44 lines
2.8 KiB
Markdown
44 lines
2.8 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Deployment
|
|
|
|
The supported production deployment is the canonical single-container instance on port `1216`.
|
|
|
|
AppOps is designed for trusted homelab/LAN operation behind network controls such as VPN, reverse-proxy authentication or trusted internal access. Do not expose the gateway directly to the public internet.
|
|
|
|
## No-Secrets Policy
|
|
|
|
- Do not commit API keys, tokens, passwords, cookies, private keys or production database files.
|
|
- Do not paste raw secrets into issues, changelogs, AI prompts, logs or screenshots.
|
|
- Connector secrets must be stored through encrypted secret storage or environment/key-file configuration.
|
|
- API responses and UI surfaces must show only write-only state such as `hasSecret`, `missing`, `secretRef` or redacted metadata.
|
|
- Backups may contain encrypted local state. Protect `/data`, `/data/backups` and the `APPOPS_SECRET_KEY` or `APPOPS_SECRET_KEY_FILE` together.
|
|
|
|
## Local-First Data Warning
|
|
|
|
AppOps stores operational state locally in SQLite under `/data/appops.db`. This can include encrypted connector secrets, audit events, inventory metadata, notification events and operator decisions.
|
|
|
|
SQLite online backups are written to `/data/backups`. They can be integrity-checked and downloaded from Settings, so treat downloaded copies as sensitive local state even though connector secrets remain encrypted. Restore is a stop-container/manual operation in V1. Losing the secret key means encrypted connector secrets in a restored database cannot be decrypted.
|
|
|
|
## Exposure Guidance
|
|
|
|
- Keep AppOps behind trusted LAN/VPN/reverse-proxy auth.
|
|
- Use TLS at the reverse proxy if accessing outside localhost/LAN.
|
|
- Do not mount `/var/run/docker.sock`.
|
|
- Do not run the container privileged.
|
|
- Do not use host networking for the default deployment.
|
|
- Keep destructive actions such as delete, prune, format and secret-show blocked unless a future reviewed policy/approval/audit/rollback design is implemented.
|
|
- Enrollment accepts only the reviewed `EnrollmentPlanV1` profiles. It cannot
|
|
claim an existing container, hostname, Authentik application, appdata path or
|
|
controller target, and it never accepts arbitrary Compose, callbacks,
|
|
environment values or controller commands.
|
|
- Automatic production delivery accepts only an HMAC-verified Gitea main push
|
|
after the controller has independently read the configured exact-SHA,
|
|
push-only validation contexts with its root-owned read credential. Webhook
|
|
payloads, Actions jobs and UI clients cannot claim validation success or
|
|
supply the credential; Gitea API outages fail closed.
|
|
|
|
## Reporting
|
|
|
|
Report suspected security issues privately to the project owner/operator. Include the affected route, version, deployment context and redacted reproduction steps. Never include raw secrets in the report.
|