Kastamonu Municipality Smart City, Digital Archive and Project Management: Rust, RustGIS and Quantum-Resistant Cryptography

Summary: For many years, local governments' IT infrastructures have been managed with cumbersome, externally dependent software stacks that are vulnerable to cyber threats. In this article, I examine the Rust (2024 Edition) architecture I developed for the T.R. Kastamonu Municipality Presidency, which provides memory safety at compile time; the domestic RustGIS tile engine that removes dependency on external CDNs and map services; the Corporate Project Management System (PYS) integrated with Laws No. 5393 and 5018; the Digital Archive compliant with TS 13298; and the quantum-resistant hybrid cryptography based on NIST FIPS 203/204 standards.

CORE ARCHITECTURE HIGHLIGHTS

Full Rust Workspace Ecosystem: Memory safety and low response times with a modular Cargo workspace structure (kb-core, kb-crypto, kb-gis, kb-archive, kb-server).
RustGIS with Zero External Dependencies: An SVG/Vector-based local tile engine that eliminates the need for OpenStreetMap or Google Maps API and performs mathematical WGS84 - Web Mercator transformation within municipal boundaries.
26 Municipal Directorates & 2,060 Sensor Points: Live IoT telemetry and fleet tracking protocol allocated to 26 directorates, including Science Affairs, Water and Sewerage (KASKİ), Municipal Police, Fire Department and Parks and Gardens.
NIST FIPS 203 / 204 Quantum Resistance: Document and data security intended to be resistant to quantum computers through ML-KEM (Kyber) key exchange, ML-DSA (Dilithium) and Ed25519 hybrid signing.
Legislative Compliance: Law No. 5393 on Municipalities (Article 41), Law No. 5018 on Public Financial Management (Article 9 budget allocation and blocking controls), Law No. 6698 on KVKK automatic data masking, TS 13298 and Law No. 3473 archive retention plan.

Introduction: The Paradigm Shift in Modern Public IT

Local governments manage intensive data flows across dozens of different areas that directly concern citizens' daily lives (infrastructure, transportation, zoning, social assistance, municipal police inspections and disaster management). The architectural weaknesses frequently encountered in traditional municipal software are as follows:

High Resource Consumption and Crash Risks: Services running on interpreted languages or virtual machines (JVM, Node.js, Python) consume excessive memory, crash under sudden load fluctuations, and disrupt real-time telemetry due to "garbage collector" pauses.
External Map and CDN Dependencies: Tiles used on smart city screens are fetched from foreign servers; this paralyzes crisis coordination during internet outages or possible embargo situations.
Post-Quantum Cyber Threats (Q-Day): The risk that title deed, zoning and corporate archive records lose their confidentiality because classical RSA or pure ECC algorithms can be reversed by future quantum computers (Shor's Algorithm).
Design Disconnected from Legislation: Budget and project modules fail to meet the analytical budget coding and performance program hierarchy required by Laws No. 5018 and 5393.

To eliminate these chronic problems, we built the platform we developed for the T.R. Kastamonu Municipality Presidency from the ground up on the Rust programming language, security-focused design principles and a local geographic information system.

1. Rust Workspace Architecture and Layered Design

Instead of a complex monolithic structure, the system is built with a Cargo Workspace architecture in which each component can be tested and compiled independently and delivers high performance:

crates/
├── kb-crypto/   # Kuantum sonrası kriptografi, erişim denetimi ve WORM denetim izi
├── kb-core/     # 5393/5018 Mevzuat modelleri, analitik bütçe, EVM ve KVKK motoru
├── kb-gis/      # RustGIS motoru, koordinat projeksiyonu, 26 müdürlük & sensör telemetrisi
├── kb-archive/  # TS 13298 / 3473 Sayılı Kanun standartlı dijital arşiv ve devir-teslim
└── kb-server/   # Tokio & Axum tabanlı asenkron mikroservis çekirdeği ve statik dağıtım

Memory Safety and the Zeroize Principle

Cryptographic keys and session tokens in public archives cannot be left in RAM after the operation ends. All key and seal objects in the kb-crypto library are equipped with the zeroize trait in accordance with FIPS 140-3 requirements. Objects that go out of scope are securely zeroed and cleared from memory.

2. Zero-Dependency Urban Geographic Information System with RustGIS

The backbone of smart cities is the map. It is critically important for a municipality to be able to serve maps even during a disaster when international connections are cut.

In the project, a fully local map tile handler and coordinate transformer was developed based on the principles of opengeos/RustGIS.

pub struct RustGisEngine {
    pub min_zoom: u8,
    pub max_zoom: u8,
    pub center_lat: f64, // Kastamonu: 41.3887° K
    pub center_lon: f64, // Kastamonu: 33.7827° D
}

Mathematical Coordinate Transformation: WGS84 ellipsoid coordinates (latitude/longitude) are transformed into the Web Mercator (EPSG:3857) projection using mathematical formulas: $$x = \left\lfloor \frac{\text{lon} + 180}{360} \times 2^z \right\rfloor, \quad y = \left\lfloor \left( 1 - \frac{\ln(\tan(\text{lat}{\text{rad}}) + \sec(\text{lat}{\text{rad}}))}{\pi} \right) \times 2^{z-1} \right\rfloor$$
Built-in SVG and PNG Tile Generation: Vector topography, street grids and municipal service buildings are rendered on the server and served to the client without sending requests to external servers.
Telemetry from 26 Directorates: From the asphalt crews of the Public Works Directorate to Fire Department response vehicles, from Water Failure field crews to Municipal Police patrols, 2,060 active IoT sensor points belonging to 26 directorates are directly connected to the map layer.

3. Post-Quantum Cryptography: NIST FIPS 203 and FIPS 204 Shield

Classical encryption methods will become ineffective with the advancement of quantum computers (Shor's algorithm). Property deeds, council decisions and citizen data in Kastamonu Municipality's digital archive must be protected starting today against "Harvest Now, Decrypt Later" (Harvest Now, Decrypt Later) attacks.

In our system, NIST FIPS 203 (ML-KEM / Crystals-Kyber) and NIST FIPS 204 (ML-DSA / Crystals-Dilithium) standards are hybridized with Ed25519:

Hybrid Sealing: Every institutional document is signed both with the classical Ed25519 private key and with a lattice-based post-quantum private key. A document cannot gain validity unless both signatures are valid at the same time.
Dual Cryptographic Digest (Dual-Hash): The integrity of documents is sealed in two layers with the SHA-256 and quantum-resistant SHA3-256 (Keccak-256) algorithms.
Court of Accounts-Compliant WORM (Write Once, Read Many) & Merkle Tree: Every operation on the archive is linked to an immutable Merkle Tree structure. Any possible manipulation attempted directly on the database is detected instantly through a Merkle root hash mismatch, and the system enters an alarm state.

4. Corporate Project Management (PYS) Fully Integrated with T.R. Legislation

Project management in public institutions differs from standard Kanban or Scrum boards in the private sector. The laws of the Republic of Turkey mandate strict rules and audits in the use of public resources.

Within the kb-core module, these rules are directly embedded in the Rust type system:

Municipal Law No. 5393 (Article 41 - Strategic Plan)

All municipal projects must be linked to the hierarchy of Strategic Goal (SA), Strategic Target (SH) and Performance Indicator (PG). No municipal project that is not linked to a target is allowed to be opened in the system.

Public Financial Management and Control Law No. 5018 (Article 9 - Budget Block Control)

Before expenditure approval or a tender is initiated within a project, whether sufficient appropriation exists in the relevant analytical budget line is checked in software:

Analytical Budget Code Validation: The format Institutional (02.37.00.02) - Functional (01.3.9.00) - Financing (5) - Economic (03.5.1.01) is validated.
Block Engine: When an expenditure is initiated, the relevant amount is blocked from the budget. Requests exceeding the budget are rejected.

Earned Value Analysis (EVM - Earned Value Management)

The physical and financial progress of projects is monitored in real time using the following formulas:

Cost Performance Index: $\text{CPI} = \frac{\text{EV}}{\text{AC}}$
Schedule Performance Index: $\text{SPI} = \frac{\text{EV}}{\text{PV}}$

This allows the municipal administration to instantly track which project has exceeded its budget or fallen behind schedule.

5. Digital Archive System in Accordance with TS 13298 Standards

The document management of municipal units has been digitized within the framework of the TS 13298 Electronic Document and Archive Management System Standard and the provisions of Law No. 3473.

Transfer-Handover Protocol (Form 1): When documents are transferred from unit archives to the institutional archive, the standard transfer-handover form required by legislation is generated automatically.
Retention and Disposal Plan: Retention plans are calculated automatically according to the type of document (Zoning: Indefinite, Personnel Records: 101 Years, Financial Documents: 10 Years); no document can be deleted without a decision of the disposal commission.
Bell-LaPadula Confidentiality and Biba Integrity Model: By applying these two models, which are widely used in information security, "No Read Up" (No Read Up) and "No Write Down" (No Write Down) prevent lower-privileged personnel from leaking documents of higher confidentiality.
KVKK Masking under Law No. 6698: Citizens' T.R. identity and phone numbers are displayed masked on personnel's screens.

6. End-to-End Verification: Council and Jev Audit Report

The system has been subjected to a comprehensive integration test suite in line with the directives of the "Software Council" and "Chief Auditor Jev" (crates/kb-server/tests/test_konsey_jev_audit.rs).

running 14 tests
test tests::test_5018_analitik_butce_bloke_yetersiz_bakiye ... ok
test tests::test_5018_analitik_butce_bloke_onay_akisi ... ok
test tests::test_5393_madde41_stratejik_hedef_baglantisi ... ok
test tests::test_bell_lapadula_no_read_up_guvenlik_ihsasi ... ok
test tests::test_biba_butunluk_no_write_up ... ok
test tests::test_merkle_tree_ve_worm_degismezlik_dogrulamasi ... ok
test tests::test_post_quantum_fips203_fips204_hibrit_muhur ... ok
test tests::test_rustgis_koordinat_ve_kiremit_donusumu ... ok
test tests::test_sayistay_worm_tamper_tespiti ... ok
test tests::test_ts13298_ve_3473_saklama_plani ... ok
test tests::test_ts13298_form1_devir_teslim_tutanak_dogrulama ... ok
test tests::test_26_mudurluk_telemetri_ve_filo_takibi ... ok
test tests::test_kvkk_6698_otomatik_maskeleme ... ok
test tests::test_evm_kazanilmis_deger_analizi_metrikleri ... ok

test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out

The tests confirm that the legislative rules and cryptographic operations work as expected.

My reading

This platform, which I developed for Kastamonu Municipality, is a concrete example of how local governments can build their own infrastructure without depending on foreign cloud and map services.

When Rust's memory safety, local mapping with RustGIS and quantum-resistant cryptography come together, a long-lasting and secure infrastructure emerges for public institutions.

All source code, architecture documentation and installation guides can be reviewed as open source:

I look forward to your opinions and contributions.