NetOfNetBeckn Network-of-Networks PoC

At a glance ​

NetOfNet is a Beckn "Network of Networks" demo. A single client (AMUL App or MH VISTAAR) submits one search; the Amul BAP fans it out to two Beckn networks in parallel and aggregates the on_search callbacks side-by-side. (A BAP — Beckn Application Platform — is the standard Beckn role that bridges synchronous client apps to the async/callback world of a Beckn network.)

Two stages are live:

The whole thing runs on one Hetzner host (sdcrs-demo, 91.99.29.19), fronted by host nginx with per-subdomain Let's Encrypt certs. All bound to 127.0.0.1; nginx is the only 0.0.0.0 surface.

Try it ​

Browser ​

Open ui.netofnet.theflywheel.in, pick a persona, type any query, hit search. Stage (b.1) BPPs vary in how they treat the query string — Vistaar matches on message.intent.item.descriptor.name, the MH mock returns its full catalog regardless.

curl — end-to-end fan-out ​

curl -sS -X POST -H "Content-Type: application/json" \
  -d '{"persona":"amul","query":"KCC","user_id":"farmer-grape-47"}' \
  https://ui.netofnet.theflywheel.in/api/search | jq .

Expected (abridged):

{
  "elapsed_ms": 2605,
  "moa": {
    "context": {
      "domain": "schemes:vistaar",
      "bpp_id": "bpp-network-playground-sandbox-vistaar.da.gov.in"
    },
    "message": { "catalog": { "providers": [{
      "descriptor": { "name": "SchemeFinder" },
      "items": [{
        "id": "PMKISAN-101",
        "descriptor": { "name": "Kisan Credit Card", "short_desc": "..." }
      }]
    }] } }
  },
  "mh": {
    "context": { "domain": "retail", "bpp_id": "bpp-mh.netofnet.theflywheel.in" },
    "message": { "catalog": { "bpp/providers": [
      { "id": "mh-weather", "items": [{"id":"mh-w-basic","descriptor":{"name":"Weather Advisory (MH)"}}] },
      { "id": "mh-market",  "items": [{"id":"mh-m-prices","descriptor":{"name":"Mandi Prices (MH)"}}] }
    ] } }
  },
  "traces": {
    "moa": { "transaction_id": "...", "elapsed_ms": 2599, "label": "MOA — Vistaar Dev (Schemes)" },
    "mh":  { "transaction_id": "...", "elapsed_ms": 266,  "label": "MH (mock)" }
  }
}

Per-service probes ​

# Public callback URL (Vistaar Dev posts on_search here)
curl -sS https://bap-amul.netofnet.theflywheel.in/health
curl -sS https://bap-amul.netofnet.theflywheel.in/api/legs | jq .

# Real Vistaar Dev sandbox (no auth, accepts unsigned envelopes for now)
curl -sS -X POST -H "Content-Type: application/json" \
  -d '{
    "context": {"domain":"schemes:vistaar","action":"search","version":"1.1.0",
                 "bap_id":"amul-dev","bap_uri":"https://bap-amul.netofnet.theflywheel.in",
                 "transaction_id":"manual-1","message_id":"msg-1",
                 "timestamp":"2026-04-27T07:00:00.000Z","ttl":"PT10M"},
    "message": {"intent":{"category":{"descriptor":{"code":"schemes-agri"}},
                          "item":{"descriptor":{"name":"KCC"}}}}}' \
  http://43.205.18.120/search

# MH mock chain (host-bound)
curl -sS https://bap-mh.netofnet.theflywheel.in/api/legs   # not exposed; use bap-amul instead
curl -sS https://customdata-mh.netofnet.theflywheel.in/health

What we're talking to ​

The MOA leg's http://43.205.18.120/search is a BPP, not a Beckn gateway. The on_search callback comes from bpp-network-playground-sandbox-vistaar.da.gov.in (DA, GoI). So our MOA leg is BAP → BPP direct — no gateway tier in this demo.

That's a legitimate Beckn shape: a BAP that knows the BPP (from registry lookup or out-of-band) can call /search on it directly, ACK is synchronous, on_search arrives async on the BAP's own callback URL. Gateways are only needed when a BAP is broadcasting across many BPPs in a domain it doesn't yet know.

Topology ​

Public TLS termination + per-subdomain Let's Encrypt certs sit in front of the BAP (host nginx → 127.0.0.1:15010) — infra plumbing, not part of the Beckn protocol path. Skipped in the diagram so the protocol shape stays legible.

Stage (b.1) end-to-end sequence ​

Stage (a) sequence — both legs mocked (retained for reference) ​

Per-leg config flow inside the Amul BAP ​

What's running ​

Containers across three docker-compose stacks on sdcrs-demo. Amul BAP + UI on amul and platform; the mocked MH chain on mh. The MOA mocks were retired in stage (b.1) — source preserved under networks/_archive/moa-mock/ for reproducing stage (a).

Operations ​

# Bootstrap (idempotent)
ansible-playbook ansible/playbooks/site.yml

# After a code change
git push && ansible-playbook ansible/playbooks/deploy.yml

# Read-only smoke (no mutations)
ansible-playbook ansible/playbooks/verify.yml

verify.yml from a cold cache reports ok=20 failed=0 rescued=0.

Deliberate non-goals at stage (b.1) ​

• TLS between internal services, Vault-managed keys (stage c).
• Real registrar approval flow + signed-envelope verification by the Vistaar BPP. The sandbox accepts unsigned envelopes; a production-style ceremony comes with stage (b.2) integration with a real MH-side network.
• OTEL / Jaeger / Grafana — queued as the next additive increment (beckn-onix already ships collector configs).
• Helm charts and CI/CD — stage (c).

Links ​

• Repo: github.com/ChakshuGautam/netofnet-beckn-poc (current tag stage-b1-v1, 30+ commits)
• Spec: docs/superpowers/specs/2026-04-16-beckn-non-stage-a-design.md
• Implementation plan: docs/superpowers/plans/2026-04-16-stage-a-implementation.md
• Schema notes (gotchas hit during build): docs/build-notes.md
• All sequence diagrams: docs/sequences.md