# Security

## Lab threat model

This project is a **local / CI laboratory simulator**. It is not hardened as a
multi-tenant public Proxmox service. Default credentials, UI demo controls, and
compatibility endpoints are convenient for development and intentionally open
in the default Compose stack.

Do not expose ports `8006` / `8007` to untrusted networks without additional
controls you supply yourself.

## Credentials and secrets

- Passwords and API-token secrets are stored as scrypt hashes.
- Ticket values are HMAC-signed and short-lived.
- CSRF binds mutations to ticket sessions.
- Logs redact recognized ticket, password, and token representations.
- Create/regenerate token responses show the secret once; GET never echoes it.

Change `TICKET_SIGNING_KEY` for any shared lab. Replace seeded passwords and
tokens before demoing to others.

## TLS materials

`docker/tls/` contains a checked-in self-signed certificate for the local
gateway. It exists so unmodified TLS clients (e.g. proxmoxer) can connect.
**Never** reuse these files in production.

## Simulator administration

There is currently **no** separately authenticated `/_simulator` control plane.
Web UI helper routes under `/ui/api/*` and `/admin/compatibility*` are available
whenever the process is reachable. Treat network exposure as the trust
boundary.

## Simulated remotes

LDAP sync stamps, OpenID pending state, ACME, and Ceph endpoints persist local
simulator state only. They do not open real connections to external IdPs or
clusters. Do not rely on the simulator for testing live credential exfiltration
defenses against real providers.