- It does not mean unbreakable. No system is. It means the pieces that could do harm are unreachable from the internet, so an attacker's first problem is getting onto your private network, not finding a bug in a web page.
- It does not replace your own hygiene. Keep the controller updated, keep the Tailscale device list tidy, and remove people and devices you no longer trust.
- It does not hide anything from you. The controller image, the capability model and the verification code are open. You can read what the box does before you run it.
Security
Your devices answer to your network. Nothing else.
Opichy is built so that the internet has no path to your switches, motors and sensors. Control happens on the controller, inside a private network you own. The cloud only ever hears from the controller, never the other way round. Here is exactly how that works, and what it means for you.
Two boundaries
Control and coordination never share a door.
Everything that can move something physical lives on the left. Everything on the right can only read what the controller chooses to publish.
Your private network
- Devices. Lights, relays, sensors, motors, industrial I/O.
- Opichy Edge. Discovers, abstracts, decides, actuates. Works offline.
- You. Reach the controller's interfaces over Tailscale, a WireGuard‑based private network that only admits devices you have approved.
Outbound only. Heartbeat, release check.
Cloudflare cloud plane
- Identity and state. One Durable Object per controller.
- Releases. Signed‑off images, checksums, manifests.
- opichy.com. This site and its read‑only API.
Read‑only, filtered, rate‑limited.
Public internet
- Visitors. Read about Opichy, download and verify images.
- Live prototype panel. Health and sensor summaries, nothing that identifies a device or a network.
How it stays that way
Six commitments, each one checkable.
01 · Local control
Commands never cross the internet
The controller talks to your devices directly on your network. Automation, safety interlocks and schedules run on the box, and keep running when the connection is gone. There is no cloud relay in the loop to fail or to be abused.
02 · Private access
Remote control means joining the network
To operate a controller from outside the building you join its private Tailscale network. Access is granted per person and per device, encrypted end to end, and revocable in one click. No port forwarding, no public login page.
03 · Outbound only
The cloud waits to be called
The controller reaches out for two things: to report its heartbeat and to ask whether a newer release exists. opichy.com never opens a connection to a controller and does not need any inbound port on your router.
04 · Scoped credentials
Every credential does one job
Publishing releases, steering the fleet and reporting a heartbeat each use a different token. Device tokens are issued once at enrollment and stored only as a hash. Comparisons run in constant time, so a wrong guess learns nothing.
05 · Verifiable releases
Prove the image before you flash it
Every image is built by CI from public tooling with pinned dependencies, shipped with SHA‑256 checksums, and its manifest is signed with the project's Ed25519 key. The Downloads page checks the signature and any file in your browser using the same Rust code the controller runs. Nothing leaves your machine.
06 · Minimal exposure
The public sees a summary, not a system
The live prototype panel passes through an allow‑list: service health, host load, sensor readings with their age. Network addresses, device identifiers, attached hardware and power data are dropped before they leave the controller's edge.
This website
opichy.com is hardened too.
A download site is part of the supply chain, so it gets the same care as the controller.
One third‑party script, named
Every script is first‑party except Cloudflare Turnstile, which guards the early‑access form against bots and sets no tracking cookies. The content security policy names that one origin and forbids inline scripts and everything else, so an injected tag would not run.
No tracking
There is no analytics tag and no advertising pixel. Download counts and early‑access sign‑ups record the country of the request and nothing else that identifies you.
Always encrypted
HTTPS is enforced with HSTS and preload, so a browser that has visited once will refuse a plain‑text connection afterwards.
Pinned and reviewed deploys
The site and the images are built by GitHub Actions with every action pinned to an exact commit, and deployed only from the main branch after checks pass.
Plain speaking
What this does not mean.
Disclosure
Found something? Tell us first.
Opichy controls physical equipment, so security reports are the most important mail we get.
How to report
Email security@opichy.com with what you
found and how to reproduce it. We acknowledge within three working days, aim to fix
confirmed issues within ninety, faster for anything exploitable on a controller, and
credit you in the release notes unless you ask us not to. The same policy is
machine-readable at
/.well-known/security.txt.
How we build
We follow the product parts of IEC 62443: a written threat model with zones and conduits, a secure development lifecycle, signed releases, a software bill of materials for every build, and dependency audits on every change. A support period is published with each release, and security fixes travel the same signed update path as everything else.