---
id: TECH-SECURITY
type: technical
status: active
title: Security
created: '2026-09-09'
updated: '2026-10-11'
tags:
- technical
- security
related:
- ALERT-20260909-001
- ALERT-20260909-002
- NFR-002
- MOD-003
- MOD-007
source_paths:
- vault.yml
- roles/monitoring/tasks/configure-psk.yml
- roles/bootstrap/defaults/main.yml
- ansible.cfg
- execute.sh
confidence: confirmed
---

# Security

## Secrets Handling

- `vault.yml` (tracked, encrypted) holds `admin_password` (SHA-512 hash),
  `monitoring_zabbix_api_password`, and Proxmox credentials
  (`PROXMOX_USER_NAME`, `PROXMOX_USER_PASS`); it is loaded via playbook-level
  `vars_files` in `bootstrap.yml` and `playbooks/monitoring.yml`.
- Git-ignored (verified): `.vault_pass`, `setenv.sh` (Proxmox credentials),
  `.zabbix-psk/` (per-host PSKs), `logs/`.
- Resolved 2026-09-09: the `admin_password` SHA-512 hash that was committed
  in plaintext in `roles/bootstrap/defaults/main.yml` and
  `inventory/group_vars/external.yml` was moved to encrypted `vault.yml`
  (see [ALERT-20260909-001](../alerts/ALERT-20260909-001.md)).

## SSH Posture

- Runtime key access: `execute.sh` bind-mounts the caller's `$HOME/.ssh`
  (or `SSH_KEY_DIR`) read-only at `/root/.ssh`. It does not rewrite the host
  SSH configuration or permissions. Private keys are not baked into the image.
- Controller/transport: `host_key_checking = False`,
  `StrictHostKeyChecking=no`, `UserKnownHostsFile=/dev/null` (ansible.cfg,
  execute.sh, Dockerfile). Deliberate for first-time provisioning; README
  explicitly warns to restrict this in production.
- Host hardening: `manage-ssh-keys` role enforces allow/deny key lists;
  bootstrap deploys hardened `sshd.conf.j2` and per-host authorized keys.
- Per-host exceptions: `ssh_service_name: ssh` on `gitea`/`ipam`.

## Zabbix Agent TLS

- PSK-only encryption (TLS connect + accept), 256-bit PSKs generated with
  `openssl rand -hex 32` on the controller, persisted with umask 077 in a
  0700 directory, deployed 0600 to the agent host. Identity = host name.

## Risky Defaults (documented trade-offs)

- `hawser_allow_insecure_no_auth: true` - Hawser standard mode without token
  on non-loopback addresses; comment in defaults demands other network
  protections.
- `execute.sh` disables host key checking inside the runtime container.
- Mirror rewrite runs with `ignore_errors: true` in os-updates.

## Git Hygiene

- Resolved 2026-09-09: the previously uncommitted change set (including the
  `dmc12` → `cloudlorean` inventory rename and stale documentation) was
  committed as one coherent change; see
  [ALERT-20260909-002](../alerts/ALERT-20260909-002.md).