Owner: Matthew (SIRO) · Maintained by: Hermes with OpenCode · This review: 18 October 2026 · Next review: 18 January 2027 (quarterly)
Evidence for: item 8.1.4 / 8.2.1 — "IT systems and software are supported by the manufacturer, or the risks of any unsupported ones are documented and managed" (mandatory, Category 3). Feeds the "IT asset register showing OS versions and software inventory with support status" the standard asks for. The policy this evidences is 8. Unsupported Systems, which carried only an empty template until this page existed; updates are patched under 9b. Patching & Software Updates.
Scope. Our own estate: three hosts, the containers running on them, and the host tooling. Not in this register: client VPSs (they are client-owned; the managed patch service is declared here), staff laptops and phones (§8), and data assets — the information asset register for personal data is a separate document (§9).
Method. Everything below was measured live on the three hosts on 2026-10-18, not copied from an earlier review. Versions are read from the running container or the host; support status is taken from the upstream project's own lifecycle or release feed; image vulnerability counts are the weekly Trivy scan of 18 Oct 03:00 (62 images scanned, 38 actionable, 536 criticals across all of them). Support end dates are the vendor's published dates, not estimates.
| Host | OS | Kernel running | OS support ends | Patching route | Notes |
|---|---|---|---|---|---|
| Primary (gateway, data, AI) | Ubuntu 24.04.5 LTS | 6.8.0-142 — 6.8.0-147 installed, reboot pending since 14 Oct | Apr 2029 (ESM to 2034) | patch_monthly.sh 1st 02:00 + daily unattended-upgrades |
25 containers, 46 images, disk 122 G of 232 G (53%) |
| App engine (booking apps) | Ubuntu 26.04.1 LTS | 7.0.0-38 | Apr 2031 | patch-monthly.timer 1st 03:00 |
16 containers, 17 images; booted 14 Oct |
| Auxiliary (ERPNext) | Ubuntu 26.04.1 LTS | 7.0.0-38 | Apr 2031 | patch-monthly.timer 1st 04:30 (drop-in) |
8 containers; all healthy |
Both LTS releases are within standard vendor support. The operating systems are supported; the open item is the Primary's pending reboot (§6, A6).
| Component | Version running | Image pinning | Support status | Trivy criticals | Notes |
|---|---|---|---|---|---|
| PostgreSQL — central | 15 (pgvector/pgvector:pg15) |
Pinned by digest | Supported to Nov 2027 | 16 | Upgrade path to 16/17 to be planned before support ends |
| PostgreSQL — client DB | 15 (postgres:15-alpine) |
Floating minor tag | Supported to Nov 2027 | 1 | |
| Keycloak (identity) | 26.6.1 | Pinned by digest | Supported (26.x current) | 7 | Fix available in 26.6.6 — one keycloak-services CVE |
| Wiki.js (knowledge centre) | 2.5.314 | Pinned by digest | 2.x line — last 2.x release 2026-05-01; upstream now on 3.0 betas (672 on 16 Oct 2026) | 10 | Runs every wiki page and this document — see §6, A4 |
| LiveKit (media) | v1.13.5 | Pinned by digest | Supported | 0 | Clean |
| Forgejo (source control) | 16.0.2 | Pinned by tag | Supported | 0 | Clean |
| Forgejo database / Redis | postgres digest / 7-alpine | Mixed | Supported | 0 / 1 | |
| SeaweedFS (object store) | 4.48 | Pinned by tag | Supported | 0 | Clean; MinIO replacement |
| Netdata (monitoring) | nightly build (label nightly) |
Floating nightly | No pinned release | 6 | Its Docker collector caused the 11 Sep CPU burn — see §6, A3 |
| DefectDojo (vuln tracking) | digest-pinned, DD_VERSION not set in image |
Pinned by digest | Supported | 23 | Version to be read from the DefectDojo UI at next review |
| Roundcube (webmail) | latest |
Floating | Supported upstream | 30 | See §6, A2 |
| ERPNext v15 (on Primary) | 15.115.0 | Local tag erpnext_v15:latest |
Supported upstream | — | Stopped 2026-10-18 — pre-migration remnant, retained for rollback; live ERPNext is on the Auxiliary host (§6, A7) |
| AES services ×4 (PKI, signer, TSA, portal) | In-house builds, :latest |
Locally built | In-house — no upstream | 4–6 each | Pin by digest on next rebuild |
| Patient portal PWA | In-house | Locally built | In-house | 0 | Clean |
| Security dashboard | In-house | Locally built | In-house | 5 | |
| Synthetic portal rig (app + DB) | Test rig | Locally built | Test only — no personal data | 0 | Excluded from assurance scope |
| Component | Version running | Image pinning | Support status | Trivy criticals | Notes |
|---|---|---|---|---|---|
| GP booking app (Daphne + 2 Celery) | In-house build, Python 3.11.17 | Locally built | In-house; Python 3.11 supported to Oct 2027 | 13 per image | |
| Dental booking app (Daphne + 2 Celery) | In-house build, Python 3.11.16 | Locally built | In-house; Python 3.11 supported to Oct 2027 | 13 per image | One patch release behind the GP image |
| Pharmacy booking app (Daphne + 2 Celery) | In-house build | Locally built | In-house | — | |
| PgBouncer (connection pooler) | 1.26.0 | Floating latest |
Supported upstream | — | See §6, A5 |
| Redis ×3 | 7.4.10 | Floating 7-alpine |
Supported | 0 | Clean |
| Orthanc (DICOM) | built 2026-04-14 | Floating latest — legacy jodogne/orthanc |
Upstream now publishes orthancteam/orthanc (image current to 21 Sep 2026) |
10 | See §6, A8 |
| Ollama (dental embeddings) | 0.32.15 | Floating latest |
Supported upstream | 0 | Live and enabled here; the Primary installation was retired 18 Oct |
| MailHog (mail capture) | v1.0.1 — last release Aug 2020; no upstream commits since Feb 2024 | Floating latest |
Unsupported — unmaintained | 109 | See §6, A1 — the one genuinely unsupported system we run |
| Component | Version running | Support status | Notes |
|---|---|---|---|
| ERPNext web / scheduler / worker | 15.115.0 | Supported upstream (v15 branch) | Healthy |
| Redis / PostgreSQL | 7-alpine / 15-alpine | Supported | |
| Test-client rig (app + DB) | Test rig | Test only | No personal data |
| Tool | Version | Where | Support status |
|---|---|---|---|
| Docker Engine | 29.1.3 (Primary), 29.9.0 (App engine / Auxiliary) | All hosts | Supported |
| Trivy | 0.70.0 | Primary | Supported — weekly image scan |
| OWASP ZAP | ghcr.io/zaproxy/zaproxy:stable |
Primary | Supported — monthly DAST run; image retained deliberately, do not prune |
| nmap, Lynis | OS packages | Primary | Supported — weekly scans |
| # | Item | Why it is on this list | Treatment | Target |
|---|---|---|---|---|
| A1 | MailHog | No release since Aug 2020 and no upstream commit since Feb 2024 — it is unmaintained, and 109 criticals sit in the image. It is a development mail-capture service, holds no personal data, and is not reachable from outside the app network | Replace with a maintained capture service (Mailpit or equivalent), or restrict to the app stack only. Record the decision either way | Before next DSPT submission |
| A2 | Roundcube on a floating latest tag |
30 criticals, and a floating tag means the running version is whatever was last pulled | Pin by digest; raise the image refresh for webmail and decide whether webmail still earns its place | Next quarterly review |
| A3 | Netdata nightly | No pinned release; the Docker collector at its default interval caused the 11 Sep CPU incident | Pin a release tag and keep the 10 s collector interval | Next image refresh (2 Jan 2027) |
| A4 | Wiki.js 2.5.314 | 2.x receives no feature work — the last 2.x release was 1 May 2026 and upstream effort is on 3.0 (still beta, 672 builds, not production-ready) | Accepted risk for now: 2.5.314 is stable and the 3.0 line is beta. Re-assess when 3.0 ships a stable release. Compensating controls: wiki is internal-only, behind Keycloak | Re-assess at next quarterly review |
| A5 | Floating tags (edoburu/pgbouncer, ollama/ollama, redis:7-alpine, postgres:15-alpine, in-house :latest builds) |
A floating tag is an unreviewed upgrade on every pull — the supply-chain habit, not a fault in any one image | Pin by digest at the point each stack is next rebuilt; the app images already carry a build stamp | Rolling, at next rebuild of each stack |
| A6 | Primary reboot pending | Kernel 6.8.0-147 is installed but 6.8.0-142 is running; the marker dates from 14 Oct, after the 1 Oct patch reboot | Armed, awaiting trigger. /opt/scripts/post-reboot-verify.sh (version-controlled in veripath-ops/scripts, run at boot by post-reboot-verify.service) checks the kernel, container count, both tunnels, the database and five public endpoints, and writes /var/log/post-reboot-verify.log + /var/lib/post-reboot-verify.json. A baseline run on 18 Oct passed every check but the reboot marker itself. The reboot takes the whole platform down for ~2–4 minutes, including the agent session that would verify it, so the trigger is deliberate |
Next low-traffic window |
| A7 | ERPNext remnant on Primary | Not a duplicate in the loose sense — measured 18 Oct: the local container pointed at the retired client-DB gateway (port 5435, withdrawn 11 Oct), had failed 50,183 consecutive health checks, and could never have served traffic because 127.0.0.1:8005 is held by the tunnel to the live ERPNext on the Auxiliary host |
Done 18 Oct — erpnext_web stopped (erpnext_worker/erpnext_scheduler had exited two months earlier). Containers retained, not removed, for rollback. Verified after: accounts.veripath.co.uk still 200 through the tunnel |
Closed |
| A8 | Orthanc on the legacy image | jodogne/orthanc still publishes, but the maintained home is orthancteam/orthanc; our build is from April |
Move to the maintained image and pin it | Next dental release |
| A9 | Retired images retained | 46 images on the Primary for 26 running containers — including MinIO rollback copies (protected, keep), forgejo:14.0, postgres:15/16, older pgvector |
Prune the pure waste; keep the MinIO rollback image and the ZAP image by name. Decision with Matthew first | Open — carried from the 18 Oct capacity review |
| A10 | PostgreSQL 15 end of life | Community support ends Nov 2027, which is inside the life of the next DSPT submission cycle | Plan the major-version upgrade (16 or 17) for both clusters | Plan by mid-2027 |
| A11 | Python 3.11 in app images | Security support ends Oct 2027; the dental image also runs 3.11.16 while the GP image runs 3.11.17 | Fold into the app base-image refresh; align both to the same patch release | With the 2027 base-image refresh |
Nothing in this register fails the standard outright. Every system we run is within vendor support except MailHog (A1), which is documented and has a treatment. The risk items above are the "documented and managed" half of 8.2.1.
| Register | What it holds | Where |
|---|---|---|
| This page | Hardware and software: versions, support status, treatment | registers/it-asset-register |
| Information asset register (IAR) | Data assets and processing activities — patients, staff, suppliers | Information Asset Register and data processing activities |
| Access registers | Who can reach which system, by role | Access control register, administrator accounts, role access matrix |
| Supplier register | Who supplies what, and their assurance | Accountable suppliers |
| Date | Reviewer | What changed |
|---|---|---|
| 2026-10-18 | Hermes (measured live), for Matthew | First populated register. Replaces the empty template in the Standard 8 policy page. Hosts, all running containers, host tooling and 11 open treatments recorded; CVEs from the 18 Oct Trivy scan. Same day: A7 closed (ERPNext remnant stopped after measurement), A6 armed with a boot-time verification unit |