CIRCLE Documentation

Open-source tools built by CIRCLE Cyber — private PKI infrastructure, real-time development frameworks, and cybersecurity utilities for air-gapped environments and production deployments.

Contribute GitHub

Infrastructure

Private network PKI and certificate management — no cloud, no internet dependency.

uPKI CA

Self-hosted Certificate Authority. Issue, renew, and revoke X.509 certificates via ZMQ. Supports custom certificate profiles, CRL generation, and OCSP checks.

uPKI RA

ACME v2 Registration Authority (RFC 8555). Plug Traefik, cert-manager or any ACME client into your private CA — no Let's Encrypt required.

SNI Router

TLS/SNI passthrough router built on HAProxy. Route HTTPS traffic from a single public IP to multiple backends by hostname — without decrypting anything.

DNS Resolver

Internal DNS server combining CoreDNS and docker-gen. Resolves *.your.domain to your host IP and auto-registers every running container by name.

uPKI CLI

Python client for the µPKI stack. Enroll EC P-256 certificates via ACME v2, automate renewal with systemd, and install certs into Firefox and Chrome.

Development

TypeScript frameworks and libraries for building real-time, authenticated backend applications.

IOServer

TypeScript framework combining Fastify (HTTP) and Socket.IO (WebSocket) behind a single API. Services, Controllers, Managers, Watchers, and Middlewares.

IOServer OIDC

Drop-in OIDC/OAuth2 JWT middleware set for IOServer. Protects HTTP routes and Socket.IO namespaces via remote JWKS — no secret storage on the application side.

Auth Service

Self-hosted OAuth 2.1 / OIDC identity provider. Multi-app RBAC, MFA (TOTP + passkeys), subscription plans with feature flags, and consumption tracking.

Cyber

Offensive and defensive security tooling.

Sysplant

Syscall factory generating Windows syscall bypasses in C, C++, NIM, and Rust — 7 gate iterators, 4 caller methods, symbol scrambling, and MCP server integration.