Concelier FSTEC BDU Connector - Operations Runbook

Last updated: 2026-06-05

This runbook is for operators who run the FSTEC BDU connector in a Stella Ops Concelier instance, including air-gapped and regionally constrained deployments. It covers configuration, the mirror-fallback policy and its legal constraints, offline operation, and a repeatable local end-to-end proof.

1. Overview

The FSTEC BDU connector ingests the Russian BDU vulnerability database and maps entries to canonical IDs.

The official FSTEC XML archive remains the only authoritative BDU package. Mirror fallback is available only to keep operator-approved deployments moving when bdu.fstec.ru is unreachable from the deployment network.

2. Authentication

• No authentication required for public feeds unless a regional mirror enforces access controls.

3. Configuration (concelier.yaml)

concelier:
  sources:
    fstec-bdu:
      baseUri: "<fstec-bdu-feed-base>"
      maxDocumentsPerFetch: 20
      fetchTimeout: "00:00:45"
      requestDelay: "00:00:00"
      mirrorFallbackEnabled: false
      cyberosnovaBaseAddress: "https://sgrc.cyberosnova.ru/"
      securitmBaseAddress: "https://service.securitm.ru/"
      mirrorSeedBduIds: ""
      securitmListingDiscoveryEnabled: false
      maxMirrorRecordsPerFetch: 25
      mirrorRequestDelay: "00:00:02"
      cacheDirectory: "/var/lib/concelier/jobs/cache/ru-bdu"

4. Offline and air-gapped deployments

• Mirror BDU data into the Offline Kit and repoint baseUri to the mirror. See the mirror operations guide for staging and verification steps.
• Prefer the official vulxml.zip package in the Offline Kit. Mirror-derived HTML payloads may be staged only as fallback cache material and must keep their raw HTML hash and retrieval URL.
• In the default compose stack, persisted connector cache files must live under /var/lib/concelier/jobs/cache/ru-bdu. The jobs volume is owned by the Concelier runtime user and survives container replacement.

5. Mirror fallback policy

In approved deployments, Stella Ops tries BDU sources in this order:

1. Official FSTEC BDU XML archive at https://bdu.fstec.ru/files/documents/vulxml.zip.
2. Cyberosnova SGRC BDU detail pages, configured by cyberosnovaBaseAddress.
3. SECURITM BDU catalogue detail pages, configured by securitmBaseAddress.

Mirror records are stored under the canonical source key fstec-bdu, but their provenance is not treated as official FSTEC ingestion. Canonical references and provenance use this wording:

Source authority: FSTEC BDU
Retrieved from: Cyberosnova mirror / SECURITM mirror
Official verification: pending
Conformance claim: not claimed against official FSTEC package

Operational constraints:

• Keep mirrorFallbackEnabled=false unless legal/export-control review allows the deployment to use RU BDU sources.
• Use mirrorSeedBduIds for targeted fallback refreshes. Enable SECURITM listing discovery only when the operator has approved catalogue discovery.
• Keep mirrorRequestDelay non-zero in production and avoid parallel mirror scraping.
• Never bypass login walls, bot challenges, or CAPTCHAs.

6. Common failure modes

• Regional mirror availability.
• Non-standard identifier formats.
• Official archive TLS/root trust gaps. Configure the operator trust anchors directory with the official FSTEC roots.
• Cache path permission errors. Fresh compose installs set Concelier__Sources__FstecBdu__CacheDirectory to /var/lib/concelier/jobs/cache/ru-bdu; do not point it at /app/cache unless the image explicitly makes that path writable for the Concelier runtime UID.
• Mirror fallback records remain mirror_unverified until reconciled with the official XML archive.

7. Repeatable local E2E proof

Use the local harness when validating a rebuilt Concelier image against the compose stack:

powershell -NoProfile -ExecutionPolicy Bypass -File devops\mirror\test-bdu-mirror-fallback-e2e.ps1

The script is offline-safe. It requires the local Stella Ops compose stack, the stellaops Docker network, stellaops-postgres, Concelier at http://127.1.0.9, Authority at http://127.1.0.4:8440, and a pre-existing local nginx:1.27-alpine image. It does not pull images or call external FSTEC, Cyberosnova, or SECURITM hosts.

The harness creates a temporary Nginx fixture where the official archive path returns 404 and the approved seed BDU:2026-03209 returns a synthetic Cyberosnova-style detail page. It then:

• applies temporary fstec-bdu runtime source settings through the Concelier API;
• runs source:fstec-bdu:fetch, source:fstec-bdu:parse, and source:fstec-bdu:map;
• asserts Postgres has a mapped ru-bdu document, DTO, and BDU:2026-03209 advisory with mirror_unverified provenance;
• checks fixture logs for official archive 404 and mirror seed 200;
• restores the temporary runtime settings in finally.

Evidence is written under <repo>\tmp\build\mirror\bdu-fallback-e2e\<timestamp>\bdu-mirror-fallback-e2e-result.json. Use -KeepFixture or -KeepRuntimeConfig only for debugging; normal runs clean up both.