🎯 Objective#

opnDossier is a CLI tool that turns OPNsense and pfSense firewall configurations into readable documentation and security findings, fully offline. It is the flagship product of EvilBit Labs' Network Analysis suite and the near-term revenue focus of the company. The commercial positioning is "affordable RedSeal for operators" — offering RedSeal-class insight without RedSeal-class cost or deployment complexity.
Strategically the product ships as an open core: the community edition stays free and universal (multi-platform parsing, documentation conversion, baseline security analysis), while STIG/SANS/NIST compliance plugins, PDF reports, SIEM integration, and a desktop app move to the Professional tier. The OSS edition is what builds operator trust and developer credibility; the Pro tier is what funds the company.

📊 Success metrics#

🤔 Assumptions#

• Operators will accept a CLI as the primary interface. A GUI is deferred to the Professional tier and not required for adoption.
• Offline / airgap operation is a hard requirement, not a preference. The tool cannot phone home, emit telemetry, or depend on cloud services at runtime or build time.
• Users trust a tool they can audit. Every binary ships with an SBOM, all dependencies are pinned, and the codebase favors explicit Go over reflection or codegen.
• The market gap is real. RedSeal serves enterprise budgets; pfFocus and similar OSS tools are unmaintained or Python-heavy. A modern Go tool with commercial polish wins operators who need something in between.
• Go 1.21+ is available everywhere we deploy. No CGO, no dynamic linking — we ship a single static binary per platform.
• Compliance plugin architecture can support future standards (PCI-DSS, NIST 800-53, CIS) without breaking existing consumers. The plugin interface is stable as of v1.2.

🌟 Milestones#

Aligned with docs/roadmap.md and docs/plans/backlog-order-of-operations.md:

📝 Requirements#

Curated high-level requirements from project_spec/requirements.md (F001–F026) and project_spec/user_stories.md (US-001–US-048). Full requirement IDs remain canonical in the source files.

⚠️ Out of Scope#

• Real-time firewall configuration management or live device control. opnDossier reads config.xml files; it does not push config to devices or integrate with live firewall APIs.
• GUI or web interface in the community edition. A native desktop app via Wails is a Professional-tier roadmap item, not a v2.0 commitment.
• Telemetry, analytics, or any form of phone-home. This is a hard product tenet, not a feature toggle.
• Configuration backup/restore or config generation. opnDossier analyzes existing configs; it does not create new ones. The sister project OPNsense-config-faker handles synthetic config generation.
• Custom template engine for report output. Templates were fully removed in NATS-6 for v2.0; extensibility is via Go code (exported ReportBuilder interface), not text templates.
• Platform coverage beyond the published roadmap. Parsers for Cisco/Fortinet/Palo Alto/Juniper/MikroTik/Ubiquiti are planned but each is a significant engineering lift; they ship when they're ready, not to a date.
• Cloud or SaaS deployment of opnDossier itself. The product is a single static binary. A hypothetical hosted service is not on the roadmap.

🎨 Design#

• System architecture: docs/development/architecture.md + docs/architecture-diagram.mmd (Mermaid source).
• Data flow: config.xml → pkg/parser (vendor-specific) → pkg/model.CommonDevice (vendor-neutral) → internal/enrichment → internal/converter (output format) → file or stdout.
• Compliance pipeline: CommonDevice → audit.PluginManager → per-plugin RunChecks() → audit.Report → mode-specific renderer (blue/red).
• Plugin registry: dynamic .so loading opt-in via --plugin-dir; bundled plugins (Cybersecurity Best Practices, SANS, STIG) registered at init() time.

❓ Open questions#

🗂 Reference Links#

Source specifications

• project_spec/requirements.md — F001-F026 functional requirements + tech stack + architecture
• project_spec/user_stories.md — US-001 through US-048 in EARS format
• project_spec/tasks.md — release roadmap v1.0 through v2.0 with task-level status
• docs/plans/backlog-order-of-operations.md — sequenced execution plan with story points and epic assignments
• docs/plans/*.md — in-flight architectural plans (reportbuilder split, parser registry, DecodeDocument elimination, Kea DHCP model, template removal)
• AGENTS.md — code quality policy, mandatory practices, code review checklist
• GOTCHAS.md — non-obvious behaviors and hard-won lessons (plugin architecture, CLI flag wiring, sanitizer ordering, etc.)
  Public documentation
• README — product overview, installation, quick start
• docs/roadmap.md — public roadmap
• docs/compliance-standards.md — compliance framework coverage
• docs/development/architecture.md — architecture reference
  Related
• pfFocus — the Python-based config.xml parser that inspired this project
• OPNsense-config-faker — Rust-based config generator (sister project for test fixtures)
• EvilBit Threat Manager — sibling product in the Network Analysis suite