Files

T

Sergey Antropoff 48df10b17e Prepare 0.1.0 for lab release: durable handlers, HTTP Compose, CI, and pulumi-tests.

- Harden DB-backed handlers and seed profiles; align client wire shapes for
  cluster resources, QEMU config, and node SSL fields
- Serve plain HTTP on Compose :8006; keep TLS optional (--profile tls) and
  terminate HTTPS at Kubernetes Ingress
- Add pulumi-tests (full contract surface majors 6–9 + BPG lifecycle) and
  make pulumi-tests
- Ship bilingual docs, CHANGELOG, SECURITY, CONTRIBUTING, and GitHub Actions
  (make ci + Compose/Helm validation)

2026-07-18 04:18:05 +03:00

2.0 KiB

Raw Blame History

Language / Язык: English | Русский

Security

Repository policy and reporting: SECURITY.md.

Lab threat model

This project is a local / CI laboratory simulator. It is not hardened as a multi-tenant public Proxmox service. Default credentials, UI demo controls, and compatibility endpoints are convenient for development and intentionally open in the default Compose stack.

Do not expose port 8006 to untrusted networks without additional controls you supply yourself. Host :8006 is plain HTTP in Compose (real PVE uses HTTPS on that port). Host :8007 is not used by this stack (on hardware it is typically PBS). See Ports and TLS.

Credentials and secrets

Passwords and API-token secrets are stored as scrypt hashes.
Ticket values are HMAC-signed and short-lived.
CSRF binds mutations to ticket sessions.
Logs redact recognized ticket, password, and token representations.
Create/regenerate token responses show the secret once; GET never echoes it.

Change TICKET_SIGNING_KEY for any shared lab. Replace seeded passwords and tokens before demoing to others.

TLS materials

docker/tls/ contains a checked-in self-signed certificate for the optional Compose TLS gateway (--profile tls on :8443). It exists so unmodified TLS clients (e.g. proxmoxer) can connect when that profile is enabled. Never reuse these files in production.

Simulator administration

There is currently no separately authenticated /_simulator control plane. Web UI helper routes under /ui/api/* and /admin/compatibility* are available whenever the process is reachable. Treat network exposure as the trust boundary.

Simulated remotes

LDAP sync stamps, OpenID pending state, ACME, and Ceph endpoints persist local simulator state only. They do not open real connections to external IdPs or clusters. Do not rely on the simulator for testing live credential exfiltration defenses against real providers.

2.0 KiB Raw Blame History