OpenAlert Control Plane

Decentralized Nostr & Multi-Protocol Alerting Bridge

An autonomous, zero-dependency emergency alerting gateway compiled in pure Rust. Bridges IT monitoring infrastructure to censorship-resistant decentralized networks, offline Bluetooth LE meshes, Emergency SOS Wi-Fi Captive Portals, and long-range LoRa radios.

GitHub Repository ⚡ Quickstart Guide 📐 Technical Specs
🌐
Development of OpenAlert is supported by a grant from the Human Rights Foundation (HRF) Bitcoin Development Fund.
Empowering human rights defenders, civil society, and operators in hostile or partitioned environments with resilient, sovereign communication tooling.
View the Official Announcement on X →

Core Architecture & Data Flow

OpenAlert operates as a multi-protocol gateway, standardizing incoming digital payloads into Prometheus Alertmanager schema, and securely relaying them across heterogeneous decentralized transports.

📥 Ingress Sources

REST Watchdogs & Webhooks

🚨 SOS Captive Portal

Off-Grid Wi-Fi AP & SVG CAPTCHA

⚡ Nostr Events

NIP-04, NIP-17/44 Gift Wraps

📶 BitChat BLE

Noise XX Encrypted 1-on-1

📻 LoRa Sub-GHz

SLIP Micro-Datagram Peering

📱 Cellular SMS

GSM/LTE Modem AT Commands

openalertd Daemon

Rust Autonomous Control Plane

  • 🛡️ Zero-Loss Spool: SQLite Flash Queue
  • 🔄 Distance-Vector: Split-Horizon Routing
  • ⚡ Circuit Breakers: Exponential Cooldown
  • ⏱️ Duty-Cycle: ETSI 1.0% Airtime Limiter
  • 🔐 Crypto: BIP-340 Schnorr, XChaCha20
  • 📊 Embedded NOC: SSE Telemetry Web UI

📞 py-phone-caller

Voice Telephony & GSM Dispatch

🌐 Nostr Relays

Encrypted DMs & Public Broadcast

📶 BitChat Mesh

Public BLE Mesh Escalation

📻 Multi-Hop RF

Edge-to-Gateway Forwarding

🚨 IT Operations

PagerDuty, Grafana, Alertmanager

Decentralized Capabilities & Transports

Engineered from first principles for mission-critical reliability, air-gapped field kits, and sovereign crisis networks.

🚨
Emergency SOS Portal & Wi-Fi AP
Simplified emergency web endpoint (/sos) for civilians without BitChat or 0xChat installed. Features an offline 4-digit distorted SVG visual CAPTCHA signed with one-time HMAC-SHA256 nonces. Includes optional Linux hostapd + dnsmasq + nginx Port 80 Captive Portal packaging (OpenAlert-SOS) that pops up automatically on any phone joining the field node's Wi-Fi.
/sos Portal Offline SVG CAPTCHA Wi-Fi Captive Portal Port 80 Isolation
⚡
0xChat & Embedded Nostr Relay
Zero-dependency embedded WebSocket Nostr micro-relay on port 8088. Implements NIP-01/11/20 with SQLite event indexing. Supports NIP-17/59/44 onion gift wraps (ChaCha20-Poly1305) and legacy NIP-04. Features interactive Command & Control (C2) and thread-aware alert acknowledgments (ACK).
NIP-17 NIP-44 NIP-59 0xChat C2 Native TLS
📶
BitChat BLE Offline Mesh
Direct peer-to-peer communication via Linux BlueZ D-Bus peripheral GATT services, bypassing ISPs, cell towers, and internet backbones. Direct messages are secured with the Noise_XX_25519_ChaChaPoly_SHA256 handshake, automatically escalating private emergencies with their exact message payload to the public mesh, LoRa RF, and telephony.
Noise XX BlueZ GATT Zero Internet Ad-Hoc Mesh
📻
Heterogeneous Peering & LoRa RF
Connects field nodes across LoRa serial radios, LAN Ethernet, and WireGuard tunnels. Dynamic distance-vector routing with split-horizon loop suppression. Features an integrated regulatory airtime limiter tracking the 1.0% ETSI EN 300 220 ceiling, backed by persistent SQLite flash-spool storage.
LoRa SLIP ETSI 1.0% Distance-Vector SQLite Spool
🔌
Autonomous Kernel USB Reset Watchdog
Self-healing hardware supervisor for unattended field kits. Resolves character devices (/dev/ttyACM*, /dev/ttyUSB*) up Linux sysfs hierarchies to trigger kernel ioctl(USBDEVFS_RESET) hardware power cycles and sysfs unbind/bind resets upon repeated I/O timeouts, auto-recovering hung USB-UART bridges without reboots.
ioctl(USBDEVFS_RESET) Sysfs Traversal Auto-Healing Rate-Limited
📡
Physical RF Telemetry & Link Biasing
Attaches and parses compact 2-byte in-band trailers ([raw_rssi, raw_snr]) to physical LoRa frames. Calculates quadratic RF degradation penalties (P_rf) to dynamically steer distance-vector routing away from noisy or marginal links, exposing live telemetry via Prometheus gauges and the NOC Status API.
RSSI / SNR Quadratic Cost Route Biasing Prometheus
🛰️
Certified ARM & LoRa Multi-Hop Chain
Field-certified on physical ARM64 SBCs (Orange Pi Zero 3) with Waveshare Semtech SX1262 transceivers (868.0 MHz). Propagates off-grid BitChat BLE & Wi-Fi /sos Captive Portal emergencies → 868 MHz LoRa RF → Edge Gateway → WireGuard VPN → Cloud Hub → Asterisk PBX voice calls & SMS in sub-second to 3.8s latency.
Orange Pi ARM64 SX1262 868MHz Multi-Hop Mesh DTMF Ack
🔑
Enterprise APISIX & Keycloak SSO
Exposed at https://py-phone-caller.link/openalert through Apache APISIX edge gateway with Keycloak OpenID Connect authentication. Features dynamic response-rewriting for collision-free path isolation and unbuffered Server-Sent Events (SSE) live telemetry streaming with zero backend code changes.
Apache APISIX Keycloak OIDC Single Sign-On Zero Code Change
📱
Cellular SMS Hardware Bridge
Direct serial AT interface to GSM/LTE cellular modems (SIMCOM, Quectel). Features bi-directional UCS-2 hex and ASCII transcoding for international alphabets and emergency emojis. Hot-reloadable authorized sender ACLs and SQLite audit history prevent unauthorized alert injection.
AT Serial UCS-2 Hex Sender ACL SMS Egress
💻
Tactical Mission Control NOC
Single-page glassmorphic dashboard embedded directly in the binary. Live Server-Sent Events (SSE) telemetry every 2s, Day/Night theme engine for field sunlight readability, synthesized Web Audio alarms (muted by default), active strobe incident banner with 1-click ACK, and an interactive streaming log console.
Live SSE Day/Night Mode Web Audio API Log Terminal
🛠️
Operational Tooling & Config Editor
1-to-1 operational tooling available via terminal CLI or in-browser. BIP-340 Secp256k1 keypair generator, Bech32 npub/nsec translator, SMS UCS-2 codec, SHA-256 hasher, and 256-bit PSK generator. Includes an in-dashboard TOML config editor with dry-run validation and automatic .bak backups.
Keygen Bech32 TOML Editor Dry-run Check
☁️
Cloud-Native Layered Configuration
Strict parity with py-phone-caller's Python Dynaconf engine powered by Rust's config crate. Multi-tier precedence supports static TOML files, turnkey deployment profiles (edge-sensor, mesh-repeater, central-gateway), and 12-Factor container environment overrides (OPENALERT_<SEC>__<KEY>). Enables pure ephemeral container execution with zero disk mounts.
Dynaconf Parity 12-Factor App Container Ready Turnkey Profiles

Quickstart & Building `openalertd`

Compiled with standard Rust tooling. Produces a single static executable with zero shared library or package dependencies. 

# 1. Clone the repository
git clone https://github.com/jcfdeb/py-phone-caller.git
cd py-phone-caller/src/openalert

# 2. Run the comprehensive test suite
cargo test

# 3. Build optimized release binary
cargo build --release

# 4. Install as systemd service (with optional Wi-Fi SOS Captive Portal on ARM field nodes)
sudo ./packaging/install.sh --with-wifi-ap

Operational CLI Commands

# Validate configuration syntax and active directories
openalertd check-config config/openalertd.toml

# Generate a full Nostr Secp256k1 identity (nsec, npub, and ready-to-paste TOML)
openalertd generate-keypair

# Convert 0xChat mobile npub or nsec into hex (and auto-derive pubkeys)
openalertd convert-key npub1uvtjer4wn7y2qpe4clvqd7qz7x483pthpngewqddc03xes39uq3sw9p5u6

# Transcode cellular SMS UCS-2 hex and international text
openalertd convert-sms "Critical alert ⚠️"

# Generate secure SHA-256 password hash for Web UI or /sos authentication
openalertd hash-password "yourTacticalPassword"

# Inspect live daemon status, peering links, and persistent spool
openalertd status
openalertd peers
openalertd spool

Production Turnkey Deployment Profiles

Pre-configured profiles in config/profiles/ tailored for diverse deployment environments:

Profile Target Environment Active Transports Security & Auth
edge-sensor.toml Off-grid remote sensor / SOS node (solar/battery) LoRa Serial + BitChat BLE + Wi-Fi /sos Captive Portal Pre-shared XChaCha20 key + Offline SVG CAPTCHA
mesh-repeater.toml Hilltop tower or tactical vehicle relay LoRa RF cluster bridged to LAN Ethernet backhaul Dynamic Distance-Vector routing
central-gateway.toml Operations Center (NOC) / Datacenter Web UI, Asterisk Telephony, Nostr Quorum, WireGuard Bearer Token & SHA-256 Basic Auth

Hardened Release & Quality Assurance

At milestone v0.2.0, openalertd is officially hardened and field-certified. All core protocols, hardware auto-recovery supervisors, RF telemetry algorithms, off-grid Wi-Fi SOS Captive Portals, and enterprise edge gateway integrations are fully tested and locked:

✅ 100+ Automated Tests
Zero test failures across unit and integration suites. Comprehensive test matrix covers kernel USB supervisor recovery, mock sysfs resolution, RF telemetry trailer codecs, quadratic link cost calculation, multi-hop mesh forwarding, split-horizon suppression, NIP-04/44/59 onion wrapping, offline SVG CAPTCHA verification, and live SSE streaming.
🦀 Zero Compiler Warnings
Strict adherence to idiomatic Rust standards enforced via cargo clippy -- -D warnings. Memory-safe, concurrency-safe with tokio and parking_lot.
📦 Self-Contained Binary
Entire Web UI, Emergency /sos Portal, Day/Night logo assets, Web Audio synthesizers, and SQLite schemas compiled directly into the executable. Runs seamlessly on bare-metal x86_64 and ARM64 Linux field kits.