Obrenix

A self-hosted Compliance, Risk & Governance (GRC) platform. Obrenix runs as a single set of Docker containers on one Linux host — your data stays in your network, and by default even the AI engine runs on-premise.

Overview

Nothing leaves the host unless you explicitly connect an outbound integration or opt into a cloud AI provider. Here's how it works:

1. You connect data sources. Obrenix either pulls from an integration's API (read-only) or you push data in via the Ingest API.
2. The platform normalises and stores the signals in PostgreSQL and renders them as controls coverage, dashboards and reports.
3. Continuous monitoring re-checks live signals on a schedule and keeps control status and evidence current.
4. The AI engine (local by default, optional cloud provider) summarises posture, proposes control mappings, and routes ingested data.
5. Auditors get read-ready evidence packs and an immutable change history.

Architecture

Components

            ┌──────────────────────── ADMIN BROWSER ───────────────────────┐
            │   HTTPS :443  (admin UI · single sign-on optional)           │
            └───────────────────────────────┬──────────────────────────────┘
                                            │
   ┌─────────────────────────────────────────▼────────────────────────────────┐
   │  Obrenix host (single Linux VM · Docker Compose)                          │
   │   ┌──────────────┐   ┌──────────────┐   ┌───────────────┐  ┌───────────┐  │
   │   │  frontend    │──▶│   backend    │   │  sync-worker  │  │  ollama   │  │
   │   │  nginx · :443│   │ FastAPI :8000│   │ scheduled jobs│  │ local AI  │  │
   │   └──────────────┘   └──────┬───────┘   └───────┬───────┘  └───────────┘  │
   │                      ┌──────▼───────┐           │                         │
   │                      │ PostgreSQL 16│◀──────────┘   (internal only)       │
   │                      └──────────────┘                                     │
   └──────────┬───────────────────────────────────────────────┬───────────────┘
              │ OUTBOUND :443 (cloud APIs, license, opt. AI)   │ OUTBOUND via VPN
              ▼                                                ▼
       Cloud / SaaS integrations                  Resources behind your VPN

Only the web tier publishes ports. The API, database and AI engine stay on the internal Docker network.

Network model & ports

If a source (IRIS, Wazuh, a SIEM cluster, an internal service…) sits behind a VPN, put the Obrenix host on a network that can reach it (site-to-site VPN, or a VPN client on the host), then allow a single outbound rule ALLOW Obrenix-host → <resource-host>:<port> over the tunnel. The resource never needs inbound access to Obrenix.

Multi-company scoping

Obrenix supports a primary legal entity plus additional entities. Compliance, Security 360 and Policy data are isolated per entity; an entity picker on those pages switches the active company. Cross-cutting maps (framework cross-mappings, catalogs) stay shared.

Data & security posture

• HTTPS-only UI; API, database and AI never leave the internal Docker network.
• Secrets encrypted at rest; the first admin and all passwords are stored only as hashes; mandatory, encrypted 2FA (TOTP) on accounts.
• Self-hosted AI by default — no data egress for analysis unless you opt into a cloud provider (Anthropic / OpenAI), with a local Ollama fallback.
• Audit-ready — immutable change history, control evidence, and one-click auditor evidence packs.

Features & capabilities

The left sidebar has two groups: Workspace (every signed-in user) and Admin (admins only). At a glance:

Workspace — available to every signed-in user

Admin — admins only

Integrations

Every integration lives under Settings → Integrations (admin), grouped by category. Most are read-only — Obrenix makes an outbound connection and pulls data, never modifying the source. A few push (notifications / publishing) or forward events to your SIEM.

Type legend — pull = read-only · push = outbound notify / publish · forward = sends events to your SIEM (Microsoft Sentinel / Log Analytics) · engine = AI / credential.

SOC & Telemetry

AI Assistants

Notifications

Awareness & Training

Workspace

Identity & Access

Data Branch

MDM

AppSec & Vulnerabilities

Custom sources & the Ingest API

Build your own read-only HTTP / REST source when there's no dedicated tile — call any JSON endpoint (url, method, auth_header, headers) on an optional 15 min–1 day schedule. For air-gapped scanners or bespoke tooling Obrenix can't pull from, generate an API key (Integrations → Custom → API keys) and POST JSON to /api/ingest — the AI classifies what it is and where it belongs.

Deployment

Obrenix ships as Docker Compose — one Linux host, one command to install.

1. Prerequisites

• Docker Engine ≥ 20.10 and Docker Compose v2 (docker compose, not legacy docker-compose).
• openssl, git, bash, curl.
• A Linux VM (add RAM if you run the bundled local AI). Open inbound 443/tcp to your admin network / VPN.

2. Get the code

The Obrenix repository is private, so cloning needs authentication. Use the repository URL you were given (https://github.com/hexarion-boop/obrenix.git).

HTTPS + Personal Access Token (simplest):

cd /opt   # or your preferred deploy parent dir
git clone https://github.com/hexarion-boop/obrenix.git
#   Username: your GitHub login
#   Password: a GitHub Personal Access Token — NOT your account password

Create the token at GitHub → Settings → Developer settings → Personal access tokens (fine-grained with read access to the repo, or classic with the repo scope). Cache it so later git pull / ./update.sh run unattended:

git config --global credential.helper store   # saved to ~/.git-credentials (chmod 600)

SSH (if your key is on GitHub):

cd /opt
git clone [email protected]:hexarion-boop/obrenix.git

3. Install

cd /opt/obrenix
./install.sh

The interactive flow asks only a couple of questions — the public binding (domain / IP + HTTPS port, default 443) and the database (bundled PostgreSQL by default, or your external DB_URL). It then writes a chmod 600 .env, auto-generates OBRENIX_SECRET and a unique 6-digit BUILD_NUMBER, and brings the stack up with docker compose up -d --build.

4. TLS

By default nginx mints a self-signed certificate on first boot. To install or rotate your own cert:

./tls.sh --cert fullchain.pem --key privkey.pem --restart

It validates that cert and key match, refuses an expired / not-yet-valid cert, warns if it expires within 14 days, and (with --restart) reloads nginx. ./tls.sh --show prints the active cert; ./tls.sh --reset wipes it so a fresh self-signed one is minted. The cert/key live only in the Docker volume — never on the host filesystem.

5. Configuration (.env)

The installer writes sensible values; the ones worth knowing (full list in .env.example):

6. Services & data

Named volumes persist your data across rebuilds — uploads + generated reports, the PostgreSQL database, the TLS cert/key, and the local-AI models. backup.sh and Settings → Backup handle them for you.

External database: answer “no” to the bundled-DB prompt, or apply the overlay:

docker compose -f docker-compose.yml -f docker-compose.external-db.yml up -d

7. Updating

The canonical update is the script — it pulls, refreshes the BUILD_NUMBER, rebuilds and restarts:

cd /opt/obrenix
./update.sh           # or: ./update.sh --no-cache

update.sh is non-interactive and cron-safe: it runs git pull --ff-only, regenerates BUILD_NUMBER, then docker compose build --pull + docker compose up -d --remove-orphans. If the browser still shows the old version after updating, hard-refresh (Ctrl+Shift+R) and purge any CDN cache.

8. Backup, air-gapped & uninstall

• Backup / restore — encrypted database backup/restore and scheduled auto-backup are built into Settings → Backup (local + OneDrive / SharePoint / Google Drive). On the host, backup.sh bundles a pg_dump + uploads + .env/secrets into a dated tarball (cron-friendly); daily-ops helpers ship alongside — start.sh · stop.sh · restart.sh · logs.sh · health.sh.
• Air-gapped install — move the code with git bundle, load the base images via docker save / docker load, and pre-pull the local AI model.
• Uninstall — docker compose down --volumes --remove-orphans removes the stack and its data.

Licensing & first run

1. Create the administrator. Browse to https://<your-host>/. While no users exist, the sign-in page shows a "Create administrator" wizard (email + password) instead of a login form — this is the first admin.
2. Enrol 2FA. Two-factor auth is mandatory by default (OBRENIX_REQUIRE_2FA=true): on first login you scan a TOTP QR code and confirm a code.
3. Activate (optional). The built-in license check (hexlic) is off by default (HEXLIC_ENABLED=false), so the product runs unrestricted. When enabled, an activation window lets you drop in a license file to activate PRO, or start a 14-day trial.
4. Connect sources. Sign in as the admin and start wiring up sources under Settings → Integrations.

Licensing is scoped to your legal entities — a primary company plus up to two additional entities that scope the Policy / Compliance pickers. A PRO license unlocks features by tier and additional- company count; license changes are applied at the install's next heartbeat.

Support

Questions, an enterprise rollout, an air-gapped install or a tailored compliance scope — the Hexarion team is one message away.

Talk to us →