PSZONAK

The PSZONAK Server platform

Know what runs on your servers, what they logged and where it came from.

One platform, one account and one panel for three modules: CRA controls the packages entering your organisation, SBOM inventories the software on your hosts, and LOG collects and searches their logs. You install it on your own infrastructure, so your data stays with you.

Explore the modules Platform panel →

Three modules, one identity

Each module answers a different question

Modules are enabled independently. A disabled module accepts no new data, and its history stays intact.

CRA

Artifact repository

May this package enter the organisation?

  • Proxy and cache for PyPI, npm, Maven and the Docker/OCI registry, plus a repository for your own files.
  • Every artifact gets SHA-256 and SHA-512 hashes and lands in a content-addressed store.
  • Scanning with Syft (SBOM) and Grype and Trivy (vulnerabilities), enriched with EPSS and the CISA KEV catalogue.
  • audit, soft_block and hard_block policies, quarantine, and exceptions with a justification and an expiry date.
  • Full download history: who downloaded a package, when and from where.
SBOM

Software inventory

Which components run on my servers?

  • The host client builds a CycloneDX SBOM, and the server also accepts SPDX.
  • A fleet-wide component view and differences between consecutive scans of a host.
  • Vulnerabilities prioritised by KEV/EPSS, VEX-style triage and an SBOM Quality Score.
  • Fleet coverage: you see at once which hosts have stopped reporting.
  • Export to CycloneDX, SPDX, CSV and XLSX, plus report signature verification.
LOG

Centralised logs

What did these servers log, and where in the fleet does it show up?

  • Incremental reading of selected files in /var/log and journald, with rotation handling.
  • Data masking (passwords, tokens) on the host, before anything leaves the server.
  • Parsers for syslog, nginx, SSH, JSON and key=value, and search across the whole fleet.
  • Retention with legal hold, alerts (e.g. a host that went silent) and Prometheus metrics.
  • Raw batches are stored with a hash matching the one sent by the client.

How it works

A lightweight client on the host, one platform at the centre

  1. 1

    Client on a Linux server

    A single pszonak-client runs as a systemd service. It collects packages and logs only from the directories you specify. It writes data locally first, so a temporary network outage loses nothing.

  2. 2

    Outbound HTTPS only

    The client only sends, it never listens: it opens no ports and runs no commands from the server. Each installation has its own token, which can be revoked at any time.

  3. 3

    PSZONAK Server

    Accepts the data, verifies the hash, stores the original in the repository and indexes it. A single sign-in opens the CRA, SBOM and LOG panels. Every significant operation is recorded in the audit log.

Principles

Designed so your data stays under your control

On your servers, not the vendor's cloud

You install the platform on your own server. SBOMs, logs and artifacts are never sent to an external service.

API-first

The panel, the CLI and the clients all use the same documented API, so CI/CD integration needs no workarounds.

Tokens stored only as hashes

The server keeps only token hashes. You see the full token once, when it is created.

Separated permissions

An SBOM client token does not work in the LOG module, and a client token grants no access to administrative operations.

Integrity

Content hashes at every stage, a content-addressed artifact store, and backups with checksums.

No hidden dependencies

This website loads no external scripts, fonts or analytics tools.

Deployment

Docker Compose on the server, one client on the host

  • Server: an image with PostgreSQL, built-in Syft, Grype and Trivy scanners, and a task scheduler.
  • Modules are enabled with a single variable, e.g. PSZONAK_MODULES=sbom,log.
  • One pszonak-client for SBOM and LOG: a .deb package or archive, one systemd service and enrollment with a single one-time token.
  • Daily database and data backups, with a test restore.
# server
cp .env.example .env    # secrets, chmod 600
make build && make up
make backup

# Linux host
sudo apt install ./pszonak-client_1.0.0_all.deb
sudo pszonak-client enroll      # one-time token
sudo systemctl enable --now pszonak-client

Already have an account?

The platform panel with the CRA, LOG and SBOM modules is available at server.pszonak.app.

Go to the panel