Internal · Terma architecture proposal
One secure platform for every deployed site: connected, disconnected or fully air-gapped.
Terma delivers systems into places where the network is hostile, intermittent or simply not allowed. Every site needs the same things: trusted hardware, safe updates, strict separation between customers, and data that gets home. Today that is often solved per project.
Terma Bastion is a reusable, zero-trust edge platform that solves it once. One Bastion Core securely manages many Bastion Edges. Each Edge belongs to one customer, runs on its own when cut off, and can be operated fully air-gapped.
See the demonstrationsArchitecture
Live demo set: where we are
Latest lab run: 14 Oct 2026, 18:48 CEST (5 runs recorded).
Why it matters to Terma
| Challenge | What Bastion gives us |
|---|---|
| Customers and nations must never see each other's systems or data | One cryptographic trust domain per customer. Edges never trust each other, and there is no network path between them |
| Sites with no connectivity, or none allowed | Air-gapped by design. Signed, encrypted update volumes go through a quarantine VM. Data comes home on encrypted export volumes or through a one-way data diode |
| Strict firewall rules at customer sites | Only two outbound connections: NATS (TCP 7222) and Git for Argo CD (TCP 443). Nothing ever connects in |
| Tampered or stolen hardware | Tamper-proof boot. Disks unlock only after TPM checks pass. A chassis tamper switch wipes the keys, and one action revokes a whole site |
| Unknown devices plugged into the network | Zero-trust ports. No network until the device proves its identity with its TPM certificate |
| NIS2 and IEC 62443 compliance effort | Evidence built in. A threat model mapped to IEC 62443, a tamper-evident audit log, and decision records for every choice |
| Per-project engineering cost | One platform reused across programmes. Everything is declared in Git and the same on every site |
Built on open technology
Every component is open source, with no vendor lock-in and a mature community behind it:
- Talos Linux: an immutable operating system for Kubernetes, with Trusted Boot.
- Sidero Labs KMS server: unlocks disk encryption only for nodes that pass their TPM checks.
- SPIRE/SPIFFE: identity for every workload and device.
- Keylime: attestation of the switch hosts.
- Cilium and Tetragon: zero-trust networking and runtime security.
- SONiC: the switch operating system, which also handles border routing and the port gate.
- FDO: secure device onboarding.
- NATS JetStream: resilient messaging that keeps working when disconnected.
- Argo CD: GitOps deployment.
- Longhorn: storage.
- cosign and TUF: signed updates that can't be rolled back.
Designed for production, proven as a POC
The POC runs on a single cloud VM. Every decision record states what the POC proves and what production adds, such as three-node control planes, dual switch hosts, HSM quorum and hardware data diodes. The path from demo to deployable product is written down, not hand-waved.
Proposed next steps
- Demo: a live walkthrough of the 10 scenarios for architecture and engineering leads.
- Review: the security architecture against a real programme's requirements and IEC 62443 target levels.
- Pilot: one Bastion Edge on real hardware (an industrial PC and an SONiC switch) in a lab at Terma.