# Sovereign identity and policy management

> Private prototype exploring self-hosted identity, endpoint policy, compliance, and mesh networking for Windows and Linux.

- Source: https://stevenfoerster.com/projects/keystone/

In development · source not public

Since 2019

Keystone is a private prototype exploring whether directory services, endpoint policy, compliance evaluation, and mesh-network access can share one self-hosted control plane across Windows and Linux.

Status: architecture under active development, source not public, and no claim of production readiness. The components below describe implemented prototype work and design targets, not a released replacement for Microsoft identity products.

[Follow along](https://stevenfoerster.com/contact/)

Components

## What is in the stack

### Directory and KDC

Prototype directory layer with a Kerberos KDC, integrated DNS, and a SYSVOL-style policy share.

### Identity and SSO

Prototype SSO layer using OIDC and SAML, with TOTP, WebAuthn, passkeys, and user self-service.

### Mesh network

Self-hosted WireGuard mesh with ACLs derived from directory group tags.

### complyd

Compliance bridge that evaluates device state over mutually authenticated gRPC and gates network access via mesh ACL tags.

### linpolld

On-endpoint policy agent that mounts SYSVOL via Kerberos, merges policies by OU precedence, dispatches to plugins, and reports compliance every 90 seconds.

### polltool and keystonectl

Operator and management CLIs for enrollment, policy inspection, compliance history, and directory administration.

Architecture

## A closed loop between seven services

The directory is the source of truth. The identity service federates SSO. A self-hosted WireGuard mesh runs the network. complyd evaluates device state and writes tags that gate network access. linpolld pulls policy from SYSVOL and reports compliance. Every inter-component call uses Kerberos.

```
   polltool ----unix----> linpolld
                             |
            Kerberos TGS     |     Kerberos TGS
          (cifs/dc.realm)    |   (HTTP/complyd.realm)
                 |           |           |
                 v           |           v
           +-----------+     |     +-----------+
           | Directory |<----+---->|  complyd  |
           |  SYSVOL   |           +-----+-----+
           +-----------+                 |
                                    tag write
                                         |
                                         v
                                   +-----------+
                                   |   Mesh    |
                                   |   ACLs    |
                                   +-----+-----+
                                         |
                                    WireGuard
                                      mesh
```

Design decisions and trade-offs

## Why the stack looks like this

### Self-hosted, not cloud-hosted

Operators run the full stack on their own hardware. More operational responsibility, but no per-seat licensing, no forced telemetry, and no foreign jurisdiction over identity data.

### Kerberos for every component

Higher setup complexity than bearer tokens, but inter-component authentication uses the same proven mechanism the directory already provides, no parallel secret store to compromise.

### Compliance gates network access

Endpoints that fail policy evaluation lose mesh-network ACLs to sensitive subnets. Stricter than reporting-only models, but it makes "non-compliant" a real boundary instead of a dashboard color.

Roadmap

## What is on the roadmap

What works today

-   Docker Compose stack with directory, identity, mesh networking, complyd, and a reverse proxy.
-   linpolld agent with Kerberos auth, SYSVOL read, plugin dispatch, and compliance reporting.
-   Reference plugins for nftables firewall and Linux desktop screen lock.
-   Policy merge across OU hierarchy with precedence, force, and inheritance blocks.
-   polltool CLI with enrol, run, policy show, and compliance list.

What is next

-   Tier-1 plugin suite: packages, mounts, sshd, updates, custom scripts, PAM, sudoers, DNS, NTP.
-   GPO conversion pipeline mapping 80+ Windows settings to `linux-policy.yml`.
-   Distro matrix testing across Ubuntu, Debian, RHEL, and Fedora.
-   Certificate auto-enrollment.
-   Keystone Console, REST API, RBAC, and OU-scoped delegation by v1.0.

Who it is for

## Sovereignty over IT

Organizations that need to audit and operate their identity, device, and network stack without depending on a single vendor's cloud, pricing model, or geopolitical jurisdiction. Keystone is planned to be released under a permissive open-source license once the foundation stabilizes.

## Follow the build

Source is not yet public. If you want progress updates or to discuss a deployment scenario, get in touch through the contact page.

[Get in touch](https://stevenfoerster.com/contact/)