What we do · expertise
Architectures where a leak is not an option.
Encryption, fine-grained access control, complete audit logging, segmentation. We audit existing data stacks and we tool the technical requirements of NIS2 — without ever claiming to make you compliant on your behalf.
Method
Talos Linux has no shell. No interactive session, no SSH daemon, no package manager, a read-only root filesystem. A node receives a declarative configuration document at boot and conforms to it; everything else — reading logs, listing disks, rebooting, upgrading, querying etcd members, producing a support bundle — is a method on a gRPC API, authenticated by client certificate. There is no password path.
What that changes reads in both directions, and both have to be held at once. On the security side: no command interpreter to compromise, no package set to drift, no manual change that survives a reboot, and every administrative act becomes a typed call, therefore loggable and replayable. On the operations side: you no longer repair a node by hand. You fix the configuration and reapply, or you replace the node. And you depend entirely on your API client.
So we wrote ours. talos-rust-client is a gRPC client in Rust: fourteen files, 8,316 lines, of which the typed API surface is generated from SideroLabs' official protos; the connector, the talosconfig parsing and the error types are written by hand. mTLS is not a configuration option there. The certificate authority, the client certificate and the client key are three mandatory fields, and their absence is a typed error before any connection is attempted — not a warning in a log. It is published on crates.io under the MIT OR Apache-2.0 dual licence.
The rest of the posture follows the same principle: the rule lives in the system, not in a binder. Secrets sit in OpenBao, whose unseal shares you hold; the network is default-deny under Cilium, with egress enumerated destination by destination; internal certificates are issued and renewed by cert-manager; the whole platform is described in a GitOps repository where each component is an application reconciled continuously, ordered by sync waves. An auditor does not have to believe us: they read the repository and count.
On compliance, the wording is fixed and will not move. Built to tool the technical requirements of NIS2 — shared responsibility matrix published. § The directive places risk-management measures on the entity, not on its supplier, and we hold no certification of any kind. ▪
The repository this code comes from
talos-rust-client
Talos gRPC client in Rust, published on crates.io. Typed API surface generated from SideroLabs' official protos; mTLS connector, talosconfig parsing and error types written by hand.
github.com/nudibranches-tech/talos-rust-client
Measured over src/, excluding tests and examples.
async fn connect_normal(self) -> Result<Channel> {
// Validate required fields
let ca_cert = self
.ca_cert
.ok_or_else(|| Error::MissingConfig("CA certificate".to_string()))?;
let client_cert = self
.client_cert
.ok_or_else(|| Error::MissingConfig("Client certificate".to_string()))?;
let client_key = self
.client_key
.ok_or_else(|| Error::MissingConfig("Client key".to_string()))?;
// Create tonic Certificate and Identity
let ca = Certificate::from_pem(ca_cert);
let identity = Identity::from_pem(client_cert, client_key);
// Configure TLS
let mut tls_config = ClientTlsConfig::new().ca_certificate(ca).identity(identity);
…// Re-export commonly used client types pub use cluster::cluster_service_client::ClusterServiceClient; pub use inspect::inspect_service_client::InspectServiceClient; pub use machine::machine_service_client::MachineServiceClient; pub use security::security_service_client::SecurityServiceClient; pub use storage::storage_service_client::StorageServiceClient; pub use time::time_service_client::TimeServiceClient;
Scope
An audit starts from what exists: what is actually exposed, who actually has access, where the data leaves.
Engagements
Described by the setup that was put in place and by what it produced.
Embedded engagement · ongoing, more than 12 months
Engineers embedded in the client's teams, on their repository and their delivery chain. What was done by hand is now described, versioned and reviewed.
Sovereign cloud · ongoing
An internal cloud for data and inference, deployed under public control: the models run on the authority's own infrastructure, and the logs stay on its side.
Get in touch
An audit starts from what exists: what is actually exposed, who actually has access, where the data leaves. The deliverable is a written report, with its assumptions, its blind spots, and a list of what we could not verify for lack of access.