How ziro-os/pkgs works
This repository is Ziro OS’s official plugin catalog and a separately published WAF ruleset. The user workflow is to use ziroctl to discover and enable a plugin, or update gateway WAF rules; the README documents signed catalogs and host-side verification. The graph shows the documented capabilities and trust/distribution boundary. No source excerpts were available, so relationships rely on the README; implementation-level calls and internal runtime layers cannot be established.
Main entry points: catalog.pub Catalog public key · s3-ziro/manifest.json S3 storage · rclone-ziro/manifest.json rclone · rules.json WAF rules
Components 14
Plugins
- Plugin catalog
modules - S3 storage
modules/s3-ziro/manifest.json - Cloudflare Tunnel
modules/cloudflared/manifest.json - Tailscale
modules/tailscale/manifest.json - rclone
modules/rclone-ziro/manifest.json
Catalog trust
- Catalog public key
catalog.pub - Published plugin catalog
WAF rules
- Ziro gateway
- WAF rules
waf/zirogate-crs/rules.json - Published WAF catalog
Other components
- Operator
- ziroctl
- Garage service
- Backup operation
Connections 17
- Operator → ziroctl: runs commands
README.md - ziroctl → Published plugin catalog: searches and fetches
README.md - Published plugin catalog → ziroctl: serves signed index
README.md - Catalog public key → Published plugin catalog: signing key
README.md - ziroctl → S3 storage: enables plugin
README.md - ziroctl → Cloudflare Tunnel: enables plugin
README.md - ziroctl → Tailscale: enables plugin
README.md - ziroctl → rclone: enables plugin
README.md - S3 storage → Garage service: runs as
README.md - Operator → Backup operation: creates backup
README.md - Backup operation → rclone: uses remote
README.md - Operator → ziroctl: requests WAF update
README.md - ziroctl → Published WAF catalog: fetches rules
README.md - Published WAF catalog → WAF rules: publishes rules
README.md - Catalog public key → Published WAF catalog: signing key
README.md - Ziro gateway → Published WAF catalog: checks for updates
README.md - Ziro gateway → WAF rules: validates and installs
README.md