cloud.gov is built and maintained by 18F, which has an open source policy that guides our work: we use and develop open source software, and we encourage you to reuse and adapt our work.
cloud.gov is an open source project based on Cloud Foundry with additional components built by our team and other community members. This includes using open source for security: We use a combination of ClamAV, Tripwire and Snort on each system, with OpenZAP to do blackbox testing. We also run Prometheus and a full ELK stack with ElastAlert for additional monitoring and alerting. We do use use a commercial tool for CIS benchmarking and further blackbox testing. We welcome you to audit our security or contribute to it — or to make any other kind of contribution, from documentation to design.
If you’d like to contribute security research, see our vulnerability disclosure policy.
If you’re interested in contributing to cloud.gov but not sure where to start, or if you have questions about contributing, feel free to join the 18F DevOps or open source chat channels and explain your question. You can also open an issue with your question in a relevant repository.
To contribute to these repositories, you’ll need to use a GitHub account, which is free to open and use. If you’re part of the federal government, many agencies have approved use of public repository services such as GitHub (some examples here).
Here are many of our main repositories with components, tools, and configuration for the platform. This isn’t a complete or fully up-to-date list; we intend to continuously update it, but sometimes we fall behind a bit. You can find more cloud.gov repositories on GitHub.
Components run as applications on top of the platform, for users:
Components run as applications on top of the platform, for our team:
Custom components for our Cloud Foundry deployment:
- Infrastructure provisioning and deployment
- Common Concourse pipeline tasks
- Common Concourse resource
- Admin user interface
- Cloud Foundry
- Concourse task Docker image
- Nessus Manager
- RDS broker
- S3 broker
Metadata for our team, such as issues, checklists, and other documents:
Collections of scripts for our team:
Optional code offered to our team and customers:
Optional Cloud Foundry CLI plugins offered to our team and customers:
This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the CC0 1.0 Universal public domain dedication.
All contributions to this project will be released under the CC0 dedication. By submitting a pull request, you are agreeing to comply with this waiver of copyright interest.
Components based on work from other people may be in the public domain or have various open source licenses. All license details for each component are listed in the LICENSE file for that repository.