exocomp docs

Tag

#security

7 pages tagged #security.

Often with #decision 4 #auth 2 #secrets 2 #age 1 #deferred 1 All tags →

Decisions decisions/ 4 pages

Decision 0003 — Secrets envelope: age recipients → DEK → HKDF subkeysDecision

Secrets envelope of age recipients, a DEK and HKDF subkeys, with a recovery kit that closes the credential loop.

decisions/0003-secrets-envelope #decision #secrets

Decision 0005 — Job sandboxing: the `enforcing` tier via nonoDecision

Job sandboxing via nono's enforcing tier, so a job is denied every powerful local socket.

decisions/0005-job-sandboxing-nono #decision #sandbox

Decision 0007 — Audit hash chain: deferred, with a revival conditionDecision

The audit hash chain is deferred, and reviving it requires an off-host-anchored head.

decisions/0007-audit-chain-deferral #decision #deferred

Decision 0009 — LAN access: bearer tokens minted by local authDecision

LAN listeners require locally-minted bearer tokens, with TLS on by default.

decisions/0009-lan-access-tokens #decision #auth

Guide guide/ 1 page

Secrets and fleet keysGuide

The age envelope model, SOPS integration, run-secret bindings, and zero-leakage security invariants.

guide/secrets #guide #secrets #age #sops #encryption

Operations operations/ 1 page

LAN access: tokens and the web surfaceGuide

Minting bearer tokens and serving the TLS web and phone approval surface, separate from the loopback state backend.

operations/lan-access #operations #auth #web

Security security/ 1 page

Threat modelDesign

What an attacker who reaches the daemon can do, the guarding mechanisms, and the residuals that are accepted rather than closed.

security/threat-model #threat-model

All tags

#adhoc 1 #age 1 #agents 1 #alerts 1 #ansible 9 #api 4 #approvals 2 #architecture 6 #assessment 1 #auth 3 #automation 2 #backup 3 #bootstrap 2 #branches 1 #bubbletea 1 #cel 1 #changelog 1 #checks 5 #cli 5 #commands 1 #configuration 1 #containers 5 #contributing 6 #convergence 1 #credentials 2 #css 1 #debugging 1 #decision 22 #deferred 3 #dependencies 2 #deployment 1 #design 8 #dev 2 #drift 2 #encryption 1 #errors 1 #execution 2 #exitcodes 1 #failures 1 #flags 1 #gallery 1 #gates 1 #git 2 #governance 1 #guide 10 #handoff 2 #handoffs 1 #hooks 3 #internals 1 #invariants 1 #inventory 1 #json 1 #lanes 1 #lima 1 #lipgloss 1 #llm 1 #mcp 4 #metrics 1 #migrations 1 #mobile 3 #monitoring 1 #naming 1 #netgroups 1 #notifications 1 #ntfy 1 #offline 4 #opentofu 1 #operations 29 #packages 1 #packaging 3 #pairing 2 #platform 1 #playbook 1 #playbooks 1 #policy 1 #probes 2 #provisioning 1 #qr 1 #quadlet 1 #queue 1 #quickstart 1 #reactive 4 #reboot 1 #recovery 3 #reference 3 #release 1 #remote 1 #replication 2 #rollback 1 #sandbox 2 #sbom 2 #schema 1 #screenshots 1 #secrets 4 #security 7 #serve 4 #setup 2 #site 1 #sops 1 #sources 3 #sqlite 1 #ssh 1 #state 3 #store 1 #superseded 1 #templ 1 #terminal 1 #terraform 8 #testing 1 #threat-model 1 #tokens 2 #toolchain 2 #tui 2 #ui 1 #upcoming 1 #verification 1 #versioning 1 #web 3 #webhooks 3 #workflow 1 #worktrees 1 #yaml 1