Inventory

This inventory provides a detailed overview of the technical building blocks that constitute the Nexus SDV platform. It highlights the synergy between managed GCP services, existing open-source components, and the dedicated logic contributed by the Nexus project.

---

GCP Infrastructure

The foundation of the platform relies on managed Google Cloud services for enterprise-grade scalability and security.

• Cloud Bigtable: The primary high-performance data sink for vehicle telemetry and transactional data.
• Google Kubernetes Engine (GKE): The scalable compute runtime hosting the Nexus service mesh.
• Cloud SQL (PostgreSQL): Backs Keycloak and holds the fleet membership a user’s view is filtered by.
• Artifact Registry: Central management for container images and platform artifacts.
• Secret Manager: Secure storage for cryptographic keys and service credentials.
• Certificate Authority (CAS): Underpins the “Remote-only” PKI for vehicle identity.
• Cloud DNS: Manages service discovery and secure routing for external vehicle connectivity.

Infrastructure as Code: All resources are provisioned via Terraform. See the iac/terraform folder for details on Service Accounts and Networking.

---

Base Services

These services form the core of the Nexus platform. We distinguish between Nexus Open Source Contributions (developed specifically for this framework) and integrated Existing Open Source Components.

Nexus Open Source Contributions

These components were built from the ground up to enable the Nexus SDV architecture:

Component	Description
Registration Server	Handles factory trust verification and issues operational certificates.
NATS Auth Callout	Implements fine-grained, JWT-based authorization for the NATS messaging layer.
Data API	Provides a secure governance and access layer on top of raw Bigtable data.
Factory Helper	Issues per-vehicle factory identities on request, so onboarding needs no access to the Google Cloud project. Remote PKI only.
Vehicle Registry	Records every issued vehicle identity and enrols the vehicle into the platform’s fleet.
Data Converter	Translates inbound MQTT telemetry into the native protobuf format and publishes it to NATS.
FleetView	The platform’s web interface: vehicle identities, telemetry per device, GPS tracks. Deployed with every platform.

Existing Open Source Components

Nexus integrates these industry-standard tools to provide a robust backbone:

• NATS & nats-box: The distributed messaging system. nats-box is a utility container providing the NATS CLI and tools for monitoring and managing the cluster.
• nats-bigtable-connector: Streams NATS messages directly into Bigtable.
• Keycloak: The central Identity Provider (IdP) for OIDC-based authentication and token exchange.

---

Service Examples

To kickstart development, Nexus includes reference services that showcase platform integration.

• Data API Sampler: A blueprint for building custom services that leverage the Nexus Data API.
• Trip Analyzer: Calculates driving scores from live telemetry and publishes them back to the platform, where FleetView displays them.

---

Sample Clients

Functional reference implementations that demonstrate the required security handshakes and telemetry patterns.

• Python Client: A running software example in Python for vehicle simulation and platform interaction.
• Go Client: A running software example in Go demonstrating platform integration.
• IoT Client: Firmware for an ESP32 device — the complete edge-to-cloud path on real hardware, including deep sleep and GPS.
• Devices Client: A minimal Python device client, useful as the smallest possible starting point.
• Telemetry Subscriber: The consuming side — receives messages from NATS and shows how they are decoded.

---

Platform Tools

Scripts that operate a running platform. They live in the repository and are run against an existing deployment.

Tool	Purpose
nexus-preflight.sh	Read-only check of whether a Google Cloud project can take a platform at all: billing, APIs, permissions, local tooling, and whether one is already deployed there.
platform-health-check.sh	Verifies APIs, infrastructure, certificate expiry, endpoints and base services, and reports the result to a Cloud Monitoring dashboard. Runs at the end of every bootstrap.
nexus-cert-status.sh	Shows and renews the platform’s TLS certificates.
keycloak-provision-client.sh	Creates OIDC clients with realm roles, idempotently.
keycloak-provision-fleet-user.sh	Creates the FleetView group, its login user and the admin role.
run-vehicle-client-factory.sh, run-python-client-factory.sh	Walk the whole onboarding path — factory identity, registration, token, telemetry — without a Google Cloud account.