**Language / Язык:** [English](security.md) | [Русский](ru/security.md)

# Security

## Lab threat model

This project is a **local / CI laboratory simulator**. It is not hardened as
a multi-tenant public vCenter service. Default credentials, UI demo controls,
and compatibility endpoints are convenient for development and intentionally
open in the default Compose stack.

Do not expose ports `443` / `80` to untrusted networks without additional
controls you supply yourself.

## Credentials and secrets

- Passwords are stored as scrypt hashes (`vsphere_credentials.password_hash`).
- Session ids are opaque tokens (`vmware-api-session-id`) with a 2-hour
  sliding expiry, tracked in PostgreSQL (`vsphere_sessions`).
- Logs redact recognized session-id and password representations.
- Content library update/download session responses expose upload/download
  endpoints, not raw secrets.

Change `TICKET_SIGNING_KEY` for any shared lab. Replace seeded passwords
before demoing to others.

## TLS materials

`docker/tls/` contains a checked-in self-signed certificate for the local
`api-gateway` nginx service. It exists so unmodified TLS clients (pyvmomi,
govmomi, Terraform's `hashicorp/vsphere` provider) can connect with
`insecure`/`verify=False` set. **Never** reuse these files in production.

## Simulator administration

There is currently **no** separately authenticated admin control plane. Web
UI helper routes under `/ui/api/*` are available whenever the process is
reachable — including reseed and hot-swap actions. Treat network exposure as
the trust boundary.

## Authorization

Mutating REST endpoints check role-derived privileges
(`app/vsphere/security/authz.py`) before touching inventory. The seeded
`readonly@vsphere.local` principal cannot power on/create/delete VMs (HTTP
403). See [Authorization](domains/authz.md).

## Simulated remotes

NSX/Supervisor/vSAN/SAML-OIDC/VECS-certificate stand-ins (see
[API coverage](api-coverage.md)) persist local simulator state only. They do
not open real connections to external IdPs, NSX Manager, or a live vSAN
cluster. Do not rely on the simulator for testing live credential
exfiltration defenses against real providers.