🛡️ OpenCMMC Stack¶
A Free and Open-Source Infrastructure Guide for CMMC Level 2 Compliance
This project provides a complete, secure, and modular self-hosted architecture to help small and medium-sized DoD contractors meet the requirements of CMMC Level 2 using open-source tools.
📚 Guide Overview¶
🔧 Technologies Used¶
- Podman – Secure, rootless container runtime
- Keycloak – Identity provider with SSO and MFA
- Tailscale – Zero Trust VPN mesh
- Nextcloud-All-In-One – Secure document collaboration
- Mailcow – Self-hosted email
- Wazuh – SIEM and endpoint monitoring
- Ansible & Terraform – Infrastructure as Code
- Restic & BorgBackup – Secure backup solutions
- MkDocs + Mermaid – Documentation & diagrams
🧩 CMMC Domains Covered¶
This guide maps directly to all 14 CMMC Level 2 domains and their associated 110 practices as defined in NIST SP 800-171 Rev. 2.
📜 License¶
This project is released under the MIT License and is free to use, modify, and adapt.
🧠 Credits¶
Developed by cybersecurity professionals and community contributors focused on secure-by-design principles for the Defense Industrial Base.
For questions or contributions, please open an issue or submit a pull request.