How Quickfire Cyber Bulletin Works
Architecture overview
Quickfire Cyber Bulletin is a Dockerised Python application designed to run resource-consciously on a shared VPS alongside other services.
┌──────────────┠┌──────────────┠┌──────────────â”
│ app │ │ worker │ │ postgres │
│ FastAPI │◄───│ Pipeline │───►│ PostgreSQL │
│ port 8000 │ │ + Scheduler │ │ database │
└──────────────┘ └──────────────┘ └──────────────┘
│ │
│ ┌──────┴──────â”
│ │ ollama │ (optional)
│ │ local LLM │
│ └─────────────┘
│
┌───────▼──────â”
│ Caddy │ HTTPS reverse proxy
│ qfb.dmj │ DNS via Cloudflare
│ now.com │
└──────────────┘
Daily pipeline schedule (UTC)
| Time | Step | Description |
|---|---|---|
| 06:00 | fetch_sources | Fetch CISA KEV, NVD (last 25h), EPSS, GitHub Advisories, RSS feeds |
| 06:10 | enrich_cves | Link source items to vulnerability records |
| 06:15 | score_items | Calculate deterministic risk scores |
| 06:20 | generate_summaries | AI summarisation (only if ENABLE_LOCAL_AI=true) |
| 06:30 | generate_brief | Assemble ranked daily brief as draft |
| Manual | publish_brief | Admin reviews draft and publishes |
Pipeline runs at 06:00 UTC to avoid overlap with the nameetings.cloud pipeline running on the same VPS.
Resource-conscious design
- Public pages serve pre-generated database content — no live computation per visitor
- The local AI model (Ollama) runs only during the batch window, not all day
- Raw source payloads and fetch logs are pruned after 90 days
- No streaming AI — all generation happens in the background pipeline
- Docker services are scoped to their roles: web app, worker, database, optional AI
Local AI (optional)
When ENABLE_LOCAL_AI=true, the worker uses Ollama
to generate plain-language summaries. The default model is llama3.2:3b,
chosen to be conservative on shared server resources. qwen3:4b is supported
as a higher-quality option if the server has headroom.
If Ollama is unavailable or AI is disabled, the system falls back to template-based summaries automatically. The pipeline never fails because AI is unavailable.
Data flow
- Raw items arrive from public APIs and RSS feeds → stored in
source_items - CVE IDs are extracted from titles and text → linked to
vulnerabilities - Vulnerability records are enriched with CVSS (NVD), EPSS (FIRST), and KEV (CISA) data
- Deterministic risk scores are calculated from signal weights
- Items are assigned to brief sections by product category and score
- A draft brief is assembled and stored in
daily_briefs - Admin reviews the draft and publishes it
- Published brief is served from the database — no live computation
What this system does not do
- Does not scan your systems or network
- Does not perform vulnerability assessments
- Does not replace professional cybersecurity advice
- Does not monitor your specific software inventory
- Does not guarantee completeness — only covers configured public sources