Security Policy

Supported Deployment

The supported production deployment is the canonical single-container instance on port 1216.

AppOps is designed for trusted homelab/LAN operation behind network controls such as VPN, reverse-proxy authentication or trusted internal access. Do not expose the gateway directly to the public internet.

No-Secrets Policy

Do not commit API keys, tokens, passwords, cookies, private keys or production database files.
Do not paste raw secrets into issues, changelogs, AI prompts, logs or screenshots.
Connector secrets must be stored through encrypted secret storage or environment/key-file configuration.
API responses and UI surfaces must show only write-only state such as hasSecret, missing, secretRef or redacted metadata.
Backups may contain encrypted local state. Protect /data, /data/backups and the APPOPS_SECRET_KEY or APPOPS_SECRET_KEY_FILE together.

Local-First Data Warning

AppOps stores operational state locally in SQLite under /data/appops.db. This can include encrypted connector secrets, audit events, inventory metadata, notification events and operator decisions.

SQLite online backups are written to /data/backups. They can be integrity-checked and downloaded from Settings, so treat downloaded copies as sensitive local state even though connector secrets remain encrypted. Restore is a stop-container/manual operation in V1. Losing the secret key means encrypted connector secrets in a restored database cannot be decrypted.

Exposure Guidance

Keep AppOps behind trusted LAN/VPN/reverse-proxy auth.
Use TLS at the reverse proxy if accessing outside localhost/LAN.
Do not mount /var/run/docker.sock.
Do not run the container privileged.
Do not use host networking for the default deployment.
Keep destructive actions such as delete, prune, format and secret-show blocked unless a future reviewed policy/approval/audit/rollback design is implemented.
Enrollment accepts only the reviewed EnrollmentPlanV1 profiles. It cannot claim an existing container, hostname, Authentik application, appdata path or controller target, and it never accepts arbitrary Compose, callbacks, environment values or controller commands.
Automatic production delivery accepts only an HMAC-verified Gitea main push after the controller has independently read the configured exact-SHA, push-only validation contexts with its root-owned read credential. Webhook payloads, Actions jobs and UI clients cannot claim validation success or supply the credential; Gitea API outages fail closed.

Reporting

Report suspected security issues privately to the project owner/operator. Include the affected route, version, deployment context and redacted reproduction steps. Never include raw secrets in the report.

2.8 KiB Raw Permalink Blame History