DevOpsTools/proxmox-api-simulator
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Prepare 0.1.0 for lab release: durable handlers, HTTP Compose, CI, and pulumi-tests.

Browse Source 
- Harden DB-backed handlers and seed profiles; align client wire shapes for
  cluster resources, QEMU config, and node SSL fields
- Serve plain HTTP on Compose :8006; keep TLS optional (--profile tls) and
  terminate HTTPS at Kubernetes Ingress
- Add pulumi-tests (full contract surface majors 6–9 + BPG lifecycle) and
  make pulumi-tests
- Ship bilingual docs, CHANGELOG, SECURITY, CONTRIBUTING, and GitHub Actions
  (make ci + Compose/Helm validation)
This commit is contained in:
Sergey Antropoff
2026-07-18 04:18:05 +03:00
parent 777926487b
commit 48df10b17e
172 changed files with 7528 additions and 1208 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/security.md
+12 -5
View File
@@ -1,5 +1,9 @@
**Language / Язык:** [English](security.md) | [Русский](ru/security.md)
# Security
Repository policy and reporting: [SECURITY.md](../SECURITY.md).
## Lab threat model
This project is a **local / CI laboratory simulator**. It is not hardened as a
@@ -7,8 +11,10 @@ multi-tenant public Proxmox service. Default credentials, UI demo controls, and
compatibility endpoints are convenient for development and intentionally open
in the default Compose stack.
Do not expose ports `8006` / `8007` to untrusted networks without additional
controls you supply yourself.
Do not expose port `8006` to untrusted networks without additional controls you
supply yourself. Host `:8006` is plain HTTP in Compose (real PVE uses HTTPS on
that port). Host `:8007` is **not** used by this stack (on hardware it is
typically PBS). See [Ports and TLS](configuration.md#ports-and-tls).
## Credentials and secrets
@@ -23,9 +29,10 @@ tokens before demoing to others.
## TLS materials
`docker/tls/` contains a checked-in self-signed certificate for the local
gateway. It exists so unmodified TLS clients (e.g. proxmoxer) can connect.
**Never** reuse these files in production.
`docker/tls/` contains a checked-in self-signed certificate for the optional
Compose TLS gateway (`--profile tls` on `:8443`). It exists so unmodified TLS
clients (e.g. proxmoxer) can connect when that profile is enabled. **Never**
reuse these files in production.
## Simulator administration