Section 7 of 1937% complete
Section 7: Security Architecture
Trust Boundaries
| Boundary | Protection |
|---|---|
| Edge (Internet) | Cloudflare WAF, DDoS protection |
| Gateway | Authentication, rate limiting, input validation |
| Service-to-Service | mTLS (planned), internal network only |
| Agent-to-Control Plane | mTLS certificates, outbound-only |
| Database | TLS, per-service credentials, network isolation |
Authentication
- - JWT-based authentication
- - Support for passwordless login (planned)
- - OAuth2 integration (Discord, Google)
- - API keys for programmatic access
Authorization (RBAC)
| Role | Scope | Permissions |
|---|---|---|
| Owner | Organization | Full control, billing |
| Admin | Organization | Manage users, servers |
| Operator | Server | Start/stop, configure |
| Viewer | Server | View status, logs |
Secrets Management
Approach: Kubernetes secrets for infrastructure, dedicated Secrets Service for user
credentials. No secrets in code or environment variables.