Hub — overview¶
The Hub is the brain: a single Rust binary that runs your certificate authority, ACME client, Cyphers Score engine, renewal lifecycle, and the dashboard. Scout is the eyes, deployed on each endpoint; the Hub is the one instance everything reports to.
One runtime role¶
There is exactly one Hub codebase and exactly one role it plays: the
Lifecycle Hub. A customer runs one Hub instance against one PostgreSQL
database, with Scout agents reporting to it. There is no mode flag, no
federation, no horizontal scaling, and no external service the Hub depends
on — everything runs on the customer's own network. The binary and the
systemd unit are both named cyphers-hub.
What it does, end to end:
- Certificate authority — a built-in root + intermediate CA (see First-boot CA self-provisioning), OCSP responder, and CRL, for internal/private-CA issuance and for signing every Scout's enrollment certificate.
- ACME client — public issuance against Let's Encrypt, ZeroSSL, Google
Trust Services, SSL.com, or a custom-registered RFC 8555 CA (see
Certificate providers), including automatic
DNS-01: the Hub publishes the
_acme-challengerecord itself through your DNS provider (Route 53, Cloudflare, Google Cloud DNS) with no intermediary delegation service. - Cyphers Score engine — scores every certificate from the raw findings and facts Scout ships it, and derives the tier.
- Renewal lifecycle — pre-flight, issue, deliver, verify, with rollback on a failed post-install check.
- Scout fleet management — enrollment, per-agent NATS ACLs, command dispatch, and the acceptance-policy signing that lets a Scout verify the Hub's identity independently of the pinned-mTLS baseline.
- Dashboard — the React single-page operational surface,
Manage-centric: a summary strip and the whole estate in one list, grouped per certificate.
Listeners¶
The Hub binds three listeners (hub/src/main.rs, routers in hub/src/lib.rs):
| Listener | Flag / env | Default | Transport | Serves |
|---|---|---|---|---|
| UI / admin | --ui-port / UI_PORT |
443 | plain HTTP | Dashboard, login, static assets, and the dashboard's own admin REST under /api (same-origin, no CORS) |
| Enrollment | --enroll-port / ENROLL_PORT |
7443 | always TLS | POST /enroll and GET /health only |
| Scout REST | --scout-rest-port / SCOUT_REST_PORT |
8443 | plain HTTP | GET /health, GET /readyz, public PKI reads, badges, acceptance-policy replay |
Enrollment gets its own TLS-terminated listener so a brand-new Scout's
one-time token and CSR are never sent over an unverified socket, while the
Scout REST port stays free for plain public PKI reads that any relying party
may make. The listener's certificate is minted in-process from the Hub's own
CA, with SANs resolved from CYPHERS_NATS_ADVERTISED_HOST or the
DB-persisted advertised_hosts setting.
Where to go next¶
- Hub — install procedure — the deliverable: prerequisites, step-by-step install (packaged Docker and bare-tarball paths), the full environment variable reference, the Scout↔Hub NATS channel, first-boot CA self-provisioning, and troubleshooting.
- Certificate providers — the ACME CAs the Hub issues against, EAB credentials, custom provider registration.
- Renewal profiles — the reusable issuance and renewal configurations endpoints are assigned.
Hub PKI endpoints¶
The Hub runs a public, read-only PKI surface on its Scout REST port (default
:8443) — its own CA material, unauthenticated by design. These are Hub
endpoints; a running Scout agent is only ever a client of them (and fetches
just the CRL, as a revocation-check fallback). They also serve the installer,
ops/DR checks, and anything validating a Cyphers-issued certificate:
Hub endpoint (:8443) |
Returns | Fetched by |
|---|---|---|
GET /api/ca/chain |
the Hub CA chain (intermediate + root), PEM | the installer, to derive the pin |
GET /api/ca/crl.pem |
the Hub CA's revocation list | the Scout agent (revocation fallback) |
GET /api/ca/root |
the Hub root CA certificate, PEM | DR/health checks; caIssuers AIA in issued certs |
POST /api/ca/ocsp |
the Hub CA's OCSP responses (RFC 6960) | nats-server, to staple into the handshake |
GET /api/ca/acceptance-policy/signer |
the acceptance-policy signer's verifying public key, PEM | an operator computing a Scout's --policy-signer-fp pin by hand — see Scout → Install procedure |
This table used to live only on the Scout overview page because there was no Hub section to hold it — it moved here since it documents the Hub's own CA surface, not Scout behavior.