Network Architecture

Status: DRAFT

Current controls

• VPN exists between device environment and backend infrastructure
• NATS uses JWT-based authentication/authorization

Required documentation

Document:

• VPN technology
• per-device vs shared keys
• key rotation
• allowed routes/subnets
• DNS dependency
• NATS endpoints
• TLS configuration
• firewall rules
• listening ports on the gateway

Target network exposure

The production gateway should expose no unnecessary Internet-facing services.

TODO: capture ss -lntup and firewall configuration for every release.