Merge pull request #46 from uug-ai/docs/learn-product-links

Link all products to Learn documentation
docs: summarize image security approach
2026-11-05 20:10:26 +00:00 · 2026-11-04 21:10:42 +01:00 · 2026-11-04 19:47:46 +00:00 · 2026-11-04 19:46:45 +00:00 · 2026-11-04 19:38:33 +00:00 · 2026-11-04 20:25:06 +01:00
51 changed files with 829 additions and 11438 deletions
@@ -84,8 +84,7 @@ jobs:
          kubectl apply -f ./base/vault/mongodb-configmap.yaml -n kerberos-vault
          kubectl apply -f ./base/vault/kerberos-vault-deployment.yaml -n kerberos-vault
          kubectl apply -f ./base/vault/kerberos-vault-service.yaml -n kerberos-vault
-          sleep 10
-          kubectl wait --for=condition=available deployment/vault -n kerberos-vault --timeout=300s
+          kubectl rollout status deployment/vault -n kerberos-vault --timeout=300s
          kubectl get pods -A -o wide 
          kubectl get pods -A -o wide | grep vault | awk '{print $3}' | grep -q '1/1' && echo "vault pod is running with status 1/1" || (echo "vault pod is not running with status 1/1" && exit 1)
      - name: Install Agent
@@ -86,8 +86,7 @@ jobs:
          kubectl apply -f ./base/vault/mongodb-configmap.yaml -n kerberos-vault
          kubectl apply -f ./base/vault/kerberos-vault-deployment.yaml -n kerberos-vault
          kubectl apply -f ./base/vault/kerberos-vault-service.yaml -n kerberos-vault
-          sleep 10
-          kubectl wait --for=condition=available deployment/vault -n kerberos-vault --timeout=300s
+          kubectl rollout status deployment/vault -n kerberos-vault --timeout=300s
          kubectl get pods -A -o wide 
          kubectl get pods -A -o wide | grep vault | awk '{print $3}' | grep -q '1/1' && echo "vault pod is running with status 1/1" || (echo "vault pod is not running with status 1/1" && exit 1)
      - name: Install Agent
@@ -1,4 +1,4 @@
-name: Validate Kustomize and Garage on kind
+name: Validate Kustomize, Garage and Factory on kind

 on:
  workflow_dispatch:
@@ -45,6 +45,28 @@ jobs:
          bash scripts/install-garage.sh
          test "$credential_hash" = "$(kubectl -n garage get secret garage-credentials -o jsonpath='{.data}' | sha256sum)"
          bash scripts/check-garage.sh --restart
+      - name: Install legacy Factory and upgrade the actual base
+        run: |
+          kubectl apply -f base/namespaces/kerberos-factory.yaml
+          kubectl apply -f base/factory/kerberos-factory-clusterrole.yaml
+          kubectl create --dry-run=client -n kerberos-factory -f base/factory/kerberos-factory-deployment.yaml -o json |
+            jq '
+              del(.spec.template.spec.securityContext, .spec.template.spec.volumes) |
+              .spec.template.spec.containers[0] |= (
+                .image = "ghcr.io/uug-ai/factory:v2.0.11" |
+                .ports = [{"containerPort":80,"protocol":"TCP"}] |
+                del(.securityContext, .volumeMounts, .startupProbe, .readinessProbe, .livenessProbe) |
+                .env |= map(
+                  if .name == "K8S_PROXY" then .value = "http://localhost:80"
+                  elif .name == "PORT" then .value = "80"
+                  else . end))' |
+            kubectl apply -n kerberos-factory -f -
+          kubectl create --dry-run=client -n kerberos-factory -f base/factory/kerberos-factory-service.yaml -o json |
+            jq '.spec.ports[0].targetPort = 80' |
+            kubectl apply -n kerberos-factory -f -
+          kubectl -n kerberos-factory rollout status deployment/factory --timeout=300s
+          kubectl apply -k base/factory
+          bash scripts/check-factory.sh
      - name: Collect deployment diagnostics
        if: failure()
        run: bash scripts/diagnose-deployment.sh
@@ -75,8 +75,7 @@ jobs:
          kubectl apply -f ./base/vault/mongodb-configmap.yaml -n kerberos-vault
          kubectl apply -f ./base/vault/kerberos-vault-deployment.yaml -n kerberos-vault
          kubectl apply -f ./base/vault/kerberos-vault-service.yaml -n kerberos-vault
-          sleep 10
-          kubectl wait --for=condition=available deployment/vault -n kerberos-vault --timeout=300s
+          kubectl rollout status deployment/vault -n kerberos-vault --timeout=300s
          kubectl get pods -A -o wide 
          kubectl get pods -A -o wide | grep vault | awk '{print $3}' | grep -q '1/1' && echo "vault pod is running with status 1/1" || (echo "vault pod is not running with status 1/1" && exit 1)
      - name: Install Agent
@@ -1,8 +1,8 @@
 ### Optimized Data Filtering for Enhanced Bandwidth Efficiency and Relevance

-Once your Agents are properly connected and all recordings are stored in the Kerberos Vault, you may encounter additional challenges such as bandwidth limitations, storage constraints, and the need to efficiently locate relevant data. To accomplish this, we can configure an integration to filter the recordings, ensuring that only the relevant ones are retained.
+Once your Agents are properly connected and all recordings are stored in the Vault, you may encounter additional challenges such as bandwidth limitations, storage constraints, and the need to efficiently locate relevant data. To accomplish this, we can configure an integration to filter the recordings, ensuring that only the relevant ones are retained.

-Assuming all configurations are correctly set and all Kubernetes deployments are operational, you can apply the `data-filtering-deployment.yaml` deployment. This deployment will schedule a pod that listens to the configured integration in Kerberos Vault and runs a YOLOv8 model to evaluate the recordings and match them against specified conditions.
+Assuming all configurations are correctly set and all Kubernetes deployments are operational, you can apply the `data-filtering-deployment.yaml` deployment. This deployment will schedule a pod that listens to the configured integration in Vault and runs a YOLOv8 model to evaluate the recordings and match them against specified conditions.

 Please note that if you do not have a GPU on the device, you will need to disable the resource limit of the nvidia/gpu. Once done the filtering will run on the CPU.

@@ -18,7 +18,7 @@ Let's deploy the data filtering pod (with or without GPU support).
 kubectl apply -f data-filtering-deployment.yaml
 ```

-Each time a recording is stored in the Kerberos Vault, the `data-filtering` pod will receive a notification and execute the specified model (YOLOv8 by default). Based on the defined conditions, the `data-filtering` pod may forward the recording to a remote Kerberos Vault, trigger alerts, or send notifications.
+Each time a recording is stored in the Vault, the `data-filtering` pod will receive a notification and execute the specified model (YOLOv8 by default). Based on the defined conditions, the `data-filtering` pod may forward the recording to a remote Vault, trigger alerts, or send notifications.

 Ensure that the `data-filtering` workload is actively running, receiving messages from the integration, and performing the necessary processing tasks.

@@ -27,7 +27,7 @@ kubectl get po -w -A
 kubectl logs -f data...
 ```

-You might see something like below, whereas the `data-filtering` pod is iterating over recordings and frames, looking for a person. Once it finds the person it will try to `forward` the recording to a remote Kerberos Vault.
+You might see something like below, whereas the `data-filtering` pod is iterating over recordings and frames, looking for a person. Once it finds the person it will try to `forward` the recording to a remote Vault.

 ```bash
 Persons: 0, Cars: 0, Trucks: 0
@@ -49,27 +49,27 @@ Delete media from http://vault-lb.kerberos-vault/api
 8) Releasing video writer and closing video capture
 ```

-As indicated by the logs `Something went wrong while forwarding media`, the forwarding process failed due to the absence of an integration between the two `Kerberos Vaults`. Currently, only one `Kerberos Vault` is available. To enable this feature, you will need to [install a second `Kerberos Vault` in the cloud](./README.k8s-managed.md) with access to cloud storage.
+As indicated by the logs `Something went wrong while forwarding media`, the forwarding process failed due to the absence of an integration between the two `Vaults`. Currently, only one `Vault` is available. To enable this feature, you will need to [install a second `Vault` in the cloud](./README.k8s-managed.md) with access to cloud storage.

 ### Add forwarding integration

-If you have setup a secondary Kerberos Vault in the cloud, attached cloud Object storage to it, we can continue and add an additional integration through the UI.
+If you have setup a secondary Vault in the cloud, attached cloud Object storage to it, we can continue and add an additional integration through the UI.

 ```bash
 ssh -L 8080:localhost:30080 user@server-ip -p 22
 ```

-Navigate to the `Kerberos Vault` application in your browser, access the `Integration` section, and add a new integration. This integration will connect your local Kerberos Vault to the remote Kerberos Vault, and will tell the system to set recordings in a `forwarding state`.
+Navigate to the `Vault` application in your browser, access the `Integration` section, and add a new integration. This integration will connect your local Vault to the remote Vault, and will tell the system to set recordings in a `forwarding state`.

 - Add an integration

-  - Kerberos Vault
+  - Vault
    - Enabled: true
    - Integration name: remote-vault
    - Forwarding mode: continuous
    - Url: http(s)://yourvault.com/api
    - Provider: The name of the remote storage provider
-    - Access Key: The access key of the account you have created on the remote Kerberos Vault
-    - Secret Access Key: The secret access key of the account you have created on the remote Kerberos Vault
+    - Access Key: The access key of the account you have created on the remote Vault
+    - Secret Access Key: The secret access key of the account you have created on the remote Vault

 If the integration is functioning correctly, you should observe that recordings are initially marked in gray as "To be forwarded." After a short period, some recordings will be updated to green, indicating they have been "Forwarded by."
@@ -10,7 +10,7 @@

 Kubernetes is an open-source platform for automating the deployment, scaling, and management of containerized applications. It provides features like automated deployment, self-healing, service discovery, and storage orchestration. Kubernetes is essential for modern cloud-native application development and operations.

-In this tutorial, we will guide you through the installation of the Kerberos.io edge stack, which includes the Agent, Kerberos Vault, and the Data Filtering Service. This setup enables the storage of recordings from multiple cameras at the edge, facilitating local data processing and ensuring secure and efficient management of video streams.
+In this tutorial, we will guide you through installing the edge stack, which includes Agent, Vault, and the Data Filtering Service. This setup enables the storage of recordings from multiple cameras at the edge, facilitating local data processing and ensuring secure and efficient management of video streams.

 ## Install Kubernetes on Ubuntu with kubeadm

@@ -112,7 +112,7 @@ Ensure that all nodes are in the Ready state and all pods are in the Running sta

 ## Dependencies

-When installing the Kerberos.io stack, several dependencies are required for storage, such as a database (e.g., MongoDB) and a message broker (e.g., RabbitMQ) for asynchronous behavior. We will install these components before setting up the Agents and Kerberos Vault.
+When installing the ecosystem, several dependencies are required for storage, such as a database (e.g., MongoDB) and a message broker (e.g., RabbitMQ) for asynchronous behavior. We will install these components before setting up the Agents and Vault.

 ### Clone repository

@@ -145,7 +145,7 @@ Skip the following legacy section when using the default installation.

 MinIO is a high-performance, distributed object storage system that is compatible with Amazon S3 cloud storage service. It is designed to handle large-scale data storage and retrieval, making it an ideal choice for modern cloud-native applications.

-In the context of the Kerberos.io stack, MinIO will be used to store recordings from the Agents. These recordings are crucial for surveillance and monitoring purposes, and having a reliable storage solution like MinIO ensures that the data is stored securely and can be accessed efficiently.
+In the context of the ecosystem, MinIO will be used to store recordings from the Agents. These recordings are crucial for surveillance and monitoring purposes, and having a reliable storage solution like MinIO ensures that the data is stored securely and can be accessed efficiently.

 ```bash
 git clone --depth 1 --branch v6.0.1 https://github.com/minio/operator.git && kubectl apply -k operator/
@@ -227,7 +227,7 @@ To access the application, open your browser and navigate to `localhost:8080`. U

 ### Database: MongoDB

-When using Kerberos Vault, it will persist references to the recordings stored in your storage provider in a MongoDB database. As used before, we are using `helm` to install MongoDB in our Kubernetes cluster. Within the Kerberos Vault project we are using the latest official mongodb driver, so we support all major MongoDB versions (4.x, 5.x, 6.x, 7.x).
+When using Vault, it will persist references to the recordings stored in your storage provider in a MongoDB database. As used before, we are using `helm` to install MongoDB in our Kubernetes cluster. Within the Vault project we are using the latest official mongodb driver, so we support all major MongoDB versions (4.x, 5.x, 6.x, 7.x).

 Have a look into the `./mongodb-values.yaml` file, you will find plenty of configurations for the MongoDB helm chart. To change the username and password of the MongoDB instance, go ahead and [find the attribute where](https://github.com/kerberos-io/vault/blob/master/kubernetes/mongodb/values.yaml#L148) you can change the root password. Please note that we are using the official [Bitnami Mongodb helm chart](https://github.com/bitnami/charts/tree/main/bitnami/mongodb), so please use their repository for more indepth configuration.

@@ -276,9 +276,9 @@ View the RabbitMQ status and wait until it's properly running
 kubectl get po -w -A
 ```

-### Kerberos Vault
+### Vault

-Kerberos Vault requires a configuration to connect to the MongoDB instance. To handle this a `configmap` is defined in the `./mongodb-configmap.yaml` file. Modify the MongoDB credentials in the `./mongodb-configmap.yaml` file, and make sure they match the credentials of your MongoDB instance, as described above. There are two ways of configuring the MongoDB connection, either you provide a `MONGODB_URI` or you specify the individual variables `MONGODB_USERNAME`, `MONGODB_PASSWORD`, etc.
+Vault requires a configuration to connect to the MongoDB instance. To handle this a `configmap` is defined in the `./mongodb-configmap.yaml` file. Modify the MongoDB credentials in the `./mongodb-configmap.yaml` file, and make sure they match the credentials of your MongoDB instance, as described above. There are two ways of configuring the MongoDB connection, either you provide a `MONGODB_URI` or you specify the individual variables `MONGODB_USERNAME`, `MONGODB_PASSWORD`, etc.

 As mentioned above a managed MongoDB is easier to setup and manage, for example for MongoDB Atlas, you will get a MongoDB URI in the form of `"mongodb+srv://xx:xx@kerberos-hub.xxx.mongodb.net/?retryWrites=true&w=majority&appName=xxx"`. By applying this value into the `MONGODB_URI` field, you will have setup your MongoDB connection successfully.

@@ -302,7 +302,7 @@ Create the `kerberos-vault` namespace.
 kubectl create namespace kerberos-vault
 ```

-Apply the manifests, so the Kerberos Vault application is deployed and knows how to connect to the MongoDB.
+Apply the manifests, so the Vault application is deployed and knows how to connect to the MongoDB.

 ```bash
 kubectl apply -f ./mongodb-configmap.yaml -n kerberos-vault
@@ -318,15 +318,15 @@ kubectl get po -w -A

 #### Access the UI

-If you have opted for the `NodePort` configuration, you can access the Kerberos Vault via the `http://localhost:30080` endpoint in your browser. For server installations without a GUI, consider setting up a reverse proxy to enable browser access from your local machine. Alternatively, you may utilize a `LoadBalancer` if one is available or if you are deploying on a managed Kubernetes service.
+If you have opted for the `NodePort` configuration, you can access the Vault via the `http://localhost:30080` endpoint in your browser. For server installations without a GUI, consider setting up a reverse proxy to enable browser access from your local machine. Alternatively, you may utilize a `LoadBalancer` if one is available or if you are deploying on a managed Kubernetes service.

 ```bash
 ssh -L 8080:localhost:30080 user@server-ip -p 22
 ```

-#### Configure the Kerberos Vault
+#### Configure the Vault

-With the Kerberos Vault installed, we can proceed to configure the various components. Currently, this must be done through the Kerberos Vault UI, but we plan to make it configurable via environment variables, eliminating the need for manual UI configurations.
+With the Vault installed, we can proceed to configure the various components. Currently, this must be done through the Vault UI, but we plan to make it configurable via environment variables, eliminating the need for manual UI configurations.

 ![Configure Vault](./assets/images/configure-vault.gif)

@@ -370,26 +370,26 @@ before switching an existing installation.

 ### Create an Agent

-After deploying the Kerberos Vault and configuring the necessary services for storage, database, and integration, you can proceed to deploy the Agent with the appropriate configuration. Review the `kerberos-agent-deployment.yaml` file and adjust the relevant settings, such as the RTSP URL, to ensure proper functionality. As mentioned below note that you can opt for the [Factory](https://github.com/kerberos-io/factory/tree/master/kubernetes) which gives you a UI to manage the creation of Agents. **_(Please note if you generated new the keys in the previous Kerberos Vault account creation, you need to update those in the Agent deployment)_**
+After deploying the Vault and configuring the necessary services for storage, database, and integration, you can proceed to deploy the Agent with the appropriate configuration. Review the `kerberos-agent-deployment.yaml` file and adjust the relevant settings, such as the RTSP URL, to ensure proper functionality. As mentioned below note that you can opt for the [Factory](https://github.com/kerberos-io/factory/tree/master/kubernetes) which gives you a UI to manage the creation of Agents. **_(Please note if you generated new the keys in the previous Vault account creation, you need to update those in the Agent deployment)_**

 ```bash
 kubectl apply -f kerberos-agent-deployment.yaml
 ```

-Review the creation of the Agent and review the logs of the container to validate the Agent is able to connect to the IP camera, and if a recording is being created and transferred to the Kerberos Vault
+Review the creation of the Agent and review the logs of the container to validate the Agent is able to connect to the IP camera, and if a recording is being created and transferred to the Vault

 ```bash
 kubectl get po -w -A
 kubectl logs -f kerberos-agent...
 ```

-To validate the Kerberos Vault and review any stored recordings, access the user interface at `http://localhost:30080` (after establishing the reverse tunnel).
+To validate the Vault and review any stored recordings, access the user interface at `http://localhost:30080` (after establishing the reverse tunnel).

 ### Create Agents through Factory

 Managing Agents through seperate configuration files might feel cumbersome, especially for non-technical users. This is where Factory comes into the picture. Factory provides a visual view that allows you to rapidly connect cameras through a user interface, which allows users without any technical background about cameras and kubernetes create Agents.

-Factory also requires a mongodb, just like Kerberos Vault. Luckily you can reuse the mongodb installation we have deployed earlier, the only thing we'll need to do is to create another `configmap.yaml` in the `kerberos-factory` namespace.
+Factory also requires a mongodb, just like Vault. Luckily you can reuse the mongodb installation we have deployed earlier, the only thing we'll need to do is to create another `configmap.yaml` in the `kerberos-factory` namespace.

 Create the `kerberos-factory` namespace.

@@ -419,9 +419,9 @@ kubectl get po -w -A

 ### Optimized Data Filtering for Enhanced Bandwidth Efficiency and Relevance

-Once your Agents are properly connected and all recordings are stored in the Kerberos Vault, you may encounter additional challenges such as bandwidth limitations, storage constraints, and the need to efficiently locate relevant data. To accomplish this, we can configure an integration to filter the recordings, ensuring that only the relevant ones are retained.
+Once your Agents are properly connected and all recordings are stored in the Vault, you may encounter additional challenges such as bandwidth limitations, storage constraints, and the need to efficiently locate relevant data. To accomplish this, we can configure an integration to filter the recordings, ensuring that only the relevant ones are retained.

-Assuming all configurations are correctly set and all Kubernetes deployments are operational, you can apply the `data-filtering-deployment.yaml` deployment. This deployment will schedule a pod that listens to the configured integration in Kerberos Vault and runs a YOLOv8 model to evaluate the recordings and match them against specified conditions.
+Assuming all configurations are correctly set and all Kubernetes deployments are operational, you can apply the `data-filtering-deployment.yaml` deployment. This deployment will schedule a pod that listens to the configured integration in Vault and runs a YOLOv8 model to evaluate the recordings and match them against specified conditions.

 Please note that if you do not have a GPU on the device, you will need to disable the resource limit of the nvidia/gpu. Once done the filtering will run on the CPU.

@@ -437,7 +437,7 @@ Let's deploy the data filtering pod (with or without GPU support).
 kubectl apply -f data-filtering-deployment.yaml
 ```

-Each time a recording is stored in the Kerberos Vault, the `data-filtering` pod will receive a notification and execute the specified model (YOLOv8 by default). Based on the defined conditions, the `data-filtering` pod may forward the recording to a remote Kerberos Vault, trigger alerts, or send notifications.
+Each time a recording is stored in the Vault, the `data-filtering` pod will receive a notification and execute the specified model (YOLOv8 by default). Based on the defined conditions, the `data-filtering` pod may forward the recording to a remote Vault, trigger alerts, or send notifications.

 Ensure that the `data-filtering` workload is actively running, receiving messages from the integration, and performing the necessary processing tasks.

@@ -446,7 +446,7 @@ kubectl get po -w -A
 kubectl logs -f data...
 ```

-You might see something like below, whereas the `data-filtering` pod is iterating over recordings and frames, looking for a person. Once it finds the person it will try to `forward` the recording to a remote Kerberos Vault.
+You might see something like below, whereas the `data-filtering` pod is iterating over recordings and frames, looking for a person. Once it finds the person it will try to `forward` the recording to a remote Vault.

 ```bash
 Persons: 0, Cars: 0, Trucks: 0
@@ -468,34 +468,34 @@ Delete media from http://vault-lb.kerberos-vault/api
 8) Releasing video writer and closing video capture
 ```

-As indicated by the logs `Something went wrong while forwarding media`, the forwarding process failed due to the absence of an integration between the two `Kerberos Vaults`. Currently, only one `Kerberos Vault` is available. To enable this feature, you will need to [install a second `Kerberos Vault` in the cloud](./README.k8s-managed.md) with access to cloud storage.
+As indicated by the logs `Something went wrong while forwarding media`, the forwarding process failed due to the absence of an integration between the two `Vaults`. Currently, only one `Vault` is available. To enable this feature, you will need to [install a second `Vault` in the cloud](./README.k8s-managed.md) with access to cloud storage.

 ### Add forwarding integration

-If you have setup a secondary Kerberos Vault in the cloud, attached cloud Object storage to it, we can continue and add an additional integration through the UI.
+If you have setup a secondary Vault in the cloud, attached cloud Object storage to it, we can continue and add an additional integration through the UI.

 ```bash
 ssh -L 8080:localhost:30080 user@server-ip -p 22
 ```

-Navigate to the `Kerberos Vault` application in your browser, access the `Integration` section, and add a new integration. This integration will connect your local Kerberos Vault to the remote Kerberos Vault, and will tell the system to set recordings in a `forwarding state`.
+Navigate to the `Vault` application in your browser, access the `Integration` section, and add a new integration. This integration will connect your local Vault to the remote Vault, and will tell the system to set recordings in a `forwarding state`.

 - Add an integration

-  - Kerberos Vault
+  - Vault
    - Enabled: true
    - Integration name: remote-vault
    - Forwarding mode: continuous
    - Url: http(s)://yourvault.com/api
    - Provider: The name of the remote storage provider
-    - Access Key: The access key of the account you have created on the remote Kerberos Vault
-    - Secret Access Key: The secret access key of the account you have created on the remote Kerberos Vault
+    - Access Key: The access key of the account you have created on the remote Vault
+    - Secret Access Key: The secret access key of the account you have created on the remote Vault

 If the integration is functioning correctly, you should observe that recordings are initially marked in gray as "To be forwarded." After a short period, some recordings will be updated to green, indicating they have been "Forwarded by."

 ## Cleanup

-If you consider to remove the Kerberos.io stack you might just disable the microk8s installation
+If you consider to remove the ecosystem you might just disable the microk8s installation

 ```bash
 microk8s reset
@@ -1,21 +1,29 @@
 # Deployment

-Deploying the Kerberos.io stack may initially appear to be a complex task due to its design for scalability from the outset. This entails the integration of several scalable components within a distributed deployment architecture. To streamline the installation process, we have established this repository to offer comprehensive guidance. Our objective is to incorporate as much automation as possible within this repository, thereby ensuring that the installation process is straightforward and user-friendly. At the same time, we remain committed to delivering a scalable and highly available video surveillance system.
+Deploying the ecosystem may initially appear to be a complex task due to its design for scalability from the outset. This entails the integration of several scalable components within a distributed deployment architecture. To streamline the installation process, we have established this repository to offer comprehensive guidance. Our objective is to incorporate as much automation as possible within this repository, thereby ensuring that the installation process is straightforward and user-friendly. At the same time, we remain committed to delivering a scalable and highly available video surveillance system.

-![How it works](./assets/images/how-it-works.svg)
+[![How it works: cameras feed Agents, Factory manages Agents on Kubernetes, Vault stores recordings, and Hub analyses events.](./assets/images/how-it-works.svg)][draw-how-it-works]

-The Kerberos.io stack offers flexible installation options, supporting deployment in hybrid environments, fully in the cloud, or entirely at the edge. This deployment guide covers the installation of various Kerberos.io components. For detailed information on each component, please refer to their respective repositories.
+[Edit in Draw][draw-how-it-works] · [Diagram source](./assets/diagrams/how-it-works.json)

- [Agent](https://github.com/kerberos-io/agent)
- [Factory](https://github.com/kerberos-io/factory)
- [Kerberos Vault](https://github.com/kerberos-io/vault)
- [Kerberos Hub](https://github.com/kerberos-io/hub)
+The ecosystem offers flexible installation options, supporting deployment in hybrid environments, fully in the cloud, or entirely at the edge. This deployment guide covers installing its components. For detailed component documentation, please refer to the links below.
+
+- [Agent](https://learn.uug.ai/docs/agent/)
+- [Factory](https://learn.uug.ai/docs/factory/)
+- [Vault](https://learn.uug.ai/docs/vault/)
+- [Hub](https://learn.uug.ai/docs/hub/)

 ## Continuous deployment

-[<img src="https://github.com/kerberos-io/deployment/workflows/Deploy%20on%20Microk8s/badge.svg"/>](https://github.com/kerberos-io/deployment/actions/workflows/microk8s.yaml) [<img src="https://github.com/kerberos-io/deployment/workflows/Deploy%20on%20Kubernetes/badge.svg"/>](https://github.com/kerberos-io/deployment/actions/workflows/kind.yaml)
+[![Deploy on kind](https://github.com/uug-ai/deployment/actions/workflows/kind.yaml/badge.svg?branch=main)](https://github.com/uug-ai/deployment/actions/workflows/kind.yaml)
+[![Deploy on k3d](https://github.com/uug-ai/deployment/actions/workflows/k3d.yaml/badge.svg?branch=main)](https://github.com/uug-ai/deployment/actions/workflows/k3d.yaml)
+[![Deploy on MicroK8s](https://github.com/uug-ai/deployment/actions/workflows/microk8s.yaml/badge.svg?branch=main)](https://github.com/uug-ai/deployment/actions/workflows/microk8s.yaml)
+[![Validate Kustomize, Garage and Factory on kind](https://github.com/uug-ai/deployment/actions/workflows/kustomize.yaml/badge.svg?branch=main)](https://github.com/uug-ai/deployment/actions/workflows/kustomize.yaml)

-This repository continuously tests the Kerberos.io deployment using GitHub Actions across various platforms. Refer to the badges for an overview of the operating systems and Kubernetes distributions we are deploying to. We welcome suggestions for additional automations to consider.
+These badges show the latest status of each GitHub Actions workflow on `main`.
+Select a badge to view its runs and platform-specific results. The deployment
+workflows continuously test the ecosystem across kind, k3d, and MicroK8s; the
+Kustomize workflow validates the Kustomize, Garage, and Factory setup.

 Kubernetes examples and CI now use **Garage S3** for local object storage.
 See the [Garage setup guide](./base/garage/README.md) for generated credentials,
@@ -30,33 +38,14 @@ example on fork PRs), CI emits a warning and skips delivery without masking
 deployment failures. Configured webhook delivery errors still fail the step.
 Failed deployment jobs collect pod events and bounded logs for diagnosis.

-### Hardened Hub API and frontend
+### Security

-The Kubernetes overlays and full deployment workflows pin Hub chart **0.170.1**.
-It supplies Hub API container/pod security contexts for the promoted
-`ghcr.io/uug-ai/hub-api:v1.11.31`: UID/GID `65532`, read-only root filesystem,
-no privilege escalation, dropped capabilities and RuntimeDefault seccomp.
-A disk-backed `hub-api-tmp` emptyDir at `/tmp` provides writable upload scratch
-space with pod `fsGroup: 65532`; it is not persistent storage.
-Retain this volume and mount when adding custom API mounts, because Helm
-replaces lists rather than appending to them.
-
-The promoted frontend image requires Hub chart **0.170.0 or newer**, which
-provides port `8080`, non-root/read-only runtime settings and a writable `/tmp`
-mount. Both primary and demo frontends use these settings; Admin remains on its
-legacy image and port `80`. Keep `global.imageRegistry` empty for the supplied
-fully qualified `ghcr.io` image names. Service ports remain `80` and the frontend
-NodePort remains `32080`, targeting the container port named `http`.
-
-Run `bash scripts/check-hub-runtime.sh` to check published chart `0.170.1` with these
-values before installation, or pass a local chart path as the first argument.
-When adding custom branding mounts, preserve the chart's `frontend-tmp` volume
-and `/tmp` mount. Existing deployments may require the explicit
-[HTTP port migration](https://github.com/kerberos-io/helm-charts/blob/main/charts/hub/README.md#recovering-a-duplicate-http-port-during-upgrades).
+We harden our container images and check our solutions for known CVEs. See the
+[Secure repository](https://github.com/uug-ai/secure) for our security work.

 ## Architecture

-As previously indicated, several integral components, including Object Storage, Database, and Message Brokers, are deployed and configured to ensure the proper functionality of Kerberos.io. The architecture diagrams below aims to provide a visual representation of these components and their interactions with one another depending the deployment; self-hosted or managed cloud deployment.
+As previously indicated, several integral components, including object storage, databases, and message brokers, are deployed and configured to support the ecosystem. The architecture diagrams below provide a visual representation of these components and how they interact in self-hosted and managed cloud deployments.

 It is important to note that the ease of installation may vary depending on the chosen Kubernetes distribution and platform. For instance, distributions like Microk8s, which offer an addons feature, may simplify the installation process significantly. Managed Kubernetes services on platforms such as AWS, Azure, GCP, and others offer a range of supplementary services. These include, but are not limited to, cloud-based object storage, load balancers, persistent volumes, and additional resources that enhance the deployment experience. On the other hand running a self-hosted vanilla Kubernetes deployment will come with additinal work as it misses the out-of-the-box components from a managed deployment or the self-hosted Microk8s add-ons feature.

@@ -64,17 +53,28 @@ Given these differences, we have created specific architectural frameworks for s

 ## Edge (self-hosted) deployment

-Edge (self-hosted) deployments are typically used for camera processing and edge storage. In this setup, Agents are deployed and connected to cameras, with recordings stored in the Kerberos Vault. Additionally, you may want to create integrations, such as [data filtering](https://github.com/uug-ai/data-filtering), to ensure only relevant recordings are retained, or set up custom notifications to your first or third-party platforms. In this edge scenario, hardware is being deployed in the local network to handle the workloads; for example AMD64 or ARM64 processors.
+Edge (self-hosted) deployments are typically used for camera processing and edge storage. In this setup, Agents are deployed and connected to cameras, with recordings stored in the Vault. Additionally, you may want to create integrations, such as [data filtering](https://github.com/uug-ai/data-filtering), to ensure only relevant recordings are retained, or set up custom notifications to your first or third-party platforms. In this edge scenario, hardware is being deployed in the local network to handle the workloads; for example AMD64 or ARM64 processors.

-![Edge - self-hosted deployment](./assets/images/deployment-self-hosted.svg)
+[![Self-hosted deployment: one Agent per camera uploads to Vault, backed by MongoDB and object storage. Optional RabbitMQ events feed custom integrations.](./assets/images/deployment-self-hosted.svg)][draw-deployment-self-hosted]

-A key aspect of this deployment is the scaling of Agents. Each camera is assigned a dedicated Agent container, which is linked to a central Kerberos Vault. The Kerberos Vault stores metadata in MongoDB, recordings in Garage (or another S3-compliant object storage), and can generate events in a message broker like RabbitMQ. This approach enables you to develop custom applications/logic that can respond to the creation of new recordings.
+[Edit in Draw][draw-deployment-self-hosted] · [Diagram source](./assets/diagrams/deployment-self-hosted.json)
+
+Factory is optional and manages Agents when using Kubernetes. Event publishing
+and custom integrations are optional; recordings can stay entirely within the
+private edge network.
+
+A key aspect of this deployment is the scaling of Agents. Each camera is
+assigned a dedicated Agent container, which is linked to a central Vault. Vault
+stores metadata in MongoDB, recordings in Garage (or another S3-compatible
+object storage), and can generate events in a message broker like RabbitMQ.
+This approach enables you to develop custom applications or logic that can
+respond to new recordings.

 Based on your technology experience and preferences, you can choose from the following deployment guides:

- [[Easy] Install Kerberos.io on Docker](/README.docker.md)
- [[Medium] Install Kerberos.io on Microk8s](/README.microk8s.md)
- [[Advanced] Install Kerberos.io on Kubernetes](/README.k8s.md)
+- [[Easy] Install the ecosystem with Docker](/README.docker.md)
+- [[Medium] Install the ecosystem with Microk8s](/README.microk8s.md)
+- [[Advanced] Install the ecosystem with Kubernetes](/README.k8s.md)

 ## Managed deployment

@@ -96,13 +96,54 @@ As previously discussed, a managed deployment enhances resilience and high avail

 The primary objective of maintaining a managed, public-facing deployment is to centralize multiple edge deployments through a unified interface. Typically, edge deployments are distributed across various environments such as hospitals, retail stores, and factories. These edge deployments are inherently secure and non-public facing, preventing direct internet access to these environments. To address this challenge, we operate a managed, public-facing environment that consolidates all recordings, live camera views, and permissions into a single, cohesive platform.

-![Managed deployment](./assets/images/deployment-managed.svg)
+[![Managed deployment: Agents at private sites upload over HTTPS to cloud Vault. Object storage holds recordings, MongoDB holds metadata, and RabbitMQ feeds Hub processing.](./assets/images/deployment-managed.svg)][draw-deployment-managed]
+
+[Edit in Draw][draw-deployment-managed] · [Diagram source](./assets/diagrams/deployment-managed.json)
+
+This example shows Agents uploading directly to cloud Vault, without exposing
+the camera networks to inbound internet traffic. Hybrid deployments can retain
+an edge Vault and forward selected recordings to cloud Vault instead. The
+backing services can be self-hosted or compatible managed services; their logical
+roles stay the same.

 Based on your technology experience and preferences, you can choose from the following deployment guides:

- [[Medium] Install Kerberos.io on Kubernetes (AWS, GCP, Azure, etc.)](/README.k8s-managed.md)
+- [[Medium] Install the ecosystem with Kubernetes (AWS, GCP, Azure, etc.)](/README.k8s-managed.md)

 Or provision the infrastructure yourself with infrastructure as code:

 - [[AWS] Terraform: EKS cluster + Amazon DocumentDB](./modules/amazon-eks-documentdb/README.md)
 - [[Azure] Terraform: Event Hub with 10 partitions](./modules/azure-event-hub/README.md)
+
+## Updating architecture diagrams
+
+These diagrams use the same editable `groups`, `nodes`, and `connections` JSON
+format as the [Learn diagrams](https://learn.uug.ai/docs/prologue/how/) and
+[Draw](https://draw.uug.ai/). GitHub cannot run Learn's interactive renderer, so
+the README uses self-contained SVG exports from Draw, with an **Edit in Draw**
+link carrying the source in a base64-encoded UTF-8 URL fragment.
+
+1. Update the corresponding JSON in [assets/diagrams](./assets/diagrams).
+   Keep the product colours, labelled zones, cards and orthogonal connectors
+   consistent with Learn; the overview follows Learn's solution stack.
+2. Run `node scripts/update-diagram-links.mjs` (Node.js 20+) to refresh the
+   README's Draw links. Open the updated **Edit in Draw** link, or paste the
+   JSON into Draw's **Templates** import.
+3. Use Draw's **Export board** action to download an SVG in light mode and
+   replace the matching file in [assets/images](./assets/images). Export the
+   whole diagram, not a screenshot of the editor. Draw embeds its image assets
+   so GitHub does not need external icons or scripts.
+4. Run `node scripts/update-diagram-links.mjs --check` and preview the README.
+   The check validates source bounds/connections, SVG presence and link
+   freshness; also check the exported diagram visually.
+
+Edits on a Draw board do not automatically update this repository. Mirror any
+board changes into the JSON source before refreshing the links and SVG. Commit
+the source, preview and README links together; do not hand-edit the generated
+links below.
+
+<!-- BEGIN GENERATED DRAW LINKS -->
+[draw-how-it-works]: https://draw.uug.ai/#diagram=eyJncm91cHMiOlt7ImlkIjoiY2FwdHVyZSIsImxhYmVsIjoiMS4gQ2FtZXJhIHByb2Nlc3NpbmcgLSBlZGdlIC8gY2xvdWQiLCJ4IjowLCJ5IjoyMCwidyI6NTQwLCJoIjo1MjB9LHsiaWQiOiJwZXJzaXN0ZW5jZSIsImxhYmVsIjoiMi4gUGVyc2lzdGVuY2UgLSBlZGdlIC8gY2xvdWQiLCJ4Ijo2MjAsInkiOjIwLCJ3IjozMDAsImgiOjUyMH0seyJpZCI6ImFuYWx5c2lzIiwibGFiZWwiOiIzLiBBbmFseXNlIC0gZWRnZSAvIGNsb3VkIiwieCI6MTAwMCwieSI6MjAsInciOjMwMCwiaCI6NTIwfV0sIm5vZGVzIjpbeyJpZCI6ImNhbWVyYS0xIiwia2luZCI6ImNhbWVyYSIsIngiOjMwLCJ5IjoyMzAsInciOjE4MCwiaCI6MTQwLCJoZWFkZXIiOiJDQU1FUkEiLCJ0aXRsZSI6IkNhbWVyYSAxIiwic3VidGl0bGUiOiJSVFNQIHN0cmVhbSJ9LHsiaWQiOiJjYW1lcmEtMiIsImtpbmQiOiJjYW1lcmEiLCJ4IjozMCwieSI6MzkwLCJ3IjoxODAsImgiOjE0MCwiaGVhZGVyIjoiQ0FNRVJBIiwidGl0bGUiOiJDYW1lcmEgMiIsInN1YnRpdGxlIjoiUlRTUCBzdHJlYW0ifSx7ImlkIjoiZmFjdG9yeSIsImtpbmQiOiJmYWN0b3J5IiwieCI6MjgwLCJ5Ijo2MCwidyI6MjMwLCJoIjoxNDAsImhlYWRlciI6Ik9SQ0hFU1RSQVRFIiwidGl0bGUiOiJGYWN0b3J5Iiwic3VidGl0bGUiOiJNYW5hZ2Ugb24gS3ViZXJuZXRlcyJ9LHsiaWQiOiJhZ2VudC0xIiwia2luZCI6ImFnZW50IiwieCI6MjgwLCJ5IjoyMzAsInciOjIzMCwiaCI6MTQwLCJoZWFkZXIiOiJSRUNPUkQiLCJ0aXRsZSI6IkFnZW50IDEiLCJzdWJ0aXRsZSI6IlByb2Nlc3Mgb25lIGNhbWVyYSJ9LHsiaWQiOiJhZ2VudC0yIiwia2luZCI6ImFnZW50IiwieCI6MjgwLCJ5IjozOTAsInciOjIzMCwiaCI6MTQwLCJoZWFkZXIiOiJSRUNPUkQiLCJ0aXRsZSI6IkFnZW50IDIiLCJzdWJ0aXRsZSI6IlByb2Nlc3Mgb25lIGNhbWVyYSJ9LHsiaWQiOiJ2YXVsdCIsImtpbmQiOiJ2YXVsdCIsIngiOjY1MCwieSI6MjMwLCJ3IjoyNDAsImgiOjE0MCwiaGVhZGVyIjoiU1RPUkUiLCJ0aXRsZSI6IlZhdWx0Iiwic3VidGl0bGUiOiJTdG9yZSBhbmQgaW50ZWdyYXRlIn0seyJpZCI6InN0b3JhZ2UiLCJraW5kIjoic3RvcmFnZSIsIngiOjY1MCwieSI6MzkwLCJ3IjoyNDAsImgiOjE0MCwiaGVhZGVyIjoiT0JKRUNUIFNUT1JBR0UiLCJ0aXRsZSI6IlN0b3JhZ2UgYmFja2VuZCIsInN1YnRpdGxlIjoiQ2xvdWQgLyBlZGdlIn0seyJpZCI6Imh1YiIsImtpbmQiOiJodWIiLCJ4IjoxMDMwLCJ5IjoyMzAsInciOjI0MCwiaCI6MTQwLCJoZWFkZXIiOiJBTkFMWVNFIiwidGl0bGUiOiJIdWIiLCJzdWJ0aXRsZSI6Ik1vbml0b3IgYW5kIGFuYWx5c2UifV0sImNvbm5lY3Rpb25zIjpbeyJmcm9tIjoiY2FtZXJhLTEiLCJ0byI6ImFnZW50LTEiLCJmcm9tU2lkZSI6InJpZ2h0IiwidG9TaWRlIjoibGVmdCJ9LHsiZnJvbSI6ImNhbWVyYS0yIiwidG8iOiJhZ2VudC0yIiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImxlZnQifSx7ImZyb20iOiJmYWN0b3J5IiwidG8iOiJhZ2VudC0xIiwiZnJvbVNpZGUiOiJib3R0b20iLCJ0b1NpZGUiOiJ0b3AiLCJraW5kIjoiZGFzaGVkIn0seyJmcm9tIjoiZmFjdG9yeSIsInRvIjoiYWdlbnQtMiIsImZyb21TaWRlIjoicmlnaHQiLCJ0b1NpZGUiOiJyaWdodCIsImtpbmQiOiJkYXNoZWQifSx7ImZyb20iOiJhZ2VudC0xIiwidG8iOiJ2YXVsdCIsImZyb21TaWRlIjoicmlnaHQiLCJ0b1NpZGUiOiJsZWZ0In0seyJmcm9tIjoiYWdlbnQtMiIsInRvIjoidmF1bHQiLCJmcm9tU2lkZSI6InJpZ2h0IiwidG9TaWRlIjoibGVmdCJ9LHsiZnJvbSI6InZhdWx0IiwidG8iOiJzdG9yYWdlIiwiZnJvbVNpZGUiOiJib3R0b20iLCJ0b1NpZGUiOiJ0b3AifSx7ImZyb20iOiJ2YXVsdCIsInRvIjoiaHViIiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImxlZnQiLCJsYWJlbCI6IkV2ZW50cyJ9XX0=
+[draw-deployment-self-hosted]: https://draw.uug.ai/#diagram=eyJncm91cHMiOlt7ImlkIjoiZWRnZSIsImxhYmVsIjoiUHJpdmF0ZSBlZGdlIG5ldHdvcmsgLSBEb2NrZXIgLyBLdWJlcm5ldGVzIiwieCI6MCwieSI6MjAsInciOjEyNDAsImgiOjY4MH1dLCJub2RlcyI6W3siaWQiOiJjYW1lcmEtMSIsImtpbmQiOiJjYW1lcmEiLCJ4IjozMCwieSI6MjgwLCJ3IjoxODAsImgiOjE0MCwiaGVhZGVyIjoiQ0FNRVJBIiwidGl0bGUiOiJDYW1lcmEgMSIsInN1YnRpdGxlIjoiUlRTUCBzdHJlYW0ifSx7ImlkIjoiY2FtZXJhLTIiLCJraW5kIjoiY2FtZXJhIiwieCI6MzAsInkiOjUxMCwidyI6MTgwLCJoIjoxNDAsImhlYWRlciI6IkNBTUVSQSIsInRpdGxlIjoiQ2FtZXJhIDIiLCJzdWJ0aXRsZSI6IlJUU1Agc3RyZWFtIn0seyJpZCI6ImZhY3RvcnkiLCJraW5kIjoiZmFjdG9yeSIsIngiOjI4MCwieSI6ODAsInciOjIyMCwiaCI6MTQwLCJoZWFkZXIiOiJPUFRJT05BTCBPUkNIRVNUUkFUSU9OIiwidGl0bGUiOiJGYWN0b3J5Iiwic3VidGl0bGUiOiJNYW5hZ2Ugb24gS3ViZXJuZXRlcyJ9LHsiaWQiOiJhZ2VudC0xIiwia2luZCI6ImFnZW50IiwieCI6MjgwLCJ5IjoyODAsInciOjIyMCwiaCI6MTQwLCJoZWFkZXIiOiJSRUNPUkQiLCJ0aXRsZSI6IkFnZW50IDEiLCJzdWJ0aXRsZSI6Ik9uZSBjYW1lcmEgcGVyIGNvbnRhaW5lciJ9LHsiaWQiOiJhZ2VudC0yIiwia2luZCI6ImFnZW50IiwieCI6MjgwLCJ5Ijo1MTAsInciOjIyMCwiaCI6MTQwLCJoZWFkZXIiOiJSRUNPUkQiLCJ0aXRsZSI6IkFnZW50IDIiLCJzdWJ0aXRsZSI6Ik9uZSBjYW1lcmEgcGVyIGNvbnRhaW5lciJ9LHsiaWQiOiJ2YXVsdCIsImtpbmQiOiJ2YXVsdCIsIngiOjYyMCwieSI6MjgwLCJ3IjoyMzAsImgiOjE0MCwiaGVhZGVyIjoiU1RPUkUiLCJ0aXRsZSI6IlZhdWx0Iiwic3VidGl0bGUiOiJDZW50cmFsaXNlIGVkZ2UgcmVjb3JkaW5ncyJ9LHsiaWQiOiJtb25nb2RiIiwia2luZCI6ImRhdGFiYXNlIiwieCI6OTcwLCJ5Ijo4MCwidyI6MjQwLCJoIjoxNDAsImhlYWRlciI6Ik1FVEFEQVRBIiwidGl0bGUiOiJNb25nb0RCIiwic3VidGl0bGUiOiJWYXVsdCBtZXRhZGF0YSJ9LHsiaWQiOiJzdG9yYWdlIiwia2luZCI6InN0b3JhZ2UiLCJ4Ijo5NzAsInkiOjI4MCwidyI6MjQwLCJoIjoxNDAsImhlYWRlciI6IlJFQ09SRElOR1MiLCJ0aXRsZSI6Ik9iamVjdCBzdG9yYWdlIiwic3VidGl0bGUiOiJNaW5JTyAvIFMzLWNvbXBhdGlibGUifSx7ImlkIjoiYnJva2VyIiwia2luZCI6ImFtcXAiLCJ4Ijo5NzAsInkiOjUxMCwidyI6MjQwLCJoIjoxNDAsImhlYWRlciI6Ik9QVElPTkFMIEVWRU5UUyIsInRpdGxlIjoiUmFiYml0TVEiLCJzdWJ0aXRsZSI6IlJlY29yZGluZyBldmVudHMifSx7ImlkIjoiaW50ZWdyYXRpb24iLCJraW5kIjoiZGVmYXVsdCIsIngiOjYyMCwieSI6NTEwLCJ3IjoyMzAsImgiOjE0MCwiaGVhZGVyIjoiT1BUSU9OQUwgSU5URUdSQVRJT04iLCJ0aXRsZSI6IkN1c3RvbSBhcHBsaWNhdGlvbiIsInN1YnRpdGxlIjoiRmlsdGVyLCBub3RpZnkgb3IgaW50ZWdyYXRlIn1dLCJjb25uZWN0aW9ucyI6W3siZnJvbSI6ImNhbWVyYS0xIiwidG8iOiJhZ2VudC0xIiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImxlZnQiLCJsYWJlbCI6IlJUU1AifSx7ImZyb20iOiJjYW1lcmEtMiIsInRvIjoiYWdlbnQtMiIsImZyb21TaWRlIjoicmlnaHQiLCJ0b1NpZGUiOiJsZWZ0IiwibGFiZWwiOiJSVFNQIn0seyJmcm9tIjoiZmFjdG9yeSIsInRvIjoiYWdlbnQtMSIsImZyb21TaWRlIjoiYm90dG9tIiwidG9TaWRlIjoidG9wIiwia2luZCI6ImRhc2hlZCJ9LHsiZnJvbSI6ImZhY3RvcnkiLCJ0byI6ImFnZW50LTIiLCJmcm9tU2lkZSI6ImxlZnQiLCJ0b1NpZGUiOiJsZWZ0Iiwia2luZCI6ImRhc2hlZCJ9LHsiZnJvbSI6ImFnZW50LTIiLCJ0byI6InZhdWx0IiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImxlZnQifSx7ImZyb20iOiJhZ2VudC0xIiwidG8iOiJ2YXVsdCIsImZyb21TaWRlIjoicmlnaHQiLCJ0b1NpZGUiOiJsZWZ0IiwibGFiZWwiOiJVcGxvYWQifSx7ImZyb20iOiJ2YXVsdCIsInRvIjoibW9uZ29kYiIsImZyb21TaWRlIjoidG9wIiwidG9TaWRlIjoibGVmdCJ9LHsiZnJvbSI6InZhdWx0IiwidG8iOiJzdG9yYWdlIiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImxlZnQifSx7ImZyb20iOiJ2YXVsdCIsInRvIjoiYnJva2VyIiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImxlZnQiLCJsYWJlbCI6IkV2ZW50cyJ9LHsiZnJvbSI6ImJyb2tlciIsInRvIjoiaW50ZWdyYXRpb24iLCJmcm9tU2lkZSI6ImxlZnQiLCJ0b1NpZGUiOiJyaWdodCIsImxhYmVsIjoiQ29uc3VtZSJ9XX0=
+[draw-deployment-managed]: https://draw.uug.ai/#diagram=eyJncm91cHMiOlt7ImlkIjoiZWRnZSIsImxhYmVsIjoiUHJpdmF0ZSBlZGdlIHNpdGVzIC0gb3V0Ym91bmQgdXBsb2FkcyIsIngiOjAsInkiOjIwLCJ3Ijo1MDAsImgiOjc2MH0seyJpZCI6ImNsb3VkIiwibGFiZWwiOiJDbG91ZCAtIG1hbmFnZWQgS3ViZXJuZXRlcyBhbmQgYmFja2luZyBzZXJ2aWNlcyIsIngiOjYyMCwieSI6MjAsInciOjcwMCwiaCI6NzYwfV0sIm5vZGVzIjpbeyJpZCI6ImNhbWVyYS0xIiwia2luZCI6ImNhbWVyYSIsIngiOjMwLCJ5IjoxNzAsInciOjE4MCwiaCI6MTQwLCJoZWFkZXIiOiJTSVRFIEEiLCJ0aXRsZSI6IkNhbWVyYXMiLCJzdWJ0aXRsZSI6IlByaXZhdGUgbmV0d29yayJ9LHsiaWQiOiJjYW1lcmEtMiIsImtpbmQiOiJjYW1lcmEiLCJ4IjozMCwieSI6NTMwLCJ3IjoxODAsImgiOjE0MCwiaGVhZGVyIjoiU0lURSBCIiwidGl0bGUiOiJDYW1lcmFzIiwic3VidGl0bGUiOiJQcml2YXRlIG5ldHdvcmsifSx7ImlkIjoiYWdlbnQtMSIsImtpbmQiOiJhZ2VudCIsIngiOjI3MCwieSI6MTcwLCJ3IjoyMDAsImgiOjE0MCwiaGVhZGVyIjoiUkVDT1JEIiwidGl0bGUiOiJBZ2VudHMiLCJzdWJ0aXRsZSI6Ik9uZSBwZXIgY2FtZXJhIn0seyJpZCI6ImFnZW50LTIiLCJraW5kIjoiYWdlbnQiLCJ4IjoyNzAsInkiOjUzMCwidyI6MjAwLCJoIjoxNDAsImhlYWRlciI6IlJFQ09SRCIsInRpdGxlIjoiQWdlbnRzIiwic3VidGl0bGUiOiJPbmUgcGVyIGNhbWVyYSJ9LHsiaWQiOiJ2YXVsdCIsImtpbmQiOiJ2YXVsdCIsIngiOjY1MCwieSI6MTcwLCJ3IjoyMzAsImgiOjE0MCwiaGVhZGVyIjoiU1RPUkUiLCJ0aXRsZSI6IlZhdWx0Iiwic3VidGl0bGUiOiJSZWNlaXZlIHJlY29yZGluZ3MifSx7ImlkIjoic3RvcmFnZSIsImtpbmQiOiJzdG9yYWdlIiwieCI6MTA0MCwieSI6MTcwLCJ3IjoyNTAsImgiOjE0MCwiaGVhZGVyIjoiUkVDT1JESU5HUyIsInRpdGxlIjoiT2JqZWN0IHN0b3JhZ2UiLCJzdWJ0aXRsZSI6IlMzIC8gQXp1cmUgQmxvYiAvIEdDUyJ9LHsiaWQiOiJicm9rZXIiLCJraW5kIjoiYW1xcCIsIngiOjY1MCwieSI6MzgwLCJ3IjoyMzAsImgiOjE0MCwiaGVhZGVyIjoiRVZFTlRTIiwidGl0bGUiOiJSYWJiaXRNUSIsInN1YnRpdGxlIjoiUXVldWUgcmVjb3JkaW5nIGV2ZW50cyJ9LHsiaWQiOiJtb25nb2RiIiwia2luZCI6ImRhdGFiYXNlIiwieCI6MTA0MCwieSI6MzgwLCJ3IjoyNTAsImgiOjE0MCwiaGVhZGVyIjoiTUVUQURBVEEiLCJ0aXRsZSI6Ik1vbmdvREIiLCJzdWJ0aXRsZSI6IlZhdWx0IC8gSHViIGRhdGFiYXNlcyJ9LHsiaWQiOiJodWIiLCJraW5kIjoiaHViIiwieCI6NjUwLCJ5Ijo2MDAsInciOjIzMCwiaCI6MTQwLCJoZWFkZXIiOiJBTkFMWVNFIiwidGl0bGUiOiJIdWIiLCJzdWJ0aXRsZSI6IlBpcGVsaW5lLCBBUEkgYW5kIFVJIn1dLCJjb25uZWN0aW9ucyI6W3siZnJvbSI6ImNhbWVyYS0xIiwidG8iOiJhZ2VudC0xIiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImxlZnQifSx7ImZyb20iOiJjYW1lcmEtMiIsInRvIjoiYWdlbnQtMiIsImZyb21TaWRlIjoicmlnaHQiLCJ0b1NpZGUiOiJsZWZ0In0seyJmcm9tIjoiYWdlbnQtMiIsInRvIjoidmF1bHQiLCJmcm9tU2lkZSI6InJpZ2h0IiwidG9TaWRlIjoibGVmdCJ9LHsiZnJvbSI6ImFnZW50LTEiLCJ0byI6InZhdWx0IiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImxlZnQiLCJsYWJlbCI6IkhUVFBTIHVwbG9hZCJ9LHsiZnJvbSI6InZhdWx0IiwidG8iOiJtb25nb2RiIiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImxlZnQifSx7ImZyb20iOiJ2YXVsdCIsInRvIjoic3RvcmFnZSIsImZyb21TaWRlIjoicmlnaHQiLCJ0b1NpZGUiOiJsZWZ0IiwibGFiZWwiOiJSZWNvcmRpbmdzIn0seyJmcm9tIjoidmF1bHQiLCJ0byI6ImJyb2tlciIsImZyb21TaWRlIjoiYm90dG9tIiwidG9TaWRlIjoidG9wIiwibGFiZWwiOiJFdmVudHMifSx7ImZyb20iOiJicm9rZXIiLCJ0byI6Imh1YiIsImZyb21TaWRlIjoiYm90dG9tIiwidG9TaWRlIjoidG9wIiwibGFiZWwiOiJQcm9jZXNzIn0seyJmcm9tIjoiaHViIiwidG8iOiJtb25nb2RiIiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImJvdHRvbSJ9XX0=
+<!-- END GENERATED DRAW LINKS -->
@@ -71,7 +71,7 @@ For more detailed instructions and troubleshooting, please refer to the official

 ## Dependencies

-Before installing, several dependencies are required for storage, such as a database (e.g., MongoDB) and a message broker (e.g., RabbitMQ) for asynchronous behavior. We will install these components before setting up the Agents and Kerberos Vault.
+Before installing, several dependencies are required for storage, such as a database (e.g., MongoDB) and a message broker (e.g., RabbitMQ) for asynchronous behavior. We will install these components before setting up the Agents and Vault.

 One of the key advantages of MicroK8s is its out-of-the-box addons, which can be enabled with a single command. This eliminates the need for complex Helm charts or operators, simplifying the setup process. We will enable some common services, such as DNS, GPU support, and storage, to streamline the installation.

@@ -204,7 +204,7 @@ To access the application, open your browser and navigate to `localhost:8080`. U

 ### Database: MongoDB

-When using Vault, it will persist references to the recordings stored in your storage provider in a MongoDB database. As used before, we are using `helm` to install MongoDB in our Kubernetes cluster. Within the Kerberos Vault project we are using the latest official mongodb driver, so we support all major MongoDB versions (4.x, 5.x, 6.x, 7.x).
+When using Vault, it will persist references to the recordings stored in your storage provider in a MongoDB database. As used before, we are using `helm` to install MongoDB in our Kubernetes cluster. Within the Vault project we are using the latest official mongodb driver, so we support all major MongoDB versions (4.x, 5.x, 6.x, 7.x).

 Have a look into the `./mongodb-values.yaml` file, you will find plenty of configurations for the MongoDB helm chart. To change the username and password of the MongoDB instance, go ahead and [find the attribute where](https://github.com/kerberos-io/vault/blob/master/kubernetes/mongodb/values.yaml#L148) you can change the root password. Please note that we are using the official [Bitnami Mongodb helm chart](https://github.com/bitnami/charts/tree/main/bitnami/mongodb), so please use their repository for more indepth configuration.

@@ -431,7 +431,7 @@ kubectl apply -f kerberos-hub-create-database-job.yaml  -n kerberos-hub

 ## Cleanup

-If you consider to remove the Kerberos.io stack you might just disable the microk8s installation
+If you consider to remove the ecosystem you might just disable the microk8s installation

 ```bash
 microk8s reset
@@ -0,0 +1,37 @@
+{
+  "groups": [
+    { "id": "edge", "label": "Private edge sites - outbound uploads", "x": 0, "y": 20, "w": 500, "h": 760 },
+    { "id": "cloud", "label": "Cloud - managed Kubernetes and backing services", "x": 620, "y": 20, "w": 700, "h": 760 }
+  ],
+  "nodes": [
+    { "id": "camera-1", "kind": "camera", "x": 30, "y": 170, "w": 180, "h": 140,
+      "header": "SITE A", "title": "Cameras", "subtitle": "Private network" },
+    { "id": "camera-2", "kind": "camera", "x": 30, "y": 530, "w": 180, "h": 140,
+      "header": "SITE B", "title": "Cameras", "subtitle": "Private network" },
+    { "id": "agent-1", "kind": "agent", "x": 270, "y": 170, "w": 200, "h": 140,
+      "header": "RECORD", "title": "Agents", "subtitle": "One per camera" },
+    { "id": "agent-2", "kind": "agent", "x": 270, "y": 530, "w": 200, "h": 140,
+      "header": "RECORD", "title": "Agents", "subtitle": "One per camera" },
+    { "id": "vault", "kind": "vault", "x": 650, "y": 170, "w": 230, "h": 140,
+      "header": "STORE", "title": "Vault", "subtitle": "Receive recordings" },
+    { "id": "storage", "kind": "storage", "x": 1040, "y": 170, "w": 250, "h": 140,
+      "header": "RECORDINGS", "title": "Object storage", "subtitle": "S3 / Azure Blob / GCS" },
+    { "id": "broker", "kind": "amqp", "x": 650, "y": 380, "w": 230, "h": 140,
+      "header": "EVENTS", "title": "RabbitMQ", "subtitle": "Queue recording events" },
+    { "id": "mongodb", "kind": "database", "x": 1040, "y": 380, "w": 250, "h": 140,
+      "header": "METADATA", "title": "MongoDB", "subtitle": "Vault / Hub databases" },
+    { "id": "hub", "kind": "hub", "x": 650, "y": 600, "w": 230, "h": 140,
+      "header": "ANALYSE", "title": "Hub", "subtitle": "Pipeline, API and UI" }
+  ],
+  "connections": [
+    { "from": "camera-1", "to": "agent-1", "fromSide": "right", "toSide": "left" },
+    { "from": "camera-2", "to": "agent-2", "fromSide": "right", "toSide": "left" },
+    { "from": "agent-2", "to": "vault", "fromSide": "right", "toSide": "left" },
+    { "from": "agent-1", "to": "vault", "fromSide": "right", "toSide": "left", "label": "HTTPS upload" },
+    { "from": "vault", "to": "mongodb", "fromSide": "right", "toSide": "left" },
+    { "from": "vault", "to": "storage", "fromSide": "right", "toSide": "left", "label": "Recordings" },
+    { "from": "vault", "to": "broker", "fromSide": "bottom", "toSide": "top", "label": "Events" },
+    { "from": "broker", "to": "hub", "fromSide": "bottom", "toSide": "top", "label": "Process" },
+    { "from": "hub", "to": "mongodb", "fromSide": "right", "toSide": "bottom" }
+  ]
+}
@@ -0,0 +1,39 @@
+{
+  "groups": [
+    { "id": "edge", "label": "Private edge network - Docker / Kubernetes", "x": 0, "y": 20, "w": 1240, "h": 680 }
+  ],
+  "nodes": [
+    { "id": "camera-1", "kind": "camera", "x": 30, "y": 280, "w": 180, "h": 140,
+      "header": "CAMERA", "title": "Camera 1", "subtitle": "RTSP stream" },
+    { "id": "camera-2", "kind": "camera", "x": 30, "y": 510, "w": 180, "h": 140,
+      "header": "CAMERA", "title": "Camera 2", "subtitle": "RTSP stream" },
+    { "id": "factory", "kind": "factory", "x": 280, "y": 80, "w": 220, "h": 140,
+      "header": "OPTIONAL ORCHESTRATION", "title": "Factory", "subtitle": "Manage on Kubernetes" },
+    { "id": "agent-1", "kind": "agent", "x": 280, "y": 280, "w": 220, "h": 140,
+      "header": "RECORD", "title": "Agent 1", "subtitle": "One camera per container" },
+    { "id": "agent-2", "kind": "agent", "x": 280, "y": 510, "w": 220, "h": 140,
+      "header": "RECORD", "title": "Agent 2", "subtitle": "One camera per container" },
+    { "id": "vault", "kind": "vault", "x": 620, "y": 280, "w": 230, "h": 140,
+      "header": "STORE", "title": "Vault", "subtitle": "Centralise edge recordings" },
+    { "id": "mongodb", "kind": "database", "x": 970, "y": 80, "w": 240, "h": 140,
+      "header": "METADATA", "title": "MongoDB", "subtitle": "Vault metadata" },
+    { "id": "storage", "kind": "storage", "x": 970, "y": 280, "w": 240, "h": 140,
+      "header": "RECORDINGS", "title": "Object storage", "subtitle": "MinIO / S3-compatible" },
+    { "id": "broker", "kind": "amqp", "x": 970, "y": 510, "w": 240, "h": 140,
+      "header": "OPTIONAL EVENTS", "title": "RabbitMQ", "subtitle": "Recording events" },
+    { "id": "integration", "kind": "default", "x": 620, "y": 510, "w": 230, "h": 140,
+      "header": "OPTIONAL INTEGRATION", "title": "Custom application", "subtitle": "Filter, notify or integrate" }
+  ],
+  "connections": [
+    { "from": "camera-1", "to": "agent-1", "fromSide": "right", "toSide": "left", "label": "RTSP" },
+    { "from": "camera-2", "to": "agent-2", "fromSide": "right", "toSide": "left", "label": "RTSP" },
+    { "from": "factory", "to": "agent-1", "fromSide": "bottom", "toSide": "top", "kind": "dashed" },
+    { "from": "factory", "to": "agent-2", "fromSide": "left", "toSide": "left", "kind": "dashed" },
+    { "from": "agent-2", "to": "vault", "fromSide": "right", "toSide": "left" },
+    { "from": "agent-1", "to": "vault", "fromSide": "right", "toSide": "left", "label": "Upload" },
+    { "from": "vault", "to": "mongodb", "fromSide": "top", "toSide": "left" },
+    { "from": "vault", "to": "storage", "fromSide": "right", "toSide": "left" },
+    { "from": "vault", "to": "broker", "fromSide": "right", "toSide": "left", "label": "Events" },
+    { "from": "broker", "to": "integration", "fromSide": "left", "toSide": "right", "label": "Consume" }
+  ]
+}
@@ -0,0 +1,35 @@
+{
+  "groups": [
+    { "id": "capture", "label": "1. Camera processing - edge / cloud", "x": 0, "y": 20, "w": 540, "h": 520 },
+    { "id": "persistence", "label": "2. Persistence - edge / cloud", "x": 620, "y": 20, "w": 300, "h": 520 },
+    { "id": "analysis", "label": "3. Analyse - edge / cloud", "x": 1000, "y": 20, "w": 300, "h": 520 }
+  ],
+  "nodes": [
+    { "id": "camera-1", "kind": "camera", "x": 30, "y": 230, "w": 180, "h": 140,
+      "header": "CAMERA", "title": "Camera 1", "subtitle": "RTSP stream" },
+    { "id": "camera-2", "kind": "camera", "x": 30, "y": 390, "w": 180, "h": 140,
+      "header": "CAMERA", "title": "Camera 2", "subtitle": "RTSP stream" },
+    { "id": "factory", "kind": "factory", "x": 280, "y": 60, "w": 230, "h": 140,
+      "header": "ORCHESTRATE", "title": "Factory", "subtitle": "Manage on Kubernetes" },
+    { "id": "agent-1", "kind": "agent", "x": 280, "y": 230, "w": 230, "h": 140,
+      "header": "RECORD", "title": "Agent 1", "subtitle": "Process one camera" },
+    { "id": "agent-2", "kind": "agent", "x": 280, "y": 390, "w": 230, "h": 140,
+      "header": "RECORD", "title": "Agent 2", "subtitle": "Process one camera" },
+    { "id": "vault", "kind": "vault", "x": 650, "y": 230, "w": 240, "h": 140,
+      "header": "STORE", "title": "Vault", "subtitle": "Store and integrate" },
+    { "id": "storage", "kind": "storage", "x": 650, "y": 390, "w": 240, "h": 140,
+      "header": "OBJECT STORAGE", "title": "Storage backend", "subtitle": "Cloud / edge" },
+    { "id": "hub", "kind": "hub", "x": 1030, "y": 230, "w": 240, "h": 140,
+      "header": "ANALYSE", "title": "Hub", "subtitle": "Monitor and analyse" }
+  ],
+  "connections": [
+    { "from": "camera-1", "to": "agent-1", "fromSide": "right", "toSide": "left" },
+    { "from": "camera-2", "to": "agent-2", "fromSide": "right", "toSide": "left" },
+    { "from": "factory", "to": "agent-1", "fromSide": "bottom", "toSide": "top", "kind": "dashed" },
+    { "from": "factory", "to": "agent-2", "fromSide": "right", "toSide": "right", "kind": "dashed" },
+    { "from": "agent-1", "to": "vault", "fromSide": "right", "toSide": "left" },
+    { "from": "agent-2", "to": "vault", "fromSide": "right", "toSide": "left" },
+    { "from": "vault", "to": "storage", "fromSide": "bottom", "toSide": "top" },
+    { "from": "vault", "to": "hub", "fromSide": "right", "toSide": "left", "label": "Events" }
+  ]
+}
@@ -15,7 +15,7 @@ deploy, configure and observe Agents (one Deployment + Service per camera).

 | File | Kind | Purpose |
 | ---- | ---- | ------- |
-| [`kerberos-factory-deployment.yaml`](./kerberos-factory-deployment.yaml) | `Deployment` | The Factory web app/API (`uugai/factory`), container port `80`. |
+| [`kerberos-factory-deployment.yaml`](./kerberos-factory-deployment.yaml) | `Deployment` | Hardened `ghcr.io/uug-ai/factory:v2.0.13`, pinned to its verified multi-architecture digest, container port `8080`. |
 | [`kerberos-factory-service.yaml`](./kerberos-factory-service.yaml) | `Service` | Exposes Factory on `NodePort` **30079** (a `LoadBalancer` variant is included, commented out). |
 | [`kerberos-factory-clusterrole.yaml`](./kerberos-factory-clusterrole.yaml) | `ClusterRole` + `ClusterRoleBinding` | Grants the `default` ServiceAccount in `kerberos-factory` the API access Factory needs to manage Agents. |

@@ -50,7 +50,47 @@ Other relevant environment variables:
 | `KERBEROS_AGENT_IMAGE` | `kerberos/agent:latest` | Image used when Factory creates an Agent. |
 | `KERBEROS_AGENT_MEMORY_LIMIT` | `256Mi` | Default memory limit for created Agents. |
 | `NAMESPACE` | `kerberos-factory` | Namespace Factory schedules Agents into. |
-| `K8S_PROXY` | `http://localhost:80` | Internal proxy address Factory calls for the `/kubernetes` API. |
+| `PORT` | `8080` | Unprivileged HTTP listener used by the hardened image. |
+| `K8S_PROXY` | `http://localhost:8080` | Internal proxy address Factory calls for the `/kubernetes` API. |
+
+## Hardened runtime and upgrades
+
+The image runs as UID/GID `65532:65532`, with a read-only root filesystem,
+all Linux capabilities dropped, privilege escalation disabled and the
+`RuntimeDefault` seccomp profile. The UI login named `root` is independent
+of the container's operating-system user.
+
+Two disk-backed `emptyDir` volumes are writable:
+
+- `/home/factory/config` receives missing seed configuration files.
+- `/tmp` is scratch space, including multipart uploads.
+
+The pod's `fsGroup: 65532` makes these volumes writable without a root
+init container. They survive a container restart but are replaced with the
+pod. In this base's `configmap` mode, the global configuration is restored
+from the existing Kubernetes ConfigMap on startup; existing global/template
+ConfigMaps are not overwritten by image defaults. Keep the existing
+ServiceAccount token and RBAC: Factory manages Agents through the Kubernetes
+API even though its process is non-root.
+
+Apply the Deployment and Service together when upgrading from a legacy
+port-80 image. The external Service port `80` and NodePort `30079` are unchanged;
+the Service now targets the named `http` port on container port `8080`.
+Startup, readiness and liveness probes use `/healthz`; this endpoint checks
+the HTTP process, not all downstream Kubernetes dependencies.
+
+Back up any legacy configuration stored only in the old container before
+replacing its pod. For `FACTORY_CONFIGURATION=json`, replace the config
+`emptyDir` with a writable PVC and preserve its existing JSON files before
+upgrading. A PVC must support access by UID/GID `65532`; storage backends that
+do not honor `fsGroup` need matching permissions provisioned separately.
+
+CI upgrades the last legacy release (`v2.0.11`) to these actual base manifests
+on kind. It checks the restricted runtime, Service routing, UI/login,
+ConfigMap bootstrap, saving settings and persistence after pod replacement.
+The [smoke test](../../scripts/check-factory.sh) changes settings and restarts
+Factory, so it refuses non-CI invocation and is intended only for disposable
+test clusters.

 ## Prerequisites

@@ -122,7 +162,8 @@ supports other stores via `FACTORY_CONFIGURATION`:
 - `configmap` *(default here)* — config in ConfigMaps, no MongoDB.
 - `secret` — same as `configmap` but sensitive values are kept in Kubernetes Secrets
  (add `secrets` to the ClusterRole resources for this mode).
- `json` — config in local JSON files on the pod, no MongoDB.
+- `json` — config in local JSON files, no MongoDB. Use a PVC at
+  `/home/factory/config`; the default `emptyDir` is not durable across pods.
 - `mongodb` — legacy behaviour: Factory and Agents read config from MongoDB. For this
  you also need a reachable MongoDB and the corresponding `MONGODB_*` environment
  variables (e.g. via a `mongodb` ConfigMap mounted with `envFrom`).
@@ -18,9 +18,21 @@ spec:
      labels:
        app: factory
    spec:
+      securityContext:
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
      containers:
      - name: factory
-        image: ghcr.io/uug-ai/factory:v2.0.4
+        image: ghcr.io/uug-ai/factory:v2.0.13@sha256:ade073660d911ca66d75b2abc298f1ddcbfbfe43aeed44e60fc1984b49b73d95
+        securityContext:
+          runAsNonRoot: true
+          runAsUser: 65532
+          runAsGroup: 65532
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
        resources:
          requests:
            memory: 128Mi
@@ -29,8 +41,36 @@ spec:
            memory: 128Mi
            cpu: 100m
        ports:
-          - containerPort: 80
+          - name: http
+            containerPort: 8080
+            protocol: TCP
+        startupProbe:
+          httpGet:
+            path: /healthz
+            port: http
+          failureThreshold: 30
+          periodSeconds: 2
+          timeoutSeconds: 2
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+          periodSeconds: 5
+          timeoutSeconds: 2
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+          periodSeconds: 10
+          timeoutSeconds: 2
+        volumeMounts:
+          - name: factory-config
+            mountPath: /home/factory/config
+          - name: factory-tmp
+            mountPath: /tmp
        env:
+        - name: PORT
+          value: "8080"
        - name: GIN_MODE
          value: release
        - name: KERBEROS_LOGIN_USERNAME
@@ -55,5 +95,9 @@ spec:
        - name: FACTORY_ENVIRONMENT
          value: "kubernetes"
        - name: K8S_PROXY
-          value: http://localhost:80
-
+          value: http://localhost:8080
+      volumes:
+        - name: factory-config
+          emptyDir: {}
+        - name: factory-tmp
+          emptyDir: {}
@@ -10,7 +10,7 @@ spec:
  type: NodePort
  ports:
    - port: 80
-      targetPort: 80
+      targetPort: http
      nodePort: 30079 # You can specify a port in the range 30000-32767 or let Kubernetes assign one automatically
      name: frontend
      protocol: TCP
@@ -27,7 +27,7 @@ spec:
 #   type: LoadBalancer
 #   ports:
 #   - port: 80
-#     targetPort: 80
+#     targetPort: http
 #     name: frontend
 #     protocol: TCP
 #   selector:
@@ -3,7 +3,7 @@
 # Declare variables to be passed into your templates.

 ###########################################################################
-# LICENSING information: you will a license to run Kerberos Hub.
+# LICENSING information: you will a license to run Hub.
 # ----
 # Get your license from support@kerberos.io
 #license: "---ENTER-YOUR-LICENSE-HERE---"
@@ -11,7 +11,7 @@
 license: "L/+DAwEBB2xpY2Vuc2UB/4QAAQIBB1BheWxvYWQBCgABCVNpZ25hdHVyZQEKAAAA/gMk/4QB/gEZ/8sQACxnaXRodWIuY29tL3V1Zy1haS9odWItbGljZW5zZS9tb2RlbHMuTGljZW5zZX8DAQEHTGljZW5zZQH/gAABDAECSWQB/4IAAQNLZXkBDAABB0NvbXBhbnkBDAABB0V4cFRpbWUBBAABBERheXMBBAABB0NhbWVyYXMBBAABBVNpdGVzAQQAAQZWYXVsdHMBBAABCk1lZGlhTGltaXQBBAABCVBlcnBldHVhbAECAAEGQWN0aXZlAQIAAQlJcEFkZHJlc3MBDAAAABj/gQEBAQhPYmplY3RJRAH/ggABBgEYAAAy/4AvAQwAAAAAAAAAAAAAAAACDGZyZWUtbGljZW5zZQH81iZi6gH+AtoBEAEUARQDAQAB/gIAfeXxQb6kaPfAgOWeSAE6qEiQviFD6sciNmNfMel1mEL53FeV0GQe4cYBip9wyJag35az8A1yppxSymZD5V4my2FckyN2zmEW4E2sO/v+8eKepiAGYEzrKtfNCLxdWLmrHd0zjYQ3qk+PNfoPyzCOefeulw3aFsqBlzg9wDkF8cRx6tUW0qNTzki6sFGOuLoxS49cWqsftAvZmt+CRWa8u0VArIAjOpywN0RIZCkEYzp5RYF3LSVyWYEyvVhjE19DDnevzpJyCHRsIHTRcpTQkhboeapOdlEz8cx+PaOvxktN8hBWceTAH+nw96FARG7y6Cpjw3xo+NV1xb0tvRXGaGoK77JnErKLhd/haXji98rGvMakDt18WSbQfTVS84+Fw+/gKGsW3uS3fROAaZw1kZj4PgsEPZDvbVkCVyuS0O87UoYqpxH8S4by8cTF3wDP7FwyIRZbEbYjN2wzHSmlADYOBtdsdb1VGm7wvtB85vML9n7ZSlIpJdqfci06mGks102mDyG2LRMhUEvpUW3D/weErIvj2WiAwf6r0EUj+LO8VmAsYkME9da7FXEN6Vg/5f1u485LOpYki332RaDOhDn2eMG9DVb/HnmQSFagX+XXc/QwfsWiehCgKYGk4jQpyklTqoGu8BAt6Sm8CaoH8ngZ3cHLQT5DcZElV36/N/wA"
 licenseServer:
  url: "https://license.kerberos.io/verify"
-  token: "214%ˆ#ddfsf@#3rfdsgl_)23sffeqasSwefDSFNBM" # do not change otherwise Kerberos Hub will not work.
+  token: "214%ˆ#ddfsf@#3rfdsgl_)23sffeqasSwefDSFNBM" # do not change otherwise Hub will not work.
 # Private Docker Registry: The registry secret is required if you have your Docker images behind a private registry.
 # By default it will pull from Docker hub (https://hub.docker.com/r/kerberos).
 #imagePullSecrets:
@@ -26,7 +26,7 @@ environment: "production"
 # Set to 'true' if this is a private deployment.
 isPrivate: true
 # If you plan a migration or doing maintenance, you can enable readonly.
-# This will stop any write process to mongodb or any processing done in the Kerberos Hub pipeline.
+# This will stop any write process to mongodb or any processing done in the Hub pipeline.
 readOnly: false
 # Which network ingress you are using in your Kubernetes Cluster
 # Leaving the ingress empty will disable the ingress.
@@ -42,10 +42,10 @@ mongodb:
  username: "root"
  password: "yourpassword"
 # A MQTT broker (vernemq or other like mosquitto) is used to have a bi-directional
-# communication between Agents and Kerberos Hub.
+# communication between Agents and Hub.
 # we recommend to use vernemq (as part of this installation), but a stand-alone mosquitto broker is also possible.
 mqtt:
-  host: "mqtt.yourdomain.com" # this needs to be a public accessible DNS name (it's used to communicate between Agents and Kerberos Hub)
+  host: "mqtt.yourdomain.com" # this needs to be a public accessible DNS name (it's used to communicate between Agents and Hub)
  port: "31443"
  protocol: "wss"
  username: "yourusername"
@@ -85,8 +85,8 @@ turn:
 openai:
  enabled: false
  apikey: "xxx"
-# We have a kerberos vault component installed which contains all the
-# recordings. Kerberos vault is queried to retrieve the recordings
+# We have a Vault component installed which contains all the
+# recordings. Vault is queried to retrieve the recordings
 # from the appropriate provider.

 kerberosvault:
@@ -124,23 +124,23 @@ email:
    password: "yourpassword"
  templates:
    welcome: "welcome"
-    welcomeTitle: "Welcome to Kerberos Hub"
+    welcomeTitle: "Welcome to Hub"
    activate: "activate"
-    activateTitle: "Wonderful! Your Kerberos Hub is now active"
+    activateTitle: "Wonderful! Your Hub is now active"
    forgot: "forgot"
-    forgotTitle: "Password reset Kerberos Hub. You forgot your password"
+    forgotTitle: "Password reset Hub. You forgot your password"
    share: "share"
-    shareTitle: "[Action] You received a recording from Kerberos Hub"
+    shareTitle: "[Action] You received a recording from Hub"
    caseShare: "share_case"
-    caseShareTitle: "[Action] A case has been shared with you on Kerberos Hub"
+    caseShareTitle: "[Action] A case has been shared with you on Hub"
    detection: "detection"
    disabled: "disabled"
    highupload: "highupload"
    device: "device"
-    alertTitle: "[Alert] Kerberos Hub detected something an event"
+    alertTitle: "[Alert] Hub detected something an event"
    deviceTitle: "[Device] An Agent's status has been changed"
 # Following are all the different deployments needed to make
-# Kerberos hub properly working.
+# Hub properly working.
 kerberoshub:
  admin:
    repository: uugai/admin
@@ -184,8 +184,8 @@ kerberoshub:
    #legacyUrl: "api.legacy.yourdomain.com"

    # MFA issuer name
-    mfaIssuer: "Kerberos.io"
-    # Admin API's are made available for automation of Kerberos Hub.
+    mfaIssuer: "Hub"
+    # Admin API's are made available for automation of Hub.
    # To access those API's (e.g. creation of owner users), an API key needs to be provided.
    apiKey: "Z6GPfDdYj8mxLyy6iUJVf9yBlri9lhsW"
    ## Certificates
@@ -201,20 +201,20 @@ kerberoshub:
    #    secretName: kerberoshub-admin
    language: "english"
    fallbackLanguage: "english"
-    # Legacy (reseller) it is possible to link to AWS S3 and IAM (however Kerberos Vault is now the recommended option).
-    # This is primarily used for creation of subscriptions, and not needed if you are using mainly Kerberos Vault.
+    # Legacy (reseller) it is possible to link to AWS S3 and IAM (however Vault is now the recommended option).
+    # This is primarily used for creation of subscriptions, and not needed if you are using mainly Vault.
    aws:
      region: "xxx"
      bucket: "xxx"
      accessKey: "xxx"
      secretKey: "xxx"
-    stripe: # We use stripe for billing, so it's possible to resell Kerberos Hub if agreed.
+    stripe: # We use stripe for billing, so it's possible to resell Hub if agreed.
      privateKey: "xxx"
    slack: # Slack is used in the api, to send logs to a specific Slack channel.
      enabled: "true"
      hook: "yourslackhook" # https://hooks.slack.com/services/T08Q2Q9V5/xxKT/JALxxAk26bHtuqTfZ
-      username: "Kerberos Hub" # The slack username
-    elasticsearch: # Logs of the kerberos hub will be send to an elastic search cluster.
+      username: "Hub" # The slack username
+    elasticsearch: # Logs of the Hub will be send to an elastic search cluster.
      enabled: "false"
      protocol: "http"
      host: "yourelasticsearchinstance.com"
@@ -277,7 +277,7 @@ kerberoshub:
      apikey: "xxx"
    sentry: # We can trace errors in Sentry
      url: "https://xxx@sentry.io/xxx"
-    stripe: # We use stripe for billing, so it's possible to resell Kerberos Hub if agreed.
+    stripe: # We use stripe for billing, so it's possible to resell Hub if agreed.
      publicKey: ""
    googlemaps: # Google maps is used inside the application to visualise cameras and sites.
      apikey: "xxxx"
@@ -290,15 +290,15 @@ kerberoshub:
    # in a white-label setup, or where you are managing the Agents for your customers.
    hideAddAgent: "true"
    # Multi tenancy (domains)
-    # By default the Kerberos Hub allows multi-tenancy through the concept
+    # By default the Hub allows multi-tenancy through the concept
    # of accounts and subaccounts. However through the concept of domains, you
    # take it a step further. Within a domain, user accounts are unique, and are prefixed by a (domain\).
    #multiTenant: true
    #tenantBaseDomain: "yourdomain.com" # this would resolve in following sub domain "https://domain.kerberos.io"

    # Page title (browser)
-    title: "Kerberos Hub - Video surveillance as it should be"
-    # You can style Kerberos hub as you wish.
+    title: "Hub - Video surveillance as it should be"
+    # You can style Hub as you wish.
    # 1. we do the styling on our side and bake it in the Docker image (change the logo attribute to your company name)
    # 2. you bring your own logo (set logo to 'custom'), and mount the css file and favicons.
    # we will need to include your logo in the Docker image, so please reach out to us.
@@ -314,7 +314,7 @@ kerberoshub:
    #    persistentVolumeClaim:
    #      claimName: custom-layout-claim
    # By specifying the below environments variables, you can tweak the
-    # headings and paragraphs of Kerberos Hub front-end.
+    # headings and paragraphs of Hub front-end.
    # Login page
    loginDescription: ""
    loginCopyright: ""
@@ -537,7 +537,7 @@ kerberospipeline:
    width: "600"
    height: "-1"
    kerberosvault:
-      enabled: true # If you want to use Kerberos Vault to store the thumbnails
+      enabled: true # If you want to use Vault to store the thumbnails
    resources:
      requests:
        memory: 50Mi
@@ -3,7 +3,7 @@
 # Vault base manifests

 This directory holds the raw Kubernetes manifests for **Vault**. Vault receives
-recordings from Kerberos Agents, stores recording metadata in MongoDB, and sends
+recordings from Agents, stores recording metadata in MongoDB, and sends
 recording bytes to storage providers configured through the Vault UI.

 > **Scope of this README.** At the top level of this repository Vault is normally
@@ -28,6 +28,85 @@ recording bytes to storage providers configured through the Vault UI.
 The matching `kerberos-vault` namespace is defined in
 [`../namespaces/kerberos-vault.yaml`](../namespaces/kerberos-vault.yaml).

+## Hardened Vault image
+
+Both deployment variants use the hardened Vault image
+`ghcr.io/uug-ai/vault:v1.7.19`. The Vault container runs as non-root UID/GID
+`65532`, drops Linux capabilities, disables privilege escalation, uses the
+`RuntimeDefault` seccomp profile, and has a read-only root filesystem.
+
+The image listens on container port `8080`. The Service keeps its existing
+port `80` and NodePort `30080`, forwarding to the named `http` container port.
+Startup, readiness, and liveness probes use `/api/health`.
+
+The image uses `/run/vault` for temporary upload/finalization files. Each
+Deployment mounts a writable, disk-backed `emptyDir` there, limited to `1Gi`;
+the pod `fsGroup` grants the non-root Vault process access. Size this scratch
+limit for expected concurrent uploads and available node ephemeral storage.
+
+### Size the writable scratch volume
+
+There is no one-size-fits-all volume size: estimate how many full recordings
+Vault may be writing to scratch at the same time, and the maximum size of each.
+
+- A regular HTTP upload is spooled to a temporary file. The default
+  `VAULT_MAX_PUBLISH_FILE_BYTES` limit is **1 GiB per upload**. If you change
+  this limit, use the new value in your sizing estimate.
+- Resumable tus chunks are stored in the configured object-storage provider,
+  not in this volume. When an upload is finalized, Vault downloads the completed
+  recording to a temporary file, so count concurrent **tus finalizations** and
+  their maximum recording sizes.
+- Set `TUS_MAX_SIZE_BYTES` to a positive byte limit to cap tus upload size. It is
+  unlimited when unset. For example, `1073741824` limits each tus upload to 1
+  GiB. Keep this cap within the scratch capacity you have planned.
+
+Use this conservative estimate, then round up to a convenient GiB value:
+
+```text
+scratch size >= 1.5 x (
+  concurrent HTTP uploads x maximum HTTP upload size
+  + concurrent tus finalizations x maximum tus upload size
+)
+```
+
+The `1.5` multiplier allows roughly 50% headroom. For example, allowing two
+simultaneous 1 GiB HTTP uploads and two simultaneous 1 GiB tus finalizations
+uses up to 4 GiB for those temporary files; choose a scratch limit of at least
+**6 GiB**. If you only expect two full-file operations at once in total, a
+**3 GiB** limit is a reasonable starting point. Increase it for larger files or
+more concurrent operations.
+
+To apply the 6 GiB example, set the tus cap and scratch limit in the Vault
+container and pod template of the Deployment you use. Make the same changes to
+the Secret-backed Deployment if you use that variant:
+
+```yaml
+spec:
+  template:
+    spec:
+      containers:
+        - name: vault
+          env:
+            - name: TUS_MAX_SIZE_BYTES
+              value: "1073741824"
+          volumeMounts:
+            - name: vault-tmp
+              mountPath: /run/vault
+      volumes:
+        - name: vault-tmp
+          emptyDir:
+            sizeLimit: 6Gi
+```
+
+Keep the existing `GIN_MODE` and other environment variables and the
+`vault-tmp` mount; merge these entries rather than replacing them. The disk-backed
+`emptyDir` is charged to node ephemeral storage: its `sizeLimit` is a ceiling,
+not a reservation. Make sure the node and your pod's ephemeral-storage
+requests/limits can accommodate scratch use as well as container logs and other
+temporary files. If the limit is exhausted, uploads or finalizations can fail.
+Apply the updated Deployment and check that the Vault pod becomes Ready before
+relying on the new limits.
+
 ## Prerequisites

 - A running Kubernetes cluster and `kubectl` configured to reach it.
@@ -18,13 +18,32 @@ spec:
      labels:
        app: vault
    spec:
+      securityContext:
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
      initContainers:
        - name: wait-for-mongodb-before-starup
          image: busybox
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65532
+            runAsGroup: 65532
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
          command: ["sh", "-c", "until nc -z mongodb.mongodb 27017 > /dev/null; do echo Waiting for master.; sleep 2; done;"]
      containers:
        - name: vault
-          image: ghcr.io/uug-ai/vault:v1.4.9
+          image: ghcr.io/uug-ai/vault:v1.7.19
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65532
+            runAsGroup: 65532
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
          resources:
            requests:
              memory: 128Mi
@@ -33,7 +52,33 @@ spec:
              memory: 128Mi
              cpu: 100m
          ports:
-            - containerPort: 80
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          startupProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 30
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            periodSeconds: 30
+            timeoutSeconds: 3
+            failureThreshold: 3
+          volumeMounts:
+            - name: vault-tmp
+              mountPath: /run/vault
          envFrom:
            - configMapRef:
                name: mongodb
@@ -45,3 +90,7 @@ spec:
          env:
            - name: GIN_MODE
              value: release
+      volumes:
+        - name: vault-tmp
+          emptyDir:
+            sizeLimit: 1Gi
@@ -18,13 +18,32 @@ spec:
      labels:
        app: vault
    spec:
+      securityContext:
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
      initContainers:
        - name: wait-for-mongodb-before-starup
          image: busybox
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65532
+            runAsGroup: 65532
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
          command: ["sh", "-c", "until nc -z mongodb.mongodb 27017 > /dev/null; do echo Waiting for master.; sleep 2; done;"]
      containers:
        - name: vault
          image: ghcr.io/uug-ai/vault:v1.7.19
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65532
+            runAsGroup: 65532
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
          resources:
            requests:
              memory: 128Mi
@@ -33,7 +52,33 @@ spec:
              memory: 128Mi
              cpu: 100m
          ports:
-            - containerPort: 80
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          startupProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 30
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            periodSeconds: 30
+            timeoutSeconds: 3
+            failureThreshold: 3
+          volumeMounts:
+            - name: vault-tmp
+              mountPath: /run/vault
          envFrom:
            - configMapRef:
                name: mongodb
@@ -44,3 +89,7 @@ spec:
          env:
            - name: GIN_MODE
              value: release
+      volumes:
+        - name: vault-tmp
+          emptyDir:
+            sizeLimit: 1Gi
@@ -10,7 +10,7 @@ spec:
  type: NodePort
  ports:
    - port: 80
-      targetPort: 80
+      targetPort: http
      nodePort: 30080 # You can specify a port in the range 30000-32767 or let Kubernetes assign one automatically
      name: frontend
      protocol: TCP
@@ -27,7 +27,7 @@ spec:
 #   type: LoadBalancer
 #   ports:
 #   - port: 80
-#     targetPort: 80
+#     targetPort: http
 #     name: frontend
 #     protocol: TCP
 #   selector:
@@ -1,6 +1,6 @@
 {
-    "name": "Kerberos.io",
-    "short_name": "Kerberos.io",
+    "name": "Hub",
+    "short_name": "Hub",
    "icons": [
        {
            "src": "/favicons/android-chrome-192x192.png?v=1",
@@ -7,7 +7,7 @@
 name="viewport"
 content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
 />
-<meta name="description" content="Kerberos.io Mailing">
+<meta name="description" content="Hub notifications">
 <style type="text/css">

@font-face {
@@ -150,7 +150,7 @@ margin-bottom: 36px!important;
 <tbody>
 <tr>
 <td class="corner-td" align="left"></td>
-<td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
+<td width="48" height="36" align="left"><img alt="Hub" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
 <td height="36" align="left" class="company-name-td">
 <h3  width="36" height="36" style=" font-family: Inter;
 font-size: 20px;
@@ -160,7 +160,7 @@ line-height: 24px;
 mso-line-height-rule:exactly;
 letter-spacing: 0em;
 text-align: left;
-color: #262424;">Kerberos.io</h3>
+color: #262424;">Hub</h3>
 </td>
 <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
 <a style="text-decoration: none;color: none;" href={{tab1_href}}>
@@ -260,7 +260,7 @@ mso-line-height-rule:exactly;
 letter-spacing: 0em;
 text-align: left;
 color: #6D6666;
-margin-top: 12px;">You're ready. Go ahead and <a href='{{link}}'>login to your Kerberos Hub account</a>. Start exploring the different features and functions to support your business usecases.</p>
+margin-top: 12px;">You're ready. Go ahead and <a href='{{link}}'>login to your Hub account</a>. Start exploring the different features and functions to support your business usecases.</p>
 <p style=" font-family: Inter;
 font-size: 14px;
 font-style: normal;
@@ -356,7 +356,7 @@ line-height: 36px;
 mso-line-height-rule:exactly;
 letter-spacing: 0em;
 text-align: left;
-color:#6D6666;">About Kerberos</h4>
+color:#6D6666;">About the ecosystem</h4>
 <p style=" font-family: Inter;
 font-size: 14px;
 font-style: normal;
@@ -1,13 +1,13 @@
-Kerberos.io
+Hub
 ------------

 Hey, {{user}}
-Welcome to Kerberos Hub
+Welcome to Hub
 Activate your account
 {{link}}

-Kerberos Hub in a nutshell
-With Kerberos Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.
+Hub in a nutshell
+With Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.

 However before you get started this amazing applications, please activate your account.

@@ -17,6 +17,6 @@ support@kerberos.io
 9000 Ghent, BE
 https://kerberos.io

-About Kerberos
+About the ecosystem
 ------------
 Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
@@ -1,16 +1,16 @@
 package templates

 var TEMPLATE_DETECTION_TEXT = `
-Kerberos.io
+Hub
 ------------

 Hey, {{user}}
-Welcome to Kerberos Hub
+Welcome to Hub
 Activate your account ->
 {{link}}

-Kerberos Hub in a nutshell
-With Kerberos Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.
+Hub in a nutshell
+With Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.

 However before you get started this amazing applications, please activate your account.

@@ -20,7 +20,7 @@ support@kerberos.io
 9000 Ghent, BE
 https://kerberos.io

-About Kerberos
+About the ecosystem
 ------------
 Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
 `
@@ -35,7 +35,7 @@ var TEMPLATE_DETECTION = `
            name="viewport"
            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
    />
-    <meta name="description" content="Kerberos.io Mailing">
+    <meta name="description" content="Hub notifications">
    <style type="text/css">

        @font-face {
@@ -178,7 +178,7 @@ var TEMPLATE_DETECTION = `
                <tbody>
                <tr>
                    <td class="corner-td" align="left"></td>
-                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
+                    <td width="48" height="36" align="left"><img alt="Hub" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
                    <td height="36" align="left" class="company-name-td">
                        <h3  width="36" height="36" style=" font-family: Inter;
                                        font-size: 20px;
@@ -188,7 +188,7 @@ var TEMPLATE_DETECTION = `
                                        mso-line-height-rule:exactly;
                                        letter-spacing: 0em;
                                        text-align: left;
-                                        color: #262424;">Kerberos.io</h3>
+                                        color: #262424;">Hub</h3>
                    </td>
                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
@@ -304,7 +304,7 @@ var TEMPLATE_DETECTION = `
                                        text-align: left;
                                        color: #6D6666;
                                        margin-top: 12px;">An alert was send to your e-mail as one of the conditions was triggered for your device <b>{{devicename}}</b>. Please watch the recording, by clicking on below button. 
-If you believe this event is a false positive, go to your Kerberos Hub account and change the alert settings accordingly.</p>
+If you believe this event is a false positive, go to your Hub account and change the alert settings accordingly.</p>


                        <p style=" font-family: Inter;
@@ -426,7 +426,7 @@ If you believe this event is a false positive, go to your Kerberos Hub account a
                                                        mso-line-height-rule:exactly;
                                                        letter-spacing: 0em;
                                                        text-align: left;
-                                                        color:#6D6666;">About Kerberos</h4>
+                                                        color:#6D6666;">About the ecosystem</h4>
                                    <p style=" font-family: Inter;
                                                        font-size: 14px;
                                                        font-style: normal;
@@ -1,13 +1,13 @@
-Kerberos.io
+Hub
 ------------

 Hey, {{user}}
-Welcome to Kerberos Hub
+Welcome to Hub
 Activate your account ->
 {{link}}

-Kerberos Hub in a nutshell
-With Kerberos Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.
+Hub in a nutshell
+With Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.

 However before you get started this amazing applications, please activate your account.

@@ -17,6 +17,6 @@ support@kerberos.io
 9000 Ghent, BE
 https://kerberos.io

-About Kerberos
+About the ecosystem
 ------------
 Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
@@ -7,7 +7,7 @@
            name="viewport"
            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
    />
-    <meta name="description" content="Kerberos.io Mailing">
+    <meta name="description" content="Hub notifications">
    <style type="text/css">

        @font-face {
@@ -150,7 +150,7 @@
                <tbody>
                <tr>
                    <td class="corner-td" align="left"></td>
-                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
+                    <td width="48" height="36" align="left"><img alt="Hub" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
                    <td height="36" align="left" class="company-name-td">
                        <h3  width="36" height="36" style=" font-family: Inter;
                                        font-size: 20px;
@@ -160,7 +160,7 @@
                                        mso-line-height-rule:exactly;
                                        letter-spacing: 0em;
                                        text-align: left;
-                                        color: #262424;">Kerberos.io</h3>
+                                        color: #262424;">Hub</h3>
                    </td>
                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
@@ -276,7 +276,7 @@
                                        text-align: left;
                                        color: #6D6666;
                                        margin-top: 12px;">Agents go offline due to a variety of reasons. The machine, node, micro controller on which your Agent runs, gets corrupted or disconnected from the internet.
-The camera itself is broken, damaged or in the worst case tampered. Have a look into your Kerberos Hub account for the latest recordings and/or verify the connection and status of your Agent.</p>
+The camera itself is broken, damaged or in the worst case tampered. Have a look into your Hub account for the latest recordings and/or verify the connection and status of your Agent.</p>

 						<a style="text-decoration: none;color: none;" href="{{link}}">
                            <p style="font-family: Inter;
@@ -295,7 +295,7 @@ The camera itself is broken, damaged or in the worst case tampered. Have a look
                                                width: 160px;
                                                border-radius: 4px;
 												text-align: center;
-                                                cursor: pointer;">Go to Kerberos Hub -></p>
+                                                cursor: pointer;">Go to Hub -></p>
                        </a>
 					</td>
                    <td class="corner-td" align="right"></td>
@@ -382,7 +382,7 @@ The camera itself is broken, damaged or in the worst case tampered. Have a look
                                                        mso-line-height-rule:exactly;
                                                        letter-spacing: 0em;
                                                        text-align: left;
-                                                        color:#6D6666;">About Kerberos</h4>
+                                                        color:#6D6666;">About the ecosystem</h4>
                                    <p style=" font-family: Inter;
                                                        font-size: 14px;
                                                        font-style: normal;
@@ -1,13 +1,13 @@
-Kerberos.io
+Hub
 ------------

 Hey, {{user}}
-Welcome to Kerberos Hub
+Welcome to Hub
 Activate your account ->
 {{link}}

-Kerberos Hub in a nutshell
-With Kerberos Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.
+Hub in a nutshell
+With Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.

 However before you get started this amazing applications, please activate your account.

@@ -17,6 +17,6 @@ support@kerberos.io
 9000 Ghent, BE
 https://kerberos.io

-About Kerberos
+About the ecosystem
 ------------
 Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
@@ -7,7 +7,7 @@
            name="viewport"
            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
    />
-    <meta name="description" content="Kerberos.io Mailing">
+    <meta name="description" content="Hub notifications">
    <style type="text/css">

        @font-face {
@@ -150,7 +150,7 @@
                <tbody>
                <tr>
                    <td class="corner-td" align="left"></td>
-                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
+                    <td width="48" height="36" align="left"><img alt="Hub" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
                    <td height="36" align="left" class="company-name-td">
                        <h3  width="36" height="36" style=" font-family: Inter;
                                        font-size: 20px;
@@ -160,7 +160,7 @@
                                        mso-line-height-rule:exactly;
                                        letter-spacing: 0em;
                                        text-align: left;
-                                        color: #262424;">Kerberos.io</h3>
+                                        color: #262424;">Hub</h3>
                    </td>
                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
@@ -275,8 +275,8 @@
                                        letter-spacing: 0em;
                                        text-align: left;
                                        color: #6D6666;
-                                        margin-top: 12px;">The daily limit of your account was reached (<b>{{dataUsage}} GB</b>), therefore we have disabled your account. This means that no new recordings will be uploaded to your Kerberos Hub agents until tomorrow.
-Tomorrow your account will be reset, and recordings will be uploaded again to your Kerberos Hub account.</p>
+                                        margin-top: 12px;">The daily limit of your account was reached (<b>{{dataUsage}} GB</b>), therefore we have disabled your account. This means that no new recordings will be uploaded to your Hub agents until tomorrow.
+Tomorrow your account will be reset, and recordings will be uploaded again to your Hub account.</p>
 						<p style=" font-family: Inter;
                                        font-size: 14px;
                                        font-style: normal;
@@ -286,7 +286,7 @@ Tomorrow your account will be reset, and recordings will be uploaded again to yo
                                        letter-spacing: 0em;
                                        text-align: left;
                                        color: #6D6666;
-                                        margin-top: 12px;">If you are hitting your daily limits a lot, you might consider upgrading your Kerberos Hub subscription, or fine-tune your Agents so they record less recordings.</p>
+                                        margin-top: 12px;">If you are hitting your daily limits a lot, you might consider upgrading your Hub subscription, or fine-tune your Agents so they record less recordings.</p>

 						<a style="text-decoration: none;color: none;" href="{{link}}">
                            <p style="font-family: Inter;
@@ -305,7 +305,7 @@ Tomorrow your account will be reset, and recordings will be uploaded again to yo
                                                width: 160px;
                                                border-radius: 4px;
 												text-align: center;
-                                                cursor: pointer;">Go to Kerberos Hub -></p>
+                                                cursor: pointer;">Go to Hub -></p>
                        </a>
 					</td>
                    <td class="corner-td" align="right"></td>
@@ -392,7 +392,7 @@ Tomorrow your account will be reset, and recordings will be uploaded again to yo
                                                        mso-line-height-rule:exactly;
                                                        letter-spacing: 0em;
                                                        text-align: left;
-                                                        color:#6D6666;">About Kerberos</h4>
+                                                        color:#6D6666;">About the ecosystem</h4>
                                    <p style=" font-family: Inter;
                                                        font-size: 14px;
                                                        font-style: normal;
@@ -1,13 +1,13 @@
-Kerberos.io
+Hub
 ------------

 Hey, {{user}}
-Welcome to Kerberos Hub
+Welcome to Hub
 Activate your account ->
 {{link}}

-Kerberos Hub in a nutshell
-With Kerberos Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.
+Hub in a nutshell
+With Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.

 However before you get started this amazing applications, please activate your account.

@@ -17,6 +17,6 @@ support@kerberos.io
 9000 Ghent, BE
 https://kerberos.io

-About Kerberos
+About the ecosystem
 ------------
 Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
@@ -7,7 +7,7 @@
            name="viewport"
            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
    />
-    <meta name="description" content="Kerberos.io Mailing">
+    <meta name="description" content="Hub notifications">
    <style type="text/css">

        @font-face {
@@ -150,7 +150,7 @@
                <tbody>
                <tr>
                    <td class="corner-td" align="left"></td>
-                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
+                    <td width="48" height="36" align="left"><img alt="Hub" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
                    <td height="36" align="left" class="company-name-td">
                        <h3  width="36" height="36" style=" font-family: Inter;
                                        font-size: 20px;
@@ -160,7 +160,7 @@
                                        mso-line-height-rule:exactly;
                                        letter-spacing: 0em;
                                        text-align: left;
-                                        color: #262424;">Kerberos.io</h3>
+                                        color: #262424;">Hub</h3>
                    </td>
                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
@@ -224,7 +224,7 @@
                                        padding-top: 12px;
                                        padding-bottom: 24px;
                                        padding-left: 0;
-                                        padding-right: 0;">You forgot your Kerberos Hub password!</h2>
+                                        padding-right: 0;">You forgot your Hub password!</h2>
                                        
                         <p style="font-family: Inter;
                                    font-size: 14px;
@@ -368,7 +368,7 @@
                                        mso-line-height-rule:exactly;
                                        letter-spacing: 0em;
                                        text-align: left;
-                                        color:#6D6666;">About Kerberos</h4>
+                                        color:#6D6666;">About the ecosystem</h4>
                    <p style=" font-family: Inter;
                                        font-size: 14px;
                                        font-style: normal;
@@ -1,13 +1,13 @@
-Kerberos.io
+Hub
 ------------

 Hey, {{user}}
-Welcome to Kerberos Hub
+Welcome to Hub
 Activate your account
 {{link}}

-Kerberos Hub in a nutshell
-With Kerberos Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.
+Hub in a nutshell
+With Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.

 However before you get started this amazing applications, please activate your account.

@@ -17,6 +17,6 @@ support@kerberos.io
 9000 Ghent, BE
 https://kerberos.io

-About Kerberos
+About the ecosystem
 ------------
 Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
@@ -7,7 +7,7 @@
            name="viewport"
            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
    />
-    <meta name="description" content="Kerberos.io Mailing">
+    <meta name="description" content="Hub notifications">
    <style type="text/css">

        @font-face {
@@ -150,7 +150,7 @@
                <tbody>
                <tr>
                    <td class="corner-td" align="left"></td>
-                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
+                    <td width="48" height="36" align="left"><img alt="Hub" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
                    <td height="36" align="left" class="company-name-td">
                        <h3  width="36" height="36" style=" font-family: Inter;
                                        font-size: 20px;
@@ -160,7 +160,7 @@
                                        mso-line-height-rule:exactly;
                                        letter-spacing: 0em;
                                        text-align: left;
-                                        color: #262424;">Kerberos.io</h3>
+                                        color: #262424;">Hub</h3>
                    </td>
                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
@@ -262,7 +262,7 @@
                                        text-align: left;
                                        color: #6D6666;
                                        margin-top: 12px;">You receive this alert as a lot of recordings have been uploaded during the last x minutes. This alert might indicate something is happening unusual, please have a look. 
-If you believe this is a false positive go to the alerts section of your Kerberos Hub account and update the setting accordingly.</p>
+If you believe this is a false positive go to the alerts section of your Hub account and update the setting accordingly.</p>


 						<a style="text-decoration: none;color: none;" href="{{link}}">
@@ -282,7 +282,7 @@ If you believe this is a false positive go to the alerts section of your Kerbero
                                                width: 160px;
                                                border-radius: 4px;
 												text-align: center;
-                                                cursor: pointer;">Go to Kerberos Hub -></p>
+                                                cursor: pointer;">Go to Hub -></p>
                        </a>
 					</td>
                    <td class="corner-td" align="right"></td>
@@ -369,7 +369,7 @@ If you believe this is a false positive go to the alerts section of your Kerbero
                                                        mso-line-height-rule:exactly;
                                                        letter-spacing: 0em;
                                                        text-align: left;
-                                                        color:#6D6666;">About Kerberos</h4>
+                                                        color:#6D6666;">About the ecosystem</h4>
                                    <p style=" font-family: Inter;
                                                        font-size: 14px;
                                                        font-style: normal;
@@ -1,13 +1,13 @@
-Kerberos.io
+Hub
 ------------

 Hey, {{user}}
-Welcome to Kerberos Hub
+Welcome to Hub
 Activate your account ->
 {{link}}

-Kerberos Hub in a nutshell
-With Kerberos Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.
+Hub in a nutshell
+With Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.

 However before you get started this amazing applications, please activate your account.

@@ -17,6 +17,6 @@ support@kerberos.io
 9000 Ghent, BE
 https://kerberos.io

-About Kerberos
+About the ecosystem
 ------------
 Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
@@ -7,7 +7,7 @@
            name="viewport"
            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
    />
-    <meta name="description" content="Kerberos.io Mailing">
+    <meta name="description" content="Hub notifications">
    <style type="text/css">

        @font-face {
@@ -150,7 +150,7 @@
                <tbody>
                <tr>
                    <td class="corner-td" align="left"></td>
-                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
+                    <td width="48" height="36" align="left"><img alt="Hub" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
                    <td height="36" align="left" class="company-name-td">
                        <h3  width="36" height="36" style=" font-family: Inter;
                                        font-size: 20px;
@@ -160,7 +160,7 @@
                                        mso-line-height-rule:exactly;
                                        letter-spacing: 0em;
                                        text-align: left;
-                                        color: #262424;">Kerberos.io</h3>
+                                        color: #262424;">Hub</h3>
                    </td>
                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
@@ -261,7 +261,7 @@
                                        letter-spacing: 0em;
                                        text-align: left;
                                        color: #6D6666;
-                                        margin-top: 12px;">Someone, we hope it was you ({{ipaddress}}), signed in to your account. If this was not you, please go to Kerberos Hub and change your password ASAP.</p>
+                                        margin-top: 12px;">Someone, we hope it was you ({{ipaddress}}), signed in to your account. If this was not you, please go to Hub and change your password ASAP.</p>
 					
 						<a style="text-decoration: none;color: none;" href="{{link}}">
                            <p style="font-family: Inter;
@@ -367,7 +367,7 @@
                                                        mso-line-height-rule:exactly;
                                                        letter-spacing: 0em;
                                                        text-align: left;
-                                                        color:#6D6666;">About Kerberos</h4>
+                                                        color:#6D6666;">About the ecosystem</h4>
                                    <p style=" font-family: Inter;
                                                        font-size: 14px;
                                                        font-style: normal;
@@ -1,13 +1,13 @@
-Kerberos.io
+Hub
 ------------

 Hey, {{user}}
-Welcome to Kerberos Hub
+Welcome to Hub
 Activate your account ->
 {{link}}

-Kerberos Hub in a nutshell
-With Kerberos Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.
+Hub in a nutshell
+With Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.

 However before you get started this amazing applications, please activate your account.

@@ -17,6 +17,6 @@ support@kerberos.io
 9000 Ghent, BE
 https://kerberos.io

-About Kerberos
+About the ecosystem
 ------------
 Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
@@ -8,7 +8,7 @@
            name="viewport"
            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
    />
-    <meta name="description" content="Kerberos.io Mailing">
+    <meta name="description" content="Hub notifications">
    <style type="text/css">

        @font-face {
@@ -151,7 +151,7 @@
                <tbody>
                <tr>
                    <td class="corner-td" align="left"></td>
-                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
+                    <td width="48" height="36" align="left"><img alt="Hub" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
                    <td height="36" align="left" class="company-name-td">
                        <h3  width="36" height="36" style=" font-family: Inter;
                                        font-size: 20px;
@@ -161,7 +161,7 @@
                                        mso-line-height-rule:exactly;
                                        letter-spacing: 0em;
                                        text-align: left;
-                                        color: #262424;">Kerberos.io</h3>
+                                        color: #262424;">Hub</h3>
                    </td>
                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
@@ -369,7 +369,7 @@
                                                        mso-line-height-rule:exactly;
                                                        letter-spacing: 0em;
                                                        text-align: left;
-                                                        color:#6D6666;">About Kerberos</h4>
+                                                        color:#6D6666;">About the ecosystem</h4>
                                    <p style=" font-family: Inter;
                                                        font-size: 14px;
                                                        font-style: normal;
@@ -1,4 +1,4 @@
-Kerberos.io
+Hub
 ------------

 We've something interesting for you
@@ -14,6 +14,6 @@ support@kerberos.io
 9000 Ghent, BE
 https://kerberos.io

-About Kerberos
+About the ecosystem
 ------------
 Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
@@ -8,7 +8,7 @@
            name="viewport"
            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
    />
-    <meta name="description" content="Kerberos.io Mailing">
+    <meta name="description" content="Hub notifications">
    <style type="text/css">

        @font-face {
@@ -151,7 +151,7 @@
                <tbody>
                <tr>
                    <td class="corner-td" align="left"></td>
-                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
+                    <td width="48" height="36" align="left"><img alt="Hub" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
                    <td height="36" align="left" class="company-name-td">
                        <h3  width="36" height="36" style=" font-family: Inter;
                                        font-size: 20px;
@@ -161,7 +161,7 @@
                                        mso-line-height-rule:exactly;
                                        letter-spacing: 0em;
                                        text-align: left;
-                                        color: #262424;">Kerberos.io</h3>
+                                        color: #262424;">Hub</h3>
                    </td>
                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
@@ -369,7 +369,7 @@
                                                        mso-line-height-rule:exactly;
                                                        letter-spacing: 0em;
                                                        text-align: left;
-                                                        color:#6D6666;">About Kerberos</h4>
+                                                        color:#6D6666;">About the ecosystem</h4>
                                    <p style=" font-family: Inter;
                                                        font-size: 14px;
                                                        font-style: normal;
@@ -1,4 +1,4 @@
-Kerberos.io
+Hub
 ------------

 A case has been shared with you
@@ -16,6 +16,6 @@ support@kerberos.io
 9000 Ghent, BE
 https://kerberos.io

-About Kerberos
+About the ecosystem
 ------------
 Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
@@ -7,7 +7,7 @@
            name="viewport"
            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
    />
-    <meta name="description" content="Kerberos.io Mailing">
+    <meta name="description" content="Hub notifications">
    <style type="text/css">

        @font-face {
@@ -150,7 +150,7 @@
                <tbody>
                <tr>
                    <td class="corner-td" align="left"></td>
-                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
+                    <td width="48" height="36" align="left"><img alt="Hub" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
                    <td height="36" align="left" class="company-name-td">
                        <h3  width="36" height="36" style=" font-family: Inter;
                                        font-size: 20px;
@@ -160,7 +160,7 @@
                                        mso-line-height-rule:exactly;
                                        letter-spacing: 0em;
                                        text-align: left;
-                                        color: #262424;">Kerberos.io</h3>
+                                        color: #262424;">Hub</h3>
                    </td>
                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
@@ -224,7 +224,7 @@
                                        padding-top: 12px;
                                        padding-bottom: 24px;
                                        padding-left: 0;
-                                        padding-right: 0;">Welcome to Kerberos Hub</h2>
+                                        padding-right: 0;">Welcome to Hub</h2>
 						<a style="text-decoration: none;color: none;" href="{{link}}">
                            <p style="font-family: Inter;
                                                font-size: 14px;
@@ -268,7 +268,7 @@
                                        letter-spacing: 0em;
                                        text-align: left;
                                        color: #262424;
-                                        width: 280px">Kerberos Hub in a nutshell</h3>
+                                        width: 280px">Hub in a nutshell</h3>
                        <p style=" font-family: Inter;
                                        font-size: 14px;
                                        font-style: normal;
@@ -278,7 +278,7 @@
                                        letter-spacing: 0em;
                                        text-align: left;
                                        color: #6D6666;
-                                        margin-top: 12px;">With Kerberos Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.</p>
+                                        margin-top: 12px;">With Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.</p>
                        <p style=" font-family: Inter;
                                        font-size: 14px;
                                        font-style: normal;
@@ -374,7 +374,7 @@
                                                        mso-line-height-rule:exactly;
                                                        letter-spacing: 0em;
                                                        text-align: left;
-                                                        color:#6D6666;">About Kerberos</h4>
+                                                        color:#6D6666;">About the ecosystem</h4>
                                    <p style=" font-family: Inter;
                                                        font-size: 14px;
                                                        font-style: normal;
@@ -1,13 +1,13 @@
-Kerberos.io
+Hub
 ------------

 Hey, {{user}}
-Welcome to Kerberos Hub
+Welcome to Hub
 Activate your account ->
 {{link}}

-Kerberos Hub in a nutshell
-With Kerberos Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.
+Hub in a nutshell
+With Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.

 However before you get started this amazing applications, please activate your account.

@@ -17,6 +17,6 @@ support@kerberos.io
 9000 Ghent, BE
 https://kerberos.io

-About Kerberos
+About the ecosystem
 ------------
 Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
@@ -1,13 +1,13 @@
 # Amazon DocumentDB

 [Amazon DocumentDB](https://aws.amazon.com/documentdb/) is a managed, MongoDB
-compatible database. It can be used as the metadata store for Kerberos Hub
+compatible database. It can be used as the metadata store for Hub
 instead of a self-hosted MongoDB.

 ## Things to know

 - **Not reachable from outside its VPC.** DocumentDB has no public endpoint, so
-  the Kerberos Hub services must run inside (or be peered with) the same VPC.
+  the Hub services must run inside (or be peered with) the same VPC.
 - **TLS is enabled by default.** Clients must trust the Amazon RDS certificate
  authority bundle:
  `https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem`.
@@ -23,7 +23,7 @@ The [`amazon-eks-documentdb`](../amazon-eks-documentdb/README.md) Terraform
 stack creates a VPC, an EKS cluster and a DocumentDB cluster with TLS enforced,
 and outputs a ready to paste `mongodb` values block for the hub helm chart.

-## Connecting Kerberos Hub
+## Connecting Hub

 Configure the database through `mongodb.uri` (not `mongodb.host`) and point the
 chart at the CA bundle:
@@ -2,7 +2,7 @@

 Terraform stack that creates a **basic Kubernetes cluster (EKS) and a managed
 MongoDB-compatible database (Amazon DocumentDB) on AWS**, wired together so
-Kerberos Hub can be installed on it straight away.
+Hub can be installed on it straight away.

 It is primarily meant as a **reproducible test environment** for the DocumentDB
 support in the [`hub` helm chart](https://github.com/kerberos-io/helm-charts),
@@ -110,7 +110,7 @@ $(terraform output -raw update_kubeconfig_command)
 kubectl get nodes
 ```

-## Installing Kerberos Hub against DocumentDB
+## Installing Hub against DocumentDB

 ### 1. Create the certificate authority secret

@@ -370,6 +370,6 @@ for the full list; the ones you are most likely to change:

 ## Related

- [`../amazon-documentdb`](../amazon-documentdb/README.md) — using DocumentDB as the Kerberos Hub metadata store
- [`../../overlays/documentdb`](../../overlays/documentdb) — Kustomize overlay that deploys Kerberos Hub against DocumentDB
+- [`../amazon-documentdb`](../amazon-documentdb/README.md) — using DocumentDB as the Hub metadata store
+- [`../../overlays/documentdb`](../../overlays/documentdb) — Kustomize overlay that deploys Hub against DocumentDB
 - [`../../README.k8s-managed.md`](../../README.k8s-managed.md) — installing on managed Kubernetes
@@ -6,7 +6,7 @@
 #
 #   curl -O https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem
 #
-# For Kerberos Hub that bundle is mounted through the helm chart's
+# For Hub that bundle is mounted through the helm chart's
 # `mongodb.tls` values, see the README next to this file.
 ###############################################################################

@@ -28,7 +28,7 @@ locals {

 resource "aws_security_group" "docdb" {
  name        = "${local.name}-docdb"
-  description = "MongoDB wire protocol access to the Kerberos Hub DocumentDB cluster"
+  description = "MongoDB wire protocol access to the Hub DocumentDB cluster"
  vpc_id      = module.vpc.vpc_id

  tags = merge(local.tags, { Name = "${local.name}-docdb" })
@@ -58,7 +58,7 @@ resource "aws_vpc_security_group_ingress_rule" "docdb_from_cidrs" {

 resource "aws_docdb_subnet_group" "this" {
  name        = local.docdb_subnet_group_name
-  description = "Private subnets of the Kerberos Hub VPC"
+  description = "Private subnets of the Hub VPC"
  subnet_ids  = module.vpc.private_subnets

  tags = local.tags
@@ -71,7 +71,7 @@ resource "aws_docdb_subnet_group" "this" {
 resource "aws_docdb_cluster_parameter_group" "this" {
  name        = "${local.name}-docdb"
  family      = var.docdb_parameter_group_family
-  description = "Kerberos Hub DocumentDB parameters"
+  description = "Hub DocumentDB parameters"

  parameter {
    name  = "tls"
@@ -48,7 +48,7 @@ module "eks" {
 ###############################################################################
 # EBS CSI driver
 #
-# Kerberos Hub's supporting components (RabbitMQ, VerneMQ, MinIO, ...) claim
+# Hub's supporting components (RabbitMQ, VerneMQ, MinIO, ...) claim
 # persistent volumes, so the cluster needs a working CSI driver.
 ###############################################################################

@@ -73,12 +73,12 @@ output "docdb_tls_enabled" {
 }

 ###############################################################################
-# Kerberos Hub wiring
+# Hub wiring
 ###############################################################################

 output "mongodb_uri" {
  description = <<-EOT
-    Connection string for the Kerberos Hub helm chart (`mongodb.uri`).
+    Connection string for the Hub helm chart (`mongodb.uri`).
    The chart appends `tls=true` and `tlsCAFile=...` itself when
    `mongodb.tls.enabled=true`, so no TLS parameters are included here.
    Read it with: terraform output -raw mongodb_uri
@@ -97,7 +97,7 @@ output "mongodb_uri" {

 output "hub_values_snippet" {
  description = <<-EOT
-    Ready to paste values for the Kerberos Hub helm chart. Write it to a file with:
+    Ready to paste values for the Hub helm chart. Write it to a file with:
      terraform output -raw hub_values_snippet > hub-documentdb-values.yaml
    It expects the Amazon RDS CA bundle to be available as the `mongodb-ca` secret:
      curl -O https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem
@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "${CI:-false}" != true ]]; then
+  echo "This smoke test changes Factory settings and restarts its pod. Run it only in a disposable CI cluster (CI=true)." >&2
+  exit 1
+fi
+
+temporary="$(mktemp -d)"
+pid=""
+stop_forward() {
+  if [[ -n "$pid" ]]; then
+    if kill -0 "$pid" 2>/dev/null; then
+      kill "$pid"
+      wait "$pid" || [[ "$?" == 143 ]]
+    fi
+    pid=""
+  fi
+}
+cleanup() {
+  stop_forward
+  rm -f "$temporary/port-forward.log" "$temporary/login.json" "$temporary/config.json" "$temporary/saved.json" "$temporary/index.html"
+  rmdir "$temporary"
+}
+trap cleanup EXIT
+
+kubectl -n kerberos-factory rollout status deployment/factory --timeout=300s
+kubectl -n kerberos-factory get deployment factory -o json | jq -e '
+  .spec.template.spec as $pod |
+  $pod.securityContext.fsGroup == 65532 and
+  $pod.securityContext.seccompProfile.type == "RuntimeDefault" and
+  ($pod.containers[] | select(.name == "factory") |
+    .securityContext.runAsNonRoot == true and
+    .securityContext.runAsUser == 65532 and .securityContext.runAsGroup == 65532 and
+    .securityContext.readOnlyRootFilesystem == true and
+    .securityContext.allowPrivilegeEscalation == false and
+    .securityContext.capabilities.drop == ["ALL"] and
+    .ports == [{"name":"http","containerPort":8080,"protocol":"TCP"}] and
+    any(.volumeMounts[]; .mountPath == "/home/factory/config") and
+    any(.volumeMounts[]; .mountPath == "/tmp") and
+    .startupProbe.httpGet.path == "/healthz" and
+    .readinessProbe.httpGet.port == "http" and
+    .livenessProbe.httpGet.port == "http")'
+kubectl -n kerberos-factory get service factory-nodeport -o json |
+  jq -e '.spec.ports | any(.port == 80 and .targetPort == "http" and .nodePort == 30079)'
+kubectl -n kerberos-factory get configmap agent-global-config agent-template-config
+kubectl -n kerberos-factory exec deployment/factory -- /app/main healthcheck
+
+forward() {
+  kubectl -n kerberos-factory port-forward service/factory-nodeport 13979:80 > "$temporary/port-forward.log" 2>&1 &
+  pid=$!
+  for attempt in {1..30}; do
+    if curl --fail --silent http://127.0.0.1:13979/healthz >/dev/null; then return; fi
+    if ! kill -0 "$pid" 2>/dev/null; then break; fi
+    sleep 1
+  done
+  cat "$temporary/port-forward.log" >&2
+  echo "Factory Service port-forward did not become healthy." >&2
+  exit 1
+}
+login() {
+  curl --fail --silent --show-error -H 'Content-Type: application/json' \
+    -d '{"username":"root","password":"kerberos"}' \
+    http://127.0.0.1:13979/api/login > "$temporary/login.json"
+  token="$(jq -er '.token | select(length > 0)' "$temporary/login.json")"
+  if [[ "${GITHUB_ACTIONS:-false}" == true ]]; then echo "::add-mask::$token"; fi
+}
+forward
+curl --fail --silent --show-error http://127.0.0.1:13979/ > "$temporary/index.html"
+grep -qi '<html' "$temporary/index.html"
+test "$(curl --silent --output /dev/null --write-out '%{http_code}' http://127.0.0.1:13979/api/config)" = 401
+login
+curl --fail --silent --show-error -H "Authorization: Bearer $token" \
+  http://127.0.0.1:13979/api/config > "$temporary/config.json"
+jq -e '.data.type == "global"' "$temporary/config.json"
+jq '.data | .timezone = (if .timezone == "UTC" then "Etc/GMT+1" else "UTC" end)' \
+  "$temporary/config.json" > "$temporary/saved.json"
+timezone="$(jq -r '.timezone' "$temporary/saved.json")"
+curl --fail --silent --show-error -H "Authorization: Bearer $token" \
+  -H 'Content-Type: application/json' --data-binary "@$temporary/saved.json" \
+  http://127.0.0.1:13979/api/config | jq -e --arg timezone "$timezone" '.data.timezone == $timezone'
+kubectl -n kerberos-factory get configmap agent-global-config -o json |
+  jq -e --arg timezone "$timezone" '.data["_source.json"] | fromjson | .timezone == $timezone'
+
+pod_uid() {
+  kubectl -n kerberos-factory get pods -l app=factory -o json |
+    jq -er '[.items[] | select(.metadata.deletionTimestamp == null)][0].metadata.uid'
+}
+old_pod="$(pod_uid)"
+stop_forward
+kubectl -n kerberos-factory rollout restart deployment/factory
+kubectl -n kerberos-factory rollout status deployment/factory --timeout=300s
+test "$old_pod" != "$(pod_uid)"
+forward
+login
+curl --fail --silent --show-error -H "Authorization: Bearer $token" \
+  http://127.0.0.1:13979/api/config | jq -e --arg timezone "$timezone" '.data.timezone == $timezone'
+kubectl -n kerberos-factory exec deployment/factory -- /app/main healthcheck
+echo "Factory passed: restricted runtime, Service routing, UI/auth/config, ConfigMap bootstrap and persisted settings after pod replacement."
@@ -3,7 +3,7 @@ set -uo pipefail

 kubectl get pods,pvc -A -o wide
 kubectl get events -A --sort-by=.lastTimestamp
-for namespace in garage mongodb rabbitmq vernemq kerberos-vault kerberos-agent kerberos-hub; do
+for namespace in garage mongodb rabbitmq vernemq kerberos-vault kerberos-agent kerberos-hub kerberos-factory; do
  if ! pods="$(kubectl -n "$namespace" get pods -o name)"; then
    echo "::warning::Could not list pods in $namespace."
    continue
@@ -0,0 +1,45 @@
+import assert from 'node:assert/strict'
+import { readFile, writeFile } from 'node:fs/promises'
+
+const root = new URL('../', import.meta.url)
+const names = ['how-it-works', 'deployment-self-hosted', 'deployment-managed']
+const check = process.argv.includes('--check')
+assert(process.argv.slice(2).every(arg => arg === '--check'), 'Usage: node scripts/update-diagram-links.mjs [--check]')
+
+const links = []
+for (const name of names) {
+  const diagram = JSON.parse(await readFile(new URL(`assets/diagrams/${name}.json`, root), 'utf8'))
+  assert(Array.isArray(diagram.groups) && Array.isArray(diagram.nodes) && Array.isArray(diagram.connections), `${name}: missing diagram arrays`)
+  const ids = new Set()
+  for (const node of diagram.nodes) {
+    assert(typeof node.id === 'string' && node.id && !ids.has(node.id), `${name}: invalid or duplicate node id`)
+    ids.add(node.id)
+  }
+  for (const item of [...diagram.groups, ...diagram.nodes]) {
+    assert([item.x, item.y, item.w, item.h].every(Number.isFinite) && item.w > 0 && item.h > 0, `${name}: invalid bounds`)
+  }
+  for (const connection of diagram.connections) {
+    assert(ids.has(connection.from) && ids.has(connection.to), `${name}: dangling connection`)
+    for (const side of [connection.fromSide, connection.toSide]) {
+      assert(['left', 'right', 'top', 'bottom'].includes(side), `${name}: invalid connection side`)
+    }
+  }
+  const preview = await readFile(new URL(`assets/images/${name}.svg`, root), 'utf8')
+  assert(preview.startsWith('<svg') && !/<(?:script|foreignObject)\b/i.test(preview), `${name}: expected a GitHub-safe SVG export`)
+  const payload = Buffer.from(JSON.stringify(diagram), 'utf8').toString('base64')
+  links.push(`[draw-${name}]: https://draw.uug.ai/#diagram=${payload}`)
+}
+
+const file = new URL('README.md', root)
+const readme = await readFile(file, 'utf8')
+const start = '<!-- BEGIN GENERATED DRAW LINKS -->'
+const end = '<!-- END GENERATED DRAW LINKS -->'
+assert(readme.split(start).length === 2 && readme.split(end).length === 2, 'Expected one Draw links section in README.md')
+const section = `${start}\n${links.join('\n')}\n${end}`
+const updated = readme.replace(/<!-- BEGIN GENERATED DRAW LINKS -->[\s\S]*?<!-- END GENERATED DRAW LINKS -->/, section)
+if (check) {
+  assert.equal(updated, readme, 'Draw links are stale. Run node scripts/update-diagram-links.mjs')
+} else if (updated !== readme) {
+  await writeFile(file, updated)
+}
+console.log(`${check ? 'Verified' : 'Updated'} ${names.length} editable Draw links and checked their sources/previews.`)
Author	SHA1	Message	Date
Cédric Verstraeten	5485f454b3	Merge pull request #46 from uug-ai/docs/learn-product-links Link all products to Learn documentation	2026-11-04 21:10:42 +01:00
Cédric VerstraetenandCopilot	7d5574f90e	docs: summarize image security approach Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-11-04 19:47:46 +00:00
Cédric VerstraetenandCopilot	ebd5fffd8b	docs: simplify Hub hardening overview Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-11-04 19:46:45 +00:00
Cédric VerstraetenandCopilot	eaa6bd0367	docs: link all products to Learn pages Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-11-04 19:38:33 +00:00
Cédric Verstraeten	21536ed1b0	Merge pull request #45 from uug-ai/docs/continuous-deployment-badges Show all continuous deployment workflow badges	2026-11-04 20:25:06 +01:00
Cédric VerstraetenandCopilot	711ace1f15	docs: show all continuous deployment badges Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-11-04 19:16:38 +00:00
Cédric Verstraeten	4d5d7e3c18	Merge pull request #42 from uug-ai/chore/hub-chart-0.170.1 Upgrade Hub chart to 0.170.1 with hardened API defaults	2026-11-04 18:42:49 +01:00
Cédric Verstraeten	c643012993	Merge pull request #44 from uug-ai/chore/hardened-factory-release Deploy verified hardened Factory v2.0.13	2026-11-04 18:42:40 +01:00
Cédric VerstraetenandCopilot	913706fe3f	Deploy verified hardened Factory v2.0.13 with coordinated runtime settings Pin the signed multiarchitecture digest, route unchanged external ports to HTTP 8080, enforce restricted security context and mount writable config/tmp volumes. Exercise a legacy upgrade and ConfigMap-backed settings after pod replacement on kind. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-11-04 17:16:29 +00:00
Cédric Verstraeten	d41b425035	Merge pull request #43 from uug-ai/docs/deployment-diagrams-vault-hardening Refresh deployment diagrams and harden Vault	2026-11-04 17:33:07 +01:00
Cédric VerstraetenandCopilot	f5a9eaef15	ci: wait for Vault rollout readiness Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-11-04 16:16:10 +00:00
Cédric VerstraetenandCopilot	674875a754	docs: refresh deployment diagrams and harden Vault Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-11-04 15:44:28 +00:00