Architecture Deep Dive

RasnuOS achieves its unique combination of global scale, intense security, and local execution through a hybrid architecture model.

Unlike legacy systems that rely on a central server SSH-ing into thousands of remote nodes (which introduces massive latency and security vulnerabilities), RasnuOS cleanly separates the Control Plane from the Data Plane.

1. The Centralized Control Plane (Closed-Source)

The RasnuOS backend is a highly available, proprietary cloud service. It acts as the brain of your infrastructure operations.

Responsibilities:

• Hosting the web interface, dashboards, and API.
• Managing Organizations, Teams, and Role-Based Access Control (RBAC).
• Orchestrating billing, cost insights, and the Cloud Price Catalog.
• Hosting the AI AutoPilot reasoning engine.
• Cryptographically signing instructions (intents) destined for your servers.

Because the Control Plane is centralized, your team has a single, globally accessible dashboard to manage infrastructure regardless of where the physical servers are located.

2. The Distributed Agent (Open-Source)

Installed on every target server, laptop, or edge device is the RasnuOS Agent. Written in highly optimized Go, this open-source daemon is the muscle of the operation.

Responsibilities:

• Establishing secure, outbound-only connections to the Control Plane.
• Executing infrastructure changes (deploying containers, installing packages, editing config files).
• Streaming real-time health metrics (CPU, RAM, Disk) back to the dashboard.
• Continuously polling for and verifying cryptographically signed payloads before executing them.

By making the agent open-source, we ensure that the code running directly on your servers with root privileges is fully transparent, auditable by your security teams, and extensible via custom plugins.

The Communication Layer (mTLS & Outbound Polling)

The control plane and the agents communicate exclusively via Mutually Authenticated TLS (mTLS).

Furthermore, the architecture employs an outbound-only polling mechanism. The agent reaches out to the control plane to fetch its tasks. This means you do not need to open any inbound firewall ports on your servers, significantly reducing their attack surface.