A web-based security operations platform for centralized monitoring, management, and compliance of Keylime remote attestation infrastructure. The dashboard transforms Keylime from a CLI-driven security tool into a visual operations platform, reducing mean time to detect (MTTD) attestation failures from hours to seconds, centralizing policy and certificate lifecycle management, and providing tamper-evident audit trails for compliance reporting.

• Security Operations (SecOps) teams -- real-time fleet attestation monitoring and alert triage
• System Administrators -- agent lifecycle management, performance monitoring, capacity planning
• Compliance Officers -- framework-mapped reports (NIST, PCI DSS, SOC 2, FedRAMP, CIS Controls)
• DevSecOps Engineers -- policy authoring, integration pipelines, CI/CD gating

                              +-------------------+
                              |   Browser (SPA)   |
                              |   React 18 + TS   |
                              |   Vite, Zustand,  |
                              |   TanStack Query  |
                              +--------+----------+
                                       |
                              TLS 1.3  |  WebSocket
                              (HTTPS)  |  (wss://)
                                       |
  +----------+           +-------------v--------------+          +-----------+
  | Keylime  |           |        Rust Backend        |          |  Keylime  |
  | Verifier <-----------|        Axum + Tokio        |----------> Registrar |
  | (v2/v3)  |   mTLS    |        JWT / RBAC          |   mTLS   |   (v2)    |
  +----------+ (rustls)  +-----+----------------+-----+ (rustls) +-----------+
                               |                |
                               |                |
                        +------v------+    +----v----+
                        | TimescaleDB |    |  Redis  |
                        |(time-series)|    | (cache) |
                        +-------------+    +---------+

The backend consumes Keylime's existing Verifier and Registrar REST APIs (v2 pull-mode and v3 push-mode) via mTLS without requiring any modification to Keylime components. It acts as a read-through cache and analytics aggregator, presenting a unified REST + WebSocket API to the frontend SPA.

This organization contains four repositories:

React 18 + TypeScript single-page application providing the dashboard UI.

10 navigation modules:

Key features: global search (UUID/IP/hostname), time range selector (1h - 30d), WebSocket real-time updates with exponential backoff reconnection, role-aware UI rendering (Viewer/Operator/Admin).

Rust async backend built on Axum and Tokio, serving the REST API and WebSocket endpoint.

64 API endpoints across 11 handler modules:

WebSocket: /ws/events for real-time push updates (KPIs, agent state changes, alerts).

Keylime integration: Circuit breaker pattern (threshold: 5 failures, reset: 60s), concurrent log fetch semaphore (max 5 parallel requests), dual API version support (v2 pull + v3 push).

#![forbid(unsafe_code)] enforced at the crate root.

Project documentation, specifications, and presentation materials.

Contents:

Organization-level profile and governance documentation.

• Identity: OIDC/SAML via external identity provider (no local passwords)
• Sessions: Short-lived JWT (15-minute expiry) with refresh token rotation and replay detection
• MFA: Mandatory for Admin role (enforced at IdP, verified via token claim)
• RBAC: Three-tier model enforced at the backend proxy layer

• Browser to Dashboard: TLS 1.3 minimum
• Dashboard to Keylime: mTLS with rustls (private key via HSM/PKCS#11 or HashiCorp Vault -- never cleartext on disk)
• Dashboard to Database/Cache: TLS encrypted

• Raw TPM quotes, IMA logs, boot logs, and PoP tokens are never cached, stored, or logged -- pass-through only
• Cache entries are signed (HMAC) with TTLs to mitigate poisoning
• Audit log is hash-chained (SHA-256) with RFC 3161 timestamp anchoring and Rekor transparency log checkpoints
• Minimum 1-year audit log retention for compliance

• Two-person rule: Policy changes require drafter + separate approver (N-of-M quorum configurable)
• Time-limited approval window: Default 24 hours, configurable
• Emergency bypass: Break-glass mechanism with mandatory justification and CRITICAL audit trail
• Impact analysis: Pre-update analysis categorizing agents as unaffected/affected/will-fail

• Node.js 18+ and npm (frontend)
• Rust 1.75+ with cargo (backend)
• Keylime Verifier and Registrar (or Mockoon for mock testing)
• Optionally: TimescaleDB (PostgreSQL), Redis

# 1. Start mock Keylime services (requires mockoon-cli: npm install -g @mockoon/cli)
cd keylime-webtool-backend
mockoon-cli start --data test-data/verifier.json --port 3000 &
mockoon-cli start --data test-data/registrar.json --port 3001 &

# 2. Start the backend (default: http://localhost:8080)
RUST_LOG=info cargo run

# 3. In a separate terminal, start the frontend (default: http://localhost:5173)
cd keylime-webtool-frontend
npm install
npm run dev

The frontend dev server proxies /api/* and /ws requests to the backend at localhost:8080.

Frontend (prefix VITE_ for Vite exposure):

Backend:

# Backend
cd keylime-webtool-backend
cargo test                         # unit tests
cargo clippy -- -D warnings        # lint (treat warnings as errors)
cargo fmt -- --check               # format check
bash tests/mockoon_tests.sh        # Mockoon integration tests (auto setup/teardown)
bash tests/curl_integration_test.sh # curl end-to-end tests against all API endpoints
bash scripts/pre-commit.sh         # run all CI checks locally

# Frontend
cd keylime-webtool-frontend
npm run test          # Vitest watch mode
npm run test -- --run # single test run
npm run lint          # ESLint (zero warnings policy)
npx tsc -b            # type check

# Documentation (build presentations)
cd keylime-webtool-doc
make -C slides test

The system is designed for air-gapped environments with no runtime internet access:

• All frontend assets are self-contained (no CDN)
• Backend compiles to a single binary with embedded static assets
• Fonts, icons, and scripts are bundled
• Offline EK certificate validation via pre-loaded TPM vendor CA certificates
• Update packages are GPG-signed with SBOM (SPDX/CycloneDX)

Supported deployment methods:

High Availability:

• Active/Passive: < 30s RTO, 0 RPO for committed transactions
• Active/Active: For 5,000+ agent deployments with load distribution

The project is specified using Spec-Driven Development (SDD) methodology. The full specification lives in keylime-webtool-doc/spec/SRS-Keylime-Monitoring-Tool.md.

Phase 1 -- Secure Foundation: Agent fleet monitoring, OIDC/SAML authentication, three-tier RBAC, tamper-evident audit log, mTLS to Keylime APIs.

Phase 2 -- Operations: Attestation analytics, policy management, certificate monitoring, alert notifications, push mode (v3) support, SIEM integration, WebSocket real-time updates.

Phase 3 -- Enterprise Scale: Multi-tenancy, compliance reports, incident response integration (ServiceNow, Jira, PagerDuty), HA deployment, air-gapped packaging, WCAG 2.1 AA accessibility.

The dashboard maps attestation capabilities to specific compliance controls: