Sergey Antropoff
777926487b
initial QEMU slice, backed by imported contracts for majors 6–9. - Implement durable handlers for access/auth, cluster, LXC, storage, HA, firewall, Ceph, SDN, ACME, notifications, pools, mapping, and node ops - Serve an interactive Web UI with catalog browsing, demo seed controls, and OpenAPI/help surfaces - Bundle PVE 6.4-15, 7.4-16, and 8.4.5 contract revisions alongside 9.2.3 - Support in-memory runtime contract Apply (POST /ui/api/contract/apply) so /version and /api2 routes follow the selected major until restart - Expand seed profiles (including demo-cluster), migrations 007–008, TLS gateway config, Compose/Makefile tooling, and compatibility evidence - Tighten .gitignore for macOS, hidden directories (.*/), and local secrets
43 lines
1.6 KiB
Markdown
43 lines
1.6 KiB
Markdown
# Security
|
|
|
|
## Lab threat model
|
|
|
|
This project is a **local / CI laboratory simulator**. It is not hardened as a
|
|
multi-tenant public Proxmox service. Default credentials, UI demo controls, and
|
|
compatibility endpoints are convenient for development and intentionally open
|
|
in the default Compose stack.
|
|
|
|
Do not expose ports `8006` / `8007` to untrusted networks without additional
|
|
controls you supply yourself.
|
|
|
|
## Credentials and secrets
|
|
|
|
- Passwords and API-token secrets are stored as scrypt hashes.
|
|
- Ticket values are HMAC-signed and short-lived.
|
|
- CSRF binds mutations to ticket sessions.
|
|
- Logs redact recognized ticket, password, and token representations.
|
|
- Create/regenerate token responses show the secret once; GET never echoes it.
|
|
|
|
Change `TICKET_SIGNING_KEY` for any shared lab. Replace seeded passwords and
|
|
tokens before demoing to others.
|
|
|
|
## TLS materials
|
|
|
|
`docker/tls/` contains a checked-in self-signed certificate for the local
|
|
gateway. It exists so unmodified TLS clients (e.g. proxmoxer) can connect.
|
|
**Never** reuse these files in production.
|
|
|
|
## Simulator administration
|
|
|
|
There is currently **no** separately authenticated `/_simulator` control plane.
|
|
Web UI helper routes under `/ui/api/*` and `/admin/compatibility*` are available
|
|
whenever the process is reachable. Treat network exposure as the trust
|
|
boundary.
|
|
|
|
## Simulated remotes
|
|
|
|
LDAP sync stamps, OpenID pending state, ACME, and Ceph endpoints persist local
|
|
simulator state only. They do not open real connections to external IdPs or
|
|
clusters. Do not rely on the simulator for testing live credential exfiltration
|
|
defenses against real providers.
|