phptits
0d6cd37579
- Monorepo: NestJS API (Fastify) + React web (antd/ProComponents) + shared packages - PostgreSQL/Prisma (unified resources, relations graph, audit, events, jobs) - Auth/RBAC/workspace isolation, credential vault (AES-256-GCM) - Servers/SSH, Docker discovery & lifecycle, Job Center - Websites & deployments (git provider credential clone, env, health verification) - Domains/DNS (Cloudflare adapter), certificates (TLS probe), monitoring - Automation (cron/event/webhook HMAC + notifications), AI Gateway, MCP (29 tools) - AI chat window (LLM function-calling + rules fallback, SSE streaming, approvals) - Notes: Vditor WYSIWYG markdown editor, non-blocking autosave - Tests: 35 unit/security tests; UI audit clean (desktop+mobile, deep links)
79 lines
1.6 KiB
Markdown
79 lines
1.6 KiB
Markdown
# DevOS v1 Security Specification
|
|
|
|
## 1. Threat Model
|
|
DevOS manages highly sensitive credentials:
|
|
- SSH keys
|
|
- API keys
|
|
- cloud tokens
|
|
- Git tokens
|
|
- SMTP credentials
|
|
- DNS API credentials
|
|
- database passwords
|
|
|
|
Therefore security is a core architecture boundary.
|
|
|
|
## 2. Credential Vault
|
|
Credentials are stored encrypted, separately from ordinary resource metadata.
|
|
|
|
```text
|
|
Application Master Key
|
|
↓
|
|
Envelope Encryption
|
|
↓
|
|
Encrypted Credential
|
|
```
|
|
|
|
Do not store plaintext passwords or tokens in PostgreSQL.
|
|
|
|
## 3. Authorization
|
|
Implement:
|
|
- authentication
|
|
- workspace isolation
|
|
- RBAC
|
|
- resource-level permission checks where required
|
|
- action-level authorization
|
|
|
|
## 4. Audit
|
|
All mutations and sensitive reads/actions should be auditable:
|
|
- actor
|
|
- workspace
|
|
- action
|
|
- resource
|
|
- risk
|
|
- outcome
|
|
- timestamp
|
|
- correlation/request ID
|
|
|
|
## 5. Secret Masking
|
|
Secrets must be masked in:
|
|
- logs
|
|
- UI
|
|
- Agent context
|
|
- error messages
|
|
- audit metadata
|
|
- tool results
|
|
|
|
## 6. AI Safety
|
|
AI execution must use the same authorization path as humans.
|
|
|
|
HIGH / CRITICAL:
|
|
```text
|
|
Plan
|
|
↓
|
|
User Approval
|
|
↓
|
|
Execute
|
|
↓
|
|
Verify
|
|
```
|
|
|
|
## 7. Infrastructure Execution
|
|
- SSH command execution must be scoped and logged.
|
|
- Command timeouts are mandatory.
|
|
- Production targets should be distinguishable.
|
|
- Destructive actions require explicit confirmation.
|
|
- Never allow prompt text alone to override security policy.
|
|
|
|
## 8. Security Non-Goals
|
|
This document does not claim a complete production security certification. Before public production deployment, perform threat modeling, dependency review, penetration testing and secret-rotation drills.
|