|
| 1 | +# hardbox Roadmap — v0.5 → v1.0 |
| 2 | + |
| 3 | +This document describes the planned evolution of hardbox from its current state (v0.4) through general availability (v1.0). It covers technical scope, new modules, SaaS architecture, and the commercial model that funds continued development. |
| 4 | + |
| 5 | +--- |
| 6 | + |
| 7 | +## Philosophy |
| 8 | + |
| 9 | +hardbox will always be **100% free and open source** for self-hosted use. Every hardening module, compliance profile, CLI command, and the Plugin SDK are OSS — no features locked behind a paywall. |
| 10 | + |
| 11 | +The commercial layer is a **hosted service** (hardbox Cloud) that provides the infrastructure, dashboard, and enterprise controls on top of the same OSS engine. The distinction is _where the platform runs and who maintains it_ — not which features you can access. |
| 12 | + |
| 13 | +--- |
| 14 | + |
| 15 | +## Where we are — v0.4 |
| 16 | + |
| 17 | +| Category | Count | |
| 18 | +|---|---| |
| 19 | +| Hardening modules | 15 | |
| 20 | +| Compliance profiles | 12 | |
| 21 | +| CLI commands | 7 (`audit`, `apply`, `rollback`, `diff`, `fleet`, `plugin`, `serve`) | |
| 22 | +| Checks implemented | ~156 | |
| 23 | +| Frameworks mapped | CIS L1/L2, NIST SP 800-53, STIG, PCI-DSS, HIPAA, ISO 27001, cloud-aws/gcp/azure | |
| 24 | + |
| 25 | +--- |
| 26 | + |
| 27 | +## v0.5 — Observability & Continuous Compliance |
| 28 | + |
| 29 | +**Theme:** hardbox transitions from _reactive_ (run when called) to _proactive_ (detect regressions automatically). |
| 30 | +This version also lays the technical foundation for the future SaaS agent. |
| 31 | + |
| 32 | +### P0 — Must Ship |
| 33 | + |
| 34 | +**`hardbox watch`** |
| 35 | +Daemon mode. Runs a full audit on a configurable interval, writes JSON results to a directory, and exits non-zero when the compliance score drops compared to the previous run. This is the core of continuous compliance monitoring and the basis for the future telemetry agent. |
| 36 | + |
| 37 | +```bash |
| 38 | +hardbox watch --profile production --interval 6h --output /var/lib/hardbox/reports/ |
| 39 | +``` |
| 40 | + |
| 41 | +**Webhook / alerting** |
| 42 | +Fires an HTTP POST when a regression or new `critical`/`high` finding is detected. Includes a built-in Slack adapter. Rules are configurable per severity and per module in `config.yaml`. |
| 43 | + |
| 44 | +```yaml |
| 45 | +notifications: |
| 46 | + webhook: https://hooks.slack.com/services/... |
| 47 | + on: [regression, critical_finding] |
| 48 | + modules: [ssh, firewall, users] |
| 49 | +``` |
| 50 | +
|
| 51 | +**Fleet overview in `hardbox serve`** |
| 52 | +When fleet audit JSON files are present in the reports directory, the dashboard renders an aggregate view: compliance score per host, regressions between runs, per-host timeline. No backend required — reads from local files. |
| 53 | + |
| 54 | +### P1 — Should Ship |
| 55 | + |
| 56 | +**Profile inheritance** |
| 57 | +`extends` key in YAML profiles. Inherits all settings from a base profile and overrides only what is declared. Eliminates copy-paste between similar profiles and enables org-specific customisation without forking the built-in profiles. |
| 58 | + |
| 59 | +```yaml |
| 60 | +# configs/profiles/my-production.yaml |
| 61 | +name: my-production |
| 62 | +extends: production |
| 63 | +modules: |
| 64 | + ssh: |
| 65 | + allow_users: [deploy, ops, monitoring] |
| 66 | + users: |
| 67 | + pass_max_days: 60 |
| 68 | +``` |
| 69 | + |
| 70 | +**Trend history in `hardbox serve`** |
| 71 | +The dashboard renders a compliance score sparkline over time by reading all JSON reports in the configured directory, ordered by timestamp. No database required. |
| 72 | + |
| 73 | +### P2 — Nice to Have |
| 74 | + |
| 75 | +**SARIF export** |
| 76 | +`--format sarif` produces a SARIF 2.1.0 document compatible with GitHub Advanced Security code scanning and major SIEMs. Each finding maps to a SARIF `result` with rule metadata, severity, and remediation guidance. |
| 77 | + |
| 78 | +--- |
| 79 | + |
| 80 | +## v0.6 — Deep Coverage I |
| 81 | + |
| 82 | +**Theme:** Close the most critical Lynis coverage gaps. Add modules for categories that hardbox does not yet cover. |
| 83 | + |
| 84 | +| Module | Key Checks | Compliance | |
| 85 | +|---|---|---| |
| 86 | +| `boot` | GRUB2 password, Secure Boot state, `/boot` permissions, bootloader config integrity | CIS 1.4, STIG V-238200 | |
| 87 | +| `storage` | LUKS/dm-crypt on sensitive partitions, encrypted swap, `/etc/crypttab`, plain-text swap detection | CIS 1.1, NIST SC-28 | |
| 88 | +| `integrity` | AIDE/Tripwire installed and initialised, integrity DB present, verification cron/timer configured | CIS 1.3, NIST SI-7 | |
| 89 | +| `malware` | rkhunter/chkrootkit installed and clean, suspicious processes, world-writable `PATH` entries | CIS — , NIST SI-3 | |
| 90 | +| `shells` | `TMOUT` in `/etc/profile.d/`, `HISTSIZE`/`HISTFILESIZE` limits, `.bashrc`/`.profile` audit | CIS 5.4.4, STIG | |
| 91 | +| `processes` | Process accounting enabled, `ulimits` in `/etc/security/limits.conf`, core dumps disabled | CIS 1.5, NIST AU-12 | |
| 92 | + |
| 93 | +**Target after v0.6:** ~240 checks across 21 modules. |
| 94 | + |
| 95 | +--- |
| 96 | + |
| 97 | +## v0.7 — Deep Coverage II & Agent |
| 98 | + |
| 99 | +**Theme:** Complete Lynis category parity. Introduce the telemetry agent that bridges the OSS CLI to the future SaaS platform. |
| 100 | + |
| 101 | +### New modules |
| 102 | + |
| 103 | +| Module | Key Checks | Compliance | |
| 104 | +|---|---|---| |
| 105 | +| `hardware` | USB lockdown (usbguard), Bluetooth disabled, FireWire/Thunderbolt DMA protection | CIS 1.1.1, NIST SC-41 | |
| 106 | +| `nameservices` | `/etc/hosts` integrity, `nsswitch.conf` review, DNSSEC enabled, no plaintext DNS outbound | CIS 3.4, NIST SC-20 | |
| 107 | +| `webserver` | Server tokens hidden, directory listing disabled, TLS 1.2+ enforced, security headers | CIS — , NIST SC-8 | |
| 108 | +| `databases` | Remote root login, test databases, anonymous users, password auth enforced | CIS — , PCI-DSS 6.3 | |
| 109 | + |
| 110 | +### hardbox agent |
| 111 | + |
| 112 | +A lightweight daemon that wraps `hardbox watch` and ships signed JSON audit results to a configurable HTTPS endpoint. This is the OSS component of the SaaS architecture — self-hosteable, with the endpoint defaulting to `localhost` for users who run their own backend. |
| 113 | + |
| 114 | +```bash |
| 115 | +hardbox agent \ |
| 116 | + --profile production \ |
| 117 | + --interval 6h \ |
| 118 | + --endpoint https://app.hardbox.io/ingest \ |
| 119 | + --token $HARDBOX_TOKEN |
| 120 | +``` |
| 121 | + |
| 122 | +The agent is fully OSS. The endpoint it reports to can be hardbox Cloud, a self-hosted backend, or any compatible HTTP server. |
| 123 | + |
| 124 | +### Package integrity |
| 125 | + |
| 126 | +`debsums` (Debian/Ubuntu) and `rpm -Va` (RHEL/Rocky) — verifies installed binary checksums against the package manager database. Detects tampered system binaries. |
| 127 | + |
| 128 | +**Target after v0.7:** ~300 checks across 25 modules — full Lynis category parity. |
| 129 | + |
| 130 | +--- |
| 131 | + |
| 132 | +## v0.8 — SaaS Foundation |
| 133 | + |
| 134 | +**Theme:** Minimum viable backend to support the hardbox Cloud offering. The OSS product remains fully functional without this. |
| 135 | + |
| 136 | +### Components |
| 137 | + |
| 138 | +**Backend API** |
| 139 | +Go service backed by PostgreSQL. Receives signed JSON reports from `hardbox agent`. Multi-tenant with per-organisation data isolation. Exposes a REST API consumed by the cloud dashboard. |
| 140 | + |
| 141 | +**Auth** |
| 142 | +OAuth2/OIDC login via GitHub and Google. JWT session tokens. Organisation and member management. |
| 143 | + |
| 144 | +**Cloud dashboard** |
| 145 | +Hosted version of `hardbox serve` powered by the backend API. Fleet overview, per-host drill-down, compliance score trends, alert feed, report download. |
| 146 | + |
| 147 | +**Multi-host management** |
| 148 | +Group hosts by tag, apply profiles per group, trigger bulk audits from the dashboard, compare compliance posture across groups. |
| 149 | + |
| 150 | +### Architecture |
| 151 | + |
| 152 | +``` |
| 153 | +[customer server] [hardbox Cloud] |
| 154 | + hardbox agent ──── HTTPS ──────▶ ingest API |
| 155 | + (OSS, any profile) PostgreSQL |
| 156 | + dashboard (React) |
| 157 | + alert engine |
| 158 | + report generator |
| 159 | +``` |
| 160 | +
|
| 161 | +--- |
| 162 | +
|
| 163 | +## v0.9 — Enterprise & Polish |
| 164 | +
|
| 165 | +**Theme:** Features that enterprise teams require before adoption. Billing and go-to-market readiness. |
| 166 | +
|
| 167 | +| Feature | Description | |
| 168 | +|---|---| |
| 169 | +| SSO / SAML 2.0 | Okta, Azure AD, Google Workspace integration | |
| 170 | +| RBAC | Admin, Analyst, Read-only roles per org and per host group | |
| 171 | +| Audit log | Immutable append-only record: who applied what, when, on which host | |
| 172 | +| Billing | Starter / Pro / Business plans; Stripe; metered by host count | |
| 173 | +| Compliance PDF reports | Auto-generated executive reports per framework with real audit evidence | |
| 174 | +| Custom checks (YAML) | Define new checks in YAML without writing Go; loaded by the engine at startup | |
| 175 | +
|
| 176 | +### Pricing model (planned) |
| 177 | +
|
| 178 | +| Plan | Price | Hosts | Key features | |
| 179 | +|---|---|---|---| |
| 180 | +| **OSS** | Free forever | Unlimited (self-hosted) | Full CLI, all modules, Plugin SDK | |
| 181 | +| **Cloud Starter** | ~$29 / mo | Up to 10 | Dashboard, alerts, 90-day history | |
| 182 | +| **Cloud Pro** | ~$99 / mo | Up to 50 | Fleet view, webhooks, PDF reports | |
| 183 | +| **Cloud Business** | ~$299 / mo | Unlimited | SSO, RBAC, SLA, audit log | |
| 184 | +| **Enterprise** | Contract | Unlimited | On-premise, dedicated support, custom profiles | |
| 185 | +
|
| 186 | +The value proposition is not locked features — it is **managed infrastructure, enterprise controls, and accountability**. Everything the CLI can do, you can do for free. |
| 187 | +
|
| 188 | +--- |
| 189 | +
|
| 190 | +## v1.0 — Production Ready GA |
| 191 | +
|
| 192 | +**Theme:** General availability. Stable APIs, full documentation, active commercial offering. |
| 193 | +
|
| 194 | +### Completion criteria |
| 195 | +
|
| 196 | +| Criteria | Target | |
| 197 | +|---|---| |
| 198 | +| Checks | 300+ across 25+ modules | |
| 199 | +| Compliance profiles | 12+ (CIS, NIST, STIG, PCI-DSS, HIPAA, ISO 27001, cloud-aws/gcp/azure) | |
| 200 | +| Lynis parity | All Lynis audit categories covered | |
| 201 | +| SaaS | GA with active billing | |
| 202 | +| Enterprise | SSO, RBAC, audit log, contractual SLA | |
| 203 | +| Plugin SDK | v1 stable API — frozen until v2.0 | |
| 204 | +| Packages | `.deb`, `.rpm`, and tarballs via GoReleaser | |
| 205 | +| Docs | Full module reference, operator runbooks, migration guides | |
| 206 | +
|
| 207 | +--- |
| 208 | +
|
| 209 | +## Module roadmap at a glance |
| 210 | +
|
| 211 | +| Version | New modules | Running total | |
| 212 | +|---|---|---| |
| 213 | +| v0.4 ✅ | `mount` | 15 modules, ~156 checks | |
| 214 | +| v0.5 | — (observability infra) | 15 modules, ~156 checks | |
| 215 | +| v0.6 | `boot`, `storage`, `integrity`, `malware`, `shells`, `processes` | 21 modules, ~240 checks | |
| 216 | +| v0.7 | `hardware`, `nameservices`, `webserver`, `databases` | 25 modules, ~300+ checks | |
| 217 | +| v1.0 | polish, gaps, community additions | 25+ modules, 300+ checks | |
| 218 | +
|
| 219 | +--- |
| 220 | +
|
| 221 | +## Competitive position |
| 222 | +
|
| 223 | +| | Lynis | hardbox | |
| 224 | +|---|---|---| |
| 225 | +| License | GPL | MIT | |
| 226 | +| Remediation | Enterprise (paid) | **Always free** | |
| 227 | +| Multi-host | No | `hardbox fleet` | |
| 228 | +| CI/CD integration | Manual | Native (`diff`, SARIF, exit codes) | |
| 229 | +| Plugin system | No | Plugin SDK | |
| 230 | +| Cloud-native profiles | No | AWS, GCP, Azure | |
| 231 | +| SaaS option | No | v0.8+ | |
| 232 | +| Extensible via YAML | No | v0.9+ | |
| 233 | +
|
| 234 | +hardbox is not a Lynis clone. The audit engine is a starting point — the differentiator is **remediation, scale, and ecosystem**. |
0 commit comments