inecs
f8d3cbdd59
Add the FastAPI app, PostgreSQL migrations, Docker/Helm packaging, API contracts, docs, client examples, and the unit/integration/compatibility test suite for local client and tooling labs without a real vCenter.
55 lines
2.1 KiB
Markdown
55 lines
2.1 KiB
Markdown
**Language / Язык:** [English](security.md) | [Русский](ru/security.md)
|
|
|
|
# Security
|
|
|
|
## Lab threat model
|
|
|
|
This project is a **local / CI laboratory simulator**. It is not hardened as
|
|
a multi-tenant public vCenter service. Default credentials, UI demo controls,
|
|
and compatibility endpoints are convenient for development and intentionally
|
|
open in the default Compose stack.
|
|
|
|
Do not expose ports `443` / `80` to untrusted networks without additional
|
|
controls you supply yourself.
|
|
|
|
## Credentials and secrets
|
|
|
|
- Passwords are stored as scrypt hashes (`vsphere_credentials.password_hash`).
|
|
- Session ids are opaque tokens (`vmware-api-session-id`) with a 2-hour
|
|
sliding expiry, tracked in PostgreSQL (`vsphere_sessions`).
|
|
- Logs redact recognized session-id and password representations.
|
|
- Content library update/download session responses expose upload/download
|
|
endpoints, not raw secrets.
|
|
|
|
Change `TICKET_SIGNING_KEY` for any shared lab. Replace seeded passwords
|
|
before demoing to others.
|
|
|
|
## TLS materials
|
|
|
|
`docker/tls/` contains a checked-in self-signed certificate for the local
|
|
`api-gateway` nginx service. It exists so unmodified TLS clients (pyvmomi,
|
|
govmomi, Terraform's `hashicorp/vsphere` provider) can connect with
|
|
`insecure`/`verify=False` set. **Never** reuse these files in production.
|
|
|
|
## Simulator administration
|
|
|
|
There is currently **no** separately authenticated admin control plane. Web
|
|
UI helper routes under `/ui/api/*` are available whenever the process is
|
|
reachable — including reseed and hot-swap actions. Treat network exposure as
|
|
the trust boundary.
|
|
|
|
## Authorization
|
|
|
|
Mutating REST endpoints check role-derived privileges
|
|
(`app/vsphere/security/authz.py`) before touching inventory. The seeded
|
|
`readonly@vsphere.local` principal cannot power on/create/delete VMs (HTTP
|
|
403). See [Authorization](domains/authz.md).
|
|
|
|
## Simulated remotes
|
|
|
|
NSX/Supervisor/vSAN/SAML-OIDC/VECS-certificate stand-ins (see
|
|
[API coverage](api-coverage.md)) persist local simulator state only. They do
|
|
not open real connections to external IdPs, NSX Manager, or a live vSAN
|
|
cluster. Do not rely on the simulator for testing live credential
|
|
exfiltration defenses against real providers.
|