Overview

Osiris is a production-grade OSINT platform that provides situational awareness across multiple intelligence domains. Built with Next.js 16 and MapLibre GL, every data point is rendered via WebGL for 60fps performance even with thousands of concurrent entities on-screen.

Key Capabilities

Architecture

┌─────────────────────────────────────────────────┐
│                  OSIRIS CLIENT                   │
│  ┌──────────┐  ┌──────────┐  ┌───────────────┐ │
│  │ MapLibre  │  │  HUD     │  │  RECON Toolkit│ │
│  │  GL (GPU) │  │ Panels   │  │  Port Scan    │ │
│  │  WebGL    │  │ Layers   │  │  DNS / WHOIS  │ │
│  │  Render   │  │ Controls │  │  Vuln Scanner │ │
│  └──────────┘  └──────────┘  └───────────────┘ │
├─────────────────────────────────────────────────┤
│               NEXT.JS API ROUTES                 │
│  /api/flights         /api/earthquakes          │
│  /api/cctv            /api/news                 │
│  /api/fires           /api/maritime             │
│  /api/gdelt           /api/satellites           │
│  /api/weather         /api/scanner              │
│  /api/sentinel        /api/telegram-feed        │
│  /api/osint/*  (whois, dns, ip, cve, sanctions, │
│                 crypto, sweep, threats, …)      │
├─────────────────────────────────────────────────┤
│              EXTERNAL DATA SOURCES               │
│  OpenSky · USGS · NASA · NOAA · TfL · NVD      │
│  GDACS · EONET · FIRMS · N2YO · RSS Feeds      │
│  blockstream.info · Blockscout · OpenSanctions  │
│  t.me public previews                            │
└─────────────────────────────────────────────────┘

Features

Intelligence Layers

• 16 toggleable data layers with real-time entity counts
• GPU-accelerated rendering — all map data rendered via WebGL, not DOM
• Progressive loading — data fetched on-demand when layers are activated
• Viewport-aware — only loads relevant data for the visible region

Texas CCTV

Public TxDOT ITS snapshots are integrated with the existing camera markers, preview grid and viewer. Use /api/cctv?region=texas for Texas only; global and Texas location queries include the same source. District inventories are cached independently, with stale data retained during outages. Availability varies by district and camera; these are refreshing JPEG snapshots, not video streams.

Source: TxDOT ITS.

Run npm test for offline checks or RUN_LIVE_TESTS=1 npx vitest run src/app/api/cctv/texas.test.ts to check the public Texas inventory.

RECON Toolkit

• Port Scanner — TCP connect scan with service fingerprinting
• DNS Lookup — Full record resolution (A, AAAA, MX, NS, TXT, CNAME)
• WHOIS — Domain/IP registration data (auto-cross-checked against OFAC SDN)
• SSL/TLS Inspector — Certificate chain analysis
• IP Intelligence — Geolocation, ASN, threat reputation (auto-cross-checked against OFAC SDN)
• Vulnerability Scanner — CVE lookup against NVD database
• Crypto Wallet Trace — BTC + ETH lookup (balance, tx history, OFAC SDN sanctions flag)
• OFAC Sanctions Search — query persons, organizations, vessels and aircraft against the US OFAC SDN list

Live Broadcast Network

• 23 live 24/7 news streams from global broadcasters
• Click any news dot on the map to open the live stream
• Feeds from NBC, CBS, ABC, Sky News, Al Jazeera, France 24, NHK, WION, and more

Telegram OSINT Layer

• Public-channel feed scraped from the unauthenticated t.me/s/<channel> web preview — no Bot API token, no MTProto
• Default curated set of 5 channels (EN + RU/UA war reporting), overridable via OSIRIS_TELEGRAM_CHANNELS
• Posts are geoparsed against a multilingual place dictionary (EN + Cyrillic + Arabic) and plotted on the map
• Click any cyan dot to read the post and jump to the original on Telegram

Crypto Wallet Intelligence

• BTC lookups via blockstream.info (Esplora API, keyless)
• ETH lookups via Blockscout's public ETH instance (eth.blockscout.com, keyless)
• Every lookup is cross-checked against the OFAC SDN sanctioned-address list (mirrored from 0xB10C/ofac-sanctioned-digital-currency-addresses)
• Sanctioned wallets surface a red SANCTIONED — OFAC SDN badge in the RECON panel

OFAC SDN Cross-Check

• Standalone SANCTIONS tab in the RECON toolkit — full-text search across persons, organisations, vessels and aircraft
• WHOIS and IP-intel routes auto-cross-check registrant / ASN-owner names against the SDN list and surface an inline alert
• Data sourced from OpenSanctions (CC-BY 4.0) — keyless, ~7 MB cached in-memory for 24h

Conflict Zone Monitoring

• 13 active conflict/tension zones with severity-coded warning markers
• Active Wars: Ukraine, Gaza, Sudan, Myanmar, DRC, Yemen
• High Tension: Syria, Lebanon, Sahel, Somalia, Red Sea
• Elevated: Taiwan Strait, Korean DMZ

Performance Optimized

• 75% reduction in edge requests vs initial release
• Aggressive polling relaxation (15-30 min intervals for stable data)
• Static data served from memory (zero external API calls for news feeds)
• layerFetchedRef prevents duplicate API requests

Quick Start

git clone https://github.com/simplifaisoul/osiris.git
cd osiris
npm install
npm run dev

Open http://localhost:3000

Docker / Self-Hosting

git clone https://github.com/simplifaisoul/osiris.git
cd osiris
cp .env.template .env     # optional — configure keys / port
docker compose up -d

Open http://localhost:3000. The image is a multi-stage node:22-alpine standalone build (~220 MB, non-root). The compose file also carries CasaOS app metadata (x-casaos:) for one-click install on CasaOS. See DOCKER.md for the full Docker, CasaOS and API-key guide.

Prebuilt image (GHCR) — skip the build and pull it directly:

docker pull ghcr.io/simplifaisoul/osiris:latest
docker run -d -p 3000:3000 --env-file .env ghcr.io/simplifaisoul/osiris:latest

Custom port — the container always listens on 3000; set OSIRIS_PORT in .env to change the published host port (e.g. OSIRIS_PORT=3005) without editing the compose file.

Environment Variables

OSIRIS works partially without any API keys — all core feeds use public, keyless sources. Copy .env.template to .env and set only what you need:

# Published host port (container always listens on 3000). Default: 3000
OSIRIS_PORT=3000

# RECON scanner backend (the only vars the current code reads).
# SCANNER_KEY must match the backend's OSIRIS_KEY — generate with: openssl rand -hex 32
SCANNER_URL=
SCANNER_KEY=

# Optional, for higher rate limits / future sources (see DOCKER.md for signup links)
FIRMS_API_KEY=                # NASA FIRMS  — firms.modaps.eosdis.nasa.gov/api/map_key/
OPENSKY_CLIENT_ID=            # OpenSky OAuth2 (since Mar 2025) — opensky-network.org
OPENSKY_CLIENT_SECRET=
N2YO_API_KEY=                 # N2YO satellites — n2yo.com (Profile → API key)
AIS_API_KEY=                 # aisstream.io maritime

Without SCANNER_URL/SCANNER_KEY the RECON toolkit returns 503; every other layer works out of the box. .env is gitignored — only the template is committed.

Tech Stack

Keyboard Shortcuts

Acknowledgements

Public webcams — the cameras in this layer are open data: each one is broadcast publicly by whoever runs it, on their own site or their own channel. What the web lacked was a catalogue of them.

bekijkhet.nu is that catalogue, and it is the basis for every camera in the layer. Bram and Annelies have kept it by hand since 2012, and without their index these cameras would still be scattered across several hundred unrelated sites with no way to find them.

OSIRIS links every one of them straight through to the operator who runs it, which is also how bekijkhet.nu asks to be read.

License

MIT — see LICENSE for details.