v0.1.1-beta

Locking Down the Wire: TLS, SASL & Kerberos for Kafka 🔐

This release turns the Kafka connection from "trusted network only" into something you can actually run over the open wire or against a broker that requires authentication.

✨ Highlights

• 🔒 TLS support for the Kafka producer (kafka-tls feature) — CA/certificate/key files, with an optional encrypted key password
• 🔑 SASL authentication — PLAIN/SCRAM-SHA-256/SCRAM-SHA-512 out of the box, Kerberos GSSAPI (kafka-auth-gssapi) and OAuth 2.0/OIDC (kafka-auth-oauth) behind opt-in features
• 🧩 security.protocol auto-selection — plaintext/ssl/sasl_plaintext/sasl_ssl derived automatically from your [kafka.tls]/[kafka.auth] sections, no manual wiring
• 🗝️ SecretSource — every credential (password, token, key passphrase) can come from a literal, an environment variable, or a file
• 🛡️ Unix permission enforcement — NBD refuses to start if a secret-bearing file is group- or world-readable
• 🧹 Reduced secret retention — the Kafka client config and its copies are explicitly dropped from memory right after the producer is created
• ⚙️ Fully configurable producer tuning — compression, idempotence, linger, acks, queue size, and in-flight request limits are no longer hard-coded
• 🚀 New release.yml pipeline — tagged versions now build and publish automatically

🧹 Also in this release

• 🪵 Cleaner error reporting — fatal errors are now logged through the same tracing pipeline as the rest of the daemon's output (timestamped, leveled), with full context instead of a raw debug dump — e.g. TOML config errors now show the exact line/column and a source snippet

⚠️ Build note

The binaries attached to this release are the standard and with_metrics variants. TLS and SASL/Kerberos/OAuth support are currently opt-in at compile time — until dedicated prebuilt variants ship, build from source to enable them:

cargo build --release --features metrics-exporter,kafka-tls,kafka-auth-gssapi,kafka-auth-oauth

See the Configuration and Build sections of the README for the full [kafka.tls] / [kafka.auth] schema and feature flags.

🚧 Beta status

Still single-maintainer, best-effort. Config schema may keep evolving before 1.0. Feedback welcome via CONTRIBUTING.md; vulnerabilities via SECURITY.md.

---

📝 Full changelog: CHANGELOG.md

v0.1.0-beta

Zero-Copy Multicast-to-Kafka, ANSSI-Ready 🦀

Nothing But Data (NBD) is a lightweight, high-performance, security-hardened daemon that ingests real-time UDP multicast traffic and relays it to Apache Kafka — built in Rust for sub-millisecond latency in sensitive production environments.

This is the project's first tagged release: a beta, feature-complete for its core use case but still collecting real-world mileage before a stable 1.0.

✨ Highlights

• 🚀 Zero-copy pipeline — bytes::BytesMut split-and-freeze pattern from socket to Kafka producer, no unnecessary allocations on the hot path
• 📡 Multi-channel UDP multicast ingestion via socket2, with per-provider topic/group/interface configuration
• ⚙️ Two-stage TOML config validation — parse then validate, with sensible defaults and diagnostic warnings
• 🛑 Graceful shutdown via CancellationToken, draining in-flight messages before exit
• 📈 Optional Prometheus exporter (metrics-exporter feature) for packet, byte, and error counters
• 🖥️ Cross-platform — Linux and Windows, Tier 1 targets
• 🧰 CLI — --config-file, --check-config-file (dry-run validation), --about

🔐 Security & Compliance

• Tracks the ANSSI Secure Rust Development Guide — see SECURITY.md for the full compliance matrix
• #![forbid(unsafe_code)], overflow checks enabled in release builds, no unwrap() on production paths
• Supply-chain policy enforced via cargo-deny (license allowlist, no unvetted registries, yanked-crate ban)
• Ships a production-ready, hardened systemd unit (DynamicUser, ProtectSystem=strict, capabilities dropped)

📊 Performance

Benchmarked with a dedicated integration test suite (steady-state, burst, and multi-channel scenarios) reporting p50–p99.9 latency distributions. Full methodology and results in PERFORMANCE.md.

🚧 Beta status

This is a single-maintainer, best-effort project. The core pipeline is stable and tested, but the configuration schema and public API may still move before 1.0. Bug reports and feedback are very welcome — see CONTRIBUTING.md to get started, and SECURITY.md for responsible disclosure.

📦 Getting started

cargo build --release --features metrics-exporter
./target/release/nothing_but_data --config-file /path/to/config.toml

See the README for the full configuration reference and deployment guidance.

---

📝 Full changelog: CHANGELOG.md