxmox
Crossed by a dedicated read-only Proxmox API token over TLS with explicit certificate trust. The integration periodically syncs VM and container metadata; lifecycle actions are not implemented.
Server ↔ VMware planned
Not yet implemented. Scoped to mirror the Proxmox boundary: a dedicated read-only API credential over TLS, syncing VM inventory and power state — no lifecycle actions.
Server ↔ HSM prototype
A dedicated Vitrinode-HSM device holds the SSH user CA key and issues only policy-checked OpenSSH user certificates, over a framed binary protocol on a local USB link. The device generates the key on-board and never exports it; there is no raw-signature operation to misuse. When Vitrinode is configured to use the HSM, issuance fails closed if the device is absent or its identity doesn't match what was recorded at commissioning. Verified on real silicon; not yet wired into the server.
Transport
Three agent-initiated channels are implemented today; the server never opens a connection into an agent. A fourth, planned link — the server to an HSM device — is local USB, not a network channel.
Heartbeat
Small and frequent — proves liveness and catches gross state changes. Never writes a full inventory record.
Inventory
Larger and less frequent — system, storage, network, systemd, APT and Docker facts, deduplicated by content hash so an unchanged host doesn't generate a new record every cycle.
Job poll
A long-lived poll delivers signed, typed jobs with near-real-time latency and no message-broker infrastructure. Expiry and nonce checks prevent stale or replayed work.
HSM signing link planned
Not an agent channel: a local USB link between the server and a Vitrinode-HSM device, carrying framed request/response messages with one operation in flight. It carries no key material — only a typed certificate-issuance request and the certificate that comes back.