Sergey Antropoff
48df10b17e
- Harden DB-backed handlers and seed profiles; align client wire shapes for cluster resources, QEMU config, and node SSL fields - Serve plain HTTP on Compose :8006; keep TLS optional (--profile tls) and terminate HTTPS at Kubernetes Ingress - Add pulumi-tests (full contract surface majors 6–9 + BPG lifecycle) and make pulumi-tests - Ship bilingual docs, CHANGELOG, SECURITY, CONTRIBUTING, and GitHub Actions (make ci + Compose/Helm validation)
50 lines
2.0 KiB
Markdown
50 lines
2.0 KiB
Markdown
**Language / Язык:** [English](security.md) | [Русский](ru/security.md)
|
|
|
|
# Security
|
|
|
|
Repository policy and reporting: [SECURITY.md](../SECURITY.md).
|
|
|
|
## Lab threat model
|
|
|
|
This project is a **local / CI laboratory simulator**. It is not hardened as a
|
|
multi-tenant public Proxmox service. Default credentials, UI demo controls, and
|
|
compatibility endpoints are convenient for development and intentionally open
|
|
in the default Compose stack.
|
|
|
|
Do not expose port `8006` to untrusted networks without additional controls you
|
|
supply yourself. Host `:8006` is plain HTTP in Compose (real PVE uses HTTPS on
|
|
that port). Host `:8007` is **not** used by this stack (on hardware it is
|
|
typically PBS). See [Ports and TLS](configuration.md#ports-and-tls).
|
|
|
|
## Credentials and secrets
|
|
|
|
- Passwords and API-token secrets are stored as scrypt hashes.
|
|
- Ticket values are HMAC-signed and short-lived.
|
|
- CSRF binds mutations to ticket sessions.
|
|
- Logs redact recognized ticket, password, and token representations.
|
|
- Create/regenerate token responses show the secret once; GET never echoes it.
|
|
|
|
Change `TICKET_SIGNING_KEY` for any shared lab. Replace seeded passwords and
|
|
tokens before demoing to others.
|
|
|
|
## TLS materials
|
|
|
|
`docker/tls/` contains a checked-in self-signed certificate for the optional
|
|
Compose TLS gateway (`--profile tls` on `:8443`). It exists so unmodified TLS
|
|
clients (e.g. proxmoxer) can connect when that profile is enabled. **Never**
|
|
reuse these files in production.
|
|
|
|
## Simulator administration
|
|
|
|
There is currently **no** separately authenticated `/_simulator` control plane.
|
|
Web UI helper routes under `/ui/api/*` and `/admin/compatibility*` are available
|
|
whenever the process is reachable. Treat network exposure as the trust
|
|
boundary.
|
|
|
|
## Simulated remotes
|
|
|
|
LDAP sync stamps, OpenID pending state, ACME, and Ceph endpoints persist local
|
|
simulator state only. They do not open real connections to external IdPs or
|
|
clusters. Do not rely on the simulator for testing live credential exfiltration
|
|
defenses against real providers.
|