phptits
0d6cd37579
- Monorepo: NestJS API (Fastify) + React web (antd/ProComponents) + shared packages - PostgreSQL/Prisma (unified resources, relations graph, audit, events, jobs) - Auth/RBAC/workspace isolation, credential vault (AES-256-GCM) - Servers/SSH, Docker discovery & lifecycle, Job Center - Websites & deployments (git provider credential clone, env, health verification) - Domains/DNS (Cloudflare adapter), certificates (TLS probe), monitoring - Automation (cron/event/webhook HMAC + notifications), AI Gateway, MCP (29 tools) - AI chat window (LLM function-calling + rules fallback, SSE streaming, approvals) - Notes: Vditor WYSIWYG markdown editor, non-blocking autosave - Tests: 35 unit/security tests; UI audit clean (desktop+mobile, deep links)
1.6 KiB
1.6 KiB
DevOS v1 Security Specification
1. Threat Model
DevOS manages highly sensitive credentials:
- SSH keys
- API keys
- cloud tokens
- Git tokens
- SMTP credentials
- DNS API credentials
- database passwords
Therefore security is a core architecture boundary.
2. Credential Vault
Credentials are stored encrypted, separately from ordinary resource metadata.
Application Master Key
↓
Envelope Encryption
↓
Encrypted Credential
Do not store plaintext passwords or tokens in PostgreSQL.
3. Authorization
Implement:
- authentication
- workspace isolation
- RBAC
- resource-level permission checks where required
- action-level authorization
4. Audit
All mutations and sensitive reads/actions should be auditable:
- actor
- workspace
- action
- resource
- risk
- outcome
- timestamp
- correlation/request ID
5. Secret Masking
Secrets must be masked in:
- logs
- UI
- Agent context
- error messages
- audit metadata
- tool results
6. AI Safety
AI execution must use the same authorization path as humans.
HIGH / CRITICAL:
Plan
↓
User Approval
↓
Execute
↓
Verify
7. Infrastructure Execution
- SSH command execution must be scoped and logged.
- Command timeouts are mandatory.
- Production targets should be distinguishable.
- Destructive actions require explicit confirmation.
- Never allow prompt text alone to override security policy.
8. Security Non-Goals
This document does not claim a complete production security certification. Before public production deployment, perform threat modeling, dependency review, penetration testing and secret-rotation drills.