inecs
cbd0adca91
Stateful FastAPI lab with contract packs, Compose/Helm, Docker Hub release targets, and Pulumi coverage across all Engine series (GET/POST/PUT/DELETE/HEAD).
35 lines
1.1 KiB
Markdown
35 lines
1.1 KiB
Markdown
**Language / Язык:** [English](security.md) | [Русский](ru/security.md)
|
|
|
|
# Security
|
|
|
|
This project is a **laboratory simulator**, not a hardened Engine deployment.
|
|
|
|
## Credentials
|
|
|
|
Default seeded password is `secret` for all lab users. Treat Compose TLS
|
|
certificates under `docker/tls/` as **dev-only**.
|
|
|
|
## Signing key
|
|
|
|
`TICKET_SIGNING_KEY` / Helm `secrets.ticketSigningKey` must be rotated on any
|
|
shared or long-lived cluster. The `.env.example` value is intentionally weak.
|
|
|
|
## Network exposure
|
|
|
|
Only publish Engine + UI ports to trusted networks. Do not expose the simulator
|
|
to the public Internet without additional controls.
|
|
|
|
## TLS
|
|
|
|
Compose gateway presents a local self-signed certificate on
|
|
`OVIRT_ENGINE_PORT`. Use `curl -k` / client `insecure` flags in labs, or replace
|
|
the certs under `docker/tls/`.
|
|
|
|
## Threat model (lab)
|
|
|
|
| In scope | Out of scope |
|
|
|---|---|
|
|
| Auth shape (Basic / OAuth) for client testing | Real AAA / AD / IPA integration |
|
|
| Isolating toy credentials in docs | Production secret management |
|
|
| Avoiding accidental public bind | Full Engine hardening checklist |
|