Security Baseline

This page records the reusable security posture for the fleet. Open remediation work is tracked by the Forgejo Security Hardening milestone rather than by this page.

Current Controls

• Secrets are encrypted with SOPS and decrypted at activation time.
• Provisioning passwords are SOPS-backed rather than stored as plaintext hashes.
• Server SSH disables password authentication and root login.
• Firewall openings and service bind addresses are explicit configuration.
• Electra uses encrypted storage, firmware-enforced Secure Boot, signed Lanzaboote UKIs, and TPM policies with independent LUKS passphrase recovery.
• Paseo daemons bind to loopback and use the authenticated TLS relay for remote access.
• Backrest binds its UI to loopback and receives credentials through systemd.
• Beszel agents make outbound connections and require no inbound agent port.
• Docker group membership is treated as root-equivalent access and accepted only on the single-user machines where that tradeoff is intentional.
• The retired privileged Harmonia cache container has been replaced by Attic and Forgejo Actions.

Known Follow-Up

The Security Hardening milestone tracks:

• the disk-encryption decision and implementation for lena and vega
• reduction and documentation of directly exposed administrative services
• narrower host- or service-scoped SOPS recipients
• removal of residual keys and volumes from the retired cache container
• adoption of the host and service review gate below
• Electra's final post-change encrypted recovery archive

Host and Service Review Gate

Review these points before considering a new host or custom service complete:

• Physical access: Decide whether disks require encryption and document any conflict with unattended reboot requirements.
• Authentication: Disable unnecessary password and root access; consider SSH source restrictions where they fit the operating model.
• Secrets: Grant each host or service only the SOPS recipients and secret material it requires. Preserve a deliberate emergency recovery recipient.
• Network exposure: Review every bind address and firewall opening. Prefer loopback, an authenticated reverse proxy, or VPN/mesh access for administrative interfaces and databases.
• Privilege: Treat Docker access as root-equivalent. Apply practical systemd sandboxing to custom services and document exceptions.
• Recovery: Confirm configuration, data, keys, and credentials have a tested recovery path before deployment.
• Observability: Ensure failures are visible through systemd status, monitoring, or notification paths appropriate to the service.

Record unresolved findings as Forgejo issues under an appropriate milestone. Keep this page limited to controls and review criteria that apply beyond one specific project.