infraweaver/security
Security
The honest position first, then the controls that actually ship enabled, then what this platform does not protect you from.
Alpha software — not recommended for production
InfraWeaver is in active alpha and is provided as-is for homelab experimentation and learning. Use at your own risk.
- It has not undergone an independent third-party security review or penetration test.
- Do not run it in production, or on any internet-exposed environment you care about, without first commissioning your own security audit and penetration test.
- APIs, manifests, secrets handling and deploy scripts can change without notice and may contain breaking changes or security gaps.
- You are responsible for reviewing every component, rotating all generated credentials, and hardening the deployment for your own threat model.
What ships enabled
These are defaults, not options you are encouraged to turn on. A workload that violates them is refused at admission, which is the difference between a policy and a suggestion.
WORKLOADENFORCING
- Non-root, no escalation, no capabilitiesEvery container runs as a normal user with
allowPrivilegeEscalation: falseand all capabilities dropped. - No host namespaces, no hostPathA pod cannot reach the node's PID namespace, network stack or filesystem.
- No
:latestAn untagged image makes rollback meaningless and makes "what is running" unanswerable. Rejected. - Memory request and limit requiredWith a bounded ratio between them, because memory is incompressible and the scheduler packs on requests while the kernel kills on limits.
NETWORK AND SECRETSENFORCING
- Every namespace is default-denyGenerated automatically the moment a namespace exists. Allowed: intra-namespace traffic, cluster DNS, ingress from Traefik, metrics scraping. Nothing else, including egress.
- The internal tier is IP-gatedA Traefik middleware rejects requests from outside your ranges. Knowing the hostname is not access.
- A secret-leak gate fails the build
scripts/validate-iac.shrejects any raw Kubernetes Secret that carries a real value, so a leak has to survive CI to reach git. - Credentials are generated, never shippedNothing in the repository is a working password. The installer discards your Proxmox root credentials the moment it has minted an API token.
What this does not protect you from
A security page that only lists strengths is marketing. These are real limits of the current design.
| Gap | What it means for you |
|---|---|
| No third-party review | Nobody outside the project has attacked this. The controls above are correct in intent; whether they are complete is unproven. |
| Upstream CVEs | The platform ships upstream images. When one has a vulnerability, you have it too, until the chart moves and you sync. |
| The hypervisor is yours | Proxmox itself, its web UI, its SSH exposure and its patch level are outside the platform's control and inside your blast radius. |
| A DNS token is powerful | External DNS, if you enable it, gives an in-cluster controller write access to your zone. Scope the token to one zone and nothing else. |
| An admin account is an admin account | SSO centralises login, which also means one compromised admin session reaches a great deal. Use a hardware key on it. |
| Backups are optional | Velero is off by default. An untested backup is not a backup; rehearse a restore before you need one. |
Reporting a vulnerability
Open a private security advisory on the GitHub repository rather than a public issue, and include the version or commit you tested, the manifest or route involved, and the steps that reproduce it. A working reproduction against a fresh install is worth more than a scanner report.
This is an alpha homelab project maintained in spare time. There is no response-time commitment and no bug bounty. What there is: findings get fixed, and the fix gets described honestly in the changelog.
BEFORE YOU EXPOSE IT
- Rotate every generated credentialThey are random, but they were generated by a script on a machine that also held your
.env. - Confirm the internal tier really is gatedProbe it from outside your LAN ranges. A middleware that is configured but not attached looks identical from inside.
- Put a second factor on the admin accountAuthentik supports it. The console is the whole platform.
- Turn on backups and restore oneBefore you have data you would miss, not after.