Stage 01 / 11
Record the customer
A customer becomes a tenant.
Every zone, box and certificate that follows is owned by that tenant, which is what makes isolation structural rather than a policy somebody has to remember.
Powered by
Self-hosted DNS, edge and tunnel platform
From domain to device. Everything behind one wall.
CHERT Katula publishes a customer's domain on nameservers you own, fronts it with a real certificate and a web application firewall, and serves it from a box at their site that has no public address at all — every step driven from one source of truth, in English and Arabic.
- Lifecycle stages
- 11
- Engines
- 6
- Open-source systems
- 21
- Languages
- 2
Three ways in
Three people, one control plane.
Exactly one of the eleven stages below is the customer's job. The other ten are the platform's, and every one of them is driven from the same source of truth.
I run the platform
One Console is the source of truth. Add a customer, declare their DNS, run a reconcile — the nameservers, the edge and the firewall all follow. Nothing is ever configured twice.
I own the domain
You do exactly one thing: point your domain at our nameservers, at your own registrar. Publication, certificate, firewall and routing all happen without you.
My box is behind NAT
A ChertBox on a SIM, a home line or carrier NAT has no inbound address and needs none. It dials out, holds the tunnel, and is reachable through the wall — never around it.
The platform lifecycle
Eleven stages, from a name on a form to traffic on a wire.
Select a stage to see what happens — and which components make it work.
Stage 02 / 11
Declare the domain
DNS becomes reviewable data.
The zone and its records are written in the Console, not in a nameserver — so DNS is data under review rather than a file somebody edited at two in the morning.
Powered by
Stage 03 / 11
Publish to three nameservers
One reconcile, three answers.
The zone goes to the authoritative primary, which notifies two secondaries over key-authenticated transfer. Acceptance then checks every zone on every nameserver.
Powered by
Stage 04 / 11
Delegate at the registrar
The only step that is yours.
Point the domain at ns1, ns2 and ns3 at whatever registrar you already use. No account to create, no agent to install. Everything before and after this is internal.
The customer does this
Stage 05 / 11
Issue a one-time claim code
The box ships holding nothing.
What leaks matters less than whether it leaks: only the code's hash is stored, it is redeemable once, and two live credentials for one device is refused outright.
Powered by
Stage 06 / 11
The box dials out
No inbound hole, ever.
The ChertBox opens the connection outward and holds it. Nothing is punched through the customer's firewall, which is what lets a box on carrier NAT or a SIM be served publicly at all.
Powered by
Stage 07 / 11
Authorize against the truth
Checked on every heartbeat.
A shared token answers whether this is a CHERT box at all; a per-box token answers which one, and whether it is still allowed. The source of truth decides, every time.
Powered by
Stage 08 / 11
Front it with a real certificate
Issued on first request.
The edge builds the customer's virtual host, obtains a publicly trusted certificate and renews it unasked, then puts the OWASP Core Rule Set in front of every byte that follows.
Powered by
Stage 09 / 11
Serve through the tunnel
Three address spaces, one request.
A visitor lands on one public address, is inspected, then travels down the tunnel the box itself opened to a service that has no public address.
Powered by
Stage 10 / 11
Watch and defend
Live values, or none at all.
Operations read live telemetry rather than samples. A behavioural engine turns repeated abuse into a decision, and a bouncer at the edge makes that decision bite on the next request.
Powered by
Stage 11 / 11
Revoke, rotate, re-enrol
Containment in seconds.
Revoking a box cuts the connection it is holding right now, not the next one it tries. The shared token rotates across the whole fleet without touching a single box.
Powered by
Interactive architecture
Every layer of the platform — and the component that runs it
Select any component to learn what it does, or play a journey and watch a request cross three address spaces.
Select a component or play a journey.
01
Domains & devices
What the platform fronts: a customer's own domain and a box at their site.
02
Name resolution
Authoritative DNS on three hosts the platform owns.
03
Edge & tunnel
The single public door, and the path to a device with no address.
04
Source of truth
One schema the whole platform is rebuilt from.
S
Security & identity
Two gates on every admin surface, and a credential that is worthless once used.
O
Operations & observability
Network and security operations reading the live platform, never a sample.
Details appear in the panel above the diagram.
Capabilities
What the platform does, stated plainly.
Each of these is in the running system today, and each sits behind an automated acceptance check that fails the build when it stops being true.
Authoritative DNS you own
Three nameservers answer for every zone, on infrastructure you control.
- Records written once in the Console
- No registrar panel, no third-party DNS API
Reach devices with no public address
A box behind CGNAT, a SIM or a domestic line dials out and holds a tunnel.
- Nobody opens a port at the customer site
- The hub never initiates a connection to a box
A web firewall on every hostname
The OWASP Core Rule Set runs at the edge for every tenant, not as an upsell.
- Injection and traversal refused before the origin
- Negative-tested in the acceptance suite
Certificates without a ticket
A new hostname gets a publicly trusted certificate on its first request.
- Renews itself, per hostname
- No expiry calendar, no annual scramble
One schema, no parallel truth
Tenants, devices, addresses, zones and credentials are modelled in one place.
- Every downstream system is a projection of it
- No reconciliation spreadsheet
Revocation that actually cuts
Marking a box revoked drops the session it is holding at that moment.
- Not deferred to the next reconnect
- The box learns it was revoked and holds safely
Dashboards that refuse to guess
Every tile reads a live value, and says N/A when a figure is unknown.
- An invented number poisons every other number
- Alert rules use this platform's real metric names
Behavioural defence, not just rules
Access logs are parsed continuously, and a decision is enforced at the door.
- Scanning and brute force become a ban
- Refusals are recorded with their source address
Every admin surface double-gated
An address allowlist first, then single sign-on — on every administrative front.
- Console, dashboards, device manager, mail admin
- Acceptance fails if any front answers publicly
A pinned, frozen supply chain
Every third-party image is pinned to a content digest and declared in the repository.
- Nothing updates itself overnight
- A running image that drifts turns the suite red
Arabic as a first language
The public site, the admin hub and the dashboards all render in Arabic, mirrored.
- Not an English screen with translated labels
- Ten thousand interface strings deep
Proof instead of assurances
One acceptance suite probes the live platform end to end, and every claim here sits behind a check.
- DNS replication, firewall refusals, port exposure
- Logging, image pinning, backup freshness
Engines
Six engines. Twenty-one systems. One composition.
CHERT Katula does not reimplement what the open-source world has already proven. It rebrands what it can, extends what it must, and embeds the result as one product with one identity, one language setting and one audit trail.
Engine
Console
The source of truth, and the only place an operator changes the world.
- Network source of truth
- Tenants, sites, devices, IP addresses, DNS zones and records, box credentials — one schema, one history.
- Reconcile jobs
- Push DNS to three nameservers, rebuild the edge, issue and revoke credentials, enforce port scope.
- Workers, scheduler, cache, database
- Long jobs run off the request path, on a schedule, against a relational store with a durable change log.
Engine
Name
Authoritative DNS on infrastructure the platform owns, on three separate hosts.
- Authoritative server × 3
- A primary the Console writes to, and two secondaries fed by notified, key-authenticated transfer.
- DNS front end
- Absorbs the query load and the abuse in front of the authoritative servers, with rate limiting and health checks.
Engine
Edge
The single public door. Everything that reaches a customer passes through it and is inspected.
- Reverse proxy & TLS
- Per-tenant virtual hosts generated from the Console, with automatic issuance and renewal.
- Web application firewall
- The OWASP Core Rule Set, in front of every hostname rather than a privileged few.
- Behavioural IPS & bouncer
- Reads the access log, decides on repeat offenders, and blocks them at the door on their next request.
Engine
Satellite
The tunnel plane: how a device with no public address becomes publicly reachable.
- Satellite server
- Authorizes against the Console on every login and heartbeat, enforces per-box port scope, and cuts a live session the moment a box is revoked.
- Satellite client
- Ships holding only a one-time code, dials outward, and holds the tunnel across reboots, link changes and carrier NAT.
Engine
Watch
Network and security operations, reading the live platform rather than a sample of it.
- Metrics, logs, host exporter
- Time series from every engine, logs shipped from every container, and host-level counters from the hub itself.
- Alert rules & routing
- Rules written against this platform's real metric names — a nameserver gone silent, a tunnel gone quiet, a certificate near expiry.
- Bilingual dashboards
- The analytics surface runs in Arabic or English, mirrored, from the same panel definitions.
Engine
Gate
One identity for every administrative surface, and one mail path for everything the platform sends.
- Single sign-on
- An operator signs in once and is provisioned across the Console, the dashboards and the device manager alike.
- Identity-aware proxy
- Fronts surfaces that have no sign-on of their own, so nothing is exposed merely because it was written without authentication.
- Mail server
- The platform's own outbound and inbound mail, so notifications do not depend on a third-party sender.
Why CHERT Katula
Six commitments, each with a cost we chose to pay.
Self-hosted, including the parts nobody self-hosts
Authoritative DNS, certificate issuance, identity and mail all run on infrastructure the operator controls. There is no managed DNS bill and no vendor who can change the terms.
One source of truth, enforced rather than agreed
The Console's models are the schema the whole platform shares. Downstream systems are rebuilt from it, so configuration cannot drift quietly in two directions at once.
Nothing public that does not need to be
Three ports face the internet: name resolution, web, and the tunnel the boxes dial into. Every other service binds to the loopback interface — a harder constraint to live with, and a far smaller surface to defend.
Rebrand, extend, embed — in that order
Proven open-source systems are adopted whole wherever possible and extended only where the product genuinely needs something they do not do. The upgrade path upstream is deliberately preserved.
A frozen supply chain beats a fresh one
Images are pinned to digests, automatic updates are off, and an upgrade is a reviewed change rather than something that happened overnight. Stability here is a feature, not inertia.
Bilingual to the bone
Arabic and English are peers across the public site, the admin hub and the dashboards, with the layout mirrored rather than merely translated — ten thousand interface strings deep.
Bring a domain and a box. We will handle the wall.
Point your domain at our nameservers, plug the ChertBox in, and it is published, certified, firewalled and watched. That is the whole of your side of the work.