Skip to main content

Security

Auth Model​

  • this repository does not expose its own runtime API
  • repo metadata is file-based and checked into Git
  • consumed auth is limited to:
    • optional fabric_auth_token for Fabric HTTP reads
    • optional registry credentials outside the repo for private image pulls
    • optional provider credentials outside the repo for mutating cloud runs

OAuth is not documented here because this repository is not an OAuth-facing runtime service.

OAuth would only become relevant if all of the following changed:

  • external users interact directly with a runtime surface from this repository
  • a multi-tenant access pattern is introduced
  • access from outside the trusted platform network becomes part of the contract

OAuth is not required today when:

  • communication is internal and service-to-service
  • Fabric-driven reads happen without user context
  • no direct user-facing runtime surface exists in this repository

Access Control​

  • control of this repo happens through Git and CI permissions
  • mutating infrastructure actions require manual, environment-aware execution
  • shared-host and provider credentials must stay outside the repository

Sensitive Data Types​

  • provider credentials
  • registry credentials
  • optional Fabric auth token
  • runtime secrets passed to test stacks, such as database passwords

Secrets Model​

  • no secrets are stored in Git
  • no secrets are embedded in workflows
  • helper scripts and IaC variables may accept sensitive values, but they must come from the caller environment or external secret storage

Standalone vs Integrated Credential Contract​

Modeimplementedplannednever in repo
standalone (openclaw-only and local test scenarios)optional private-registry credentials for OCI pulls, provided by operator/runtime environmentcaller-side secret resolver may pre-render explicit artifact inputs before the IaC lifecycleregistry tokens, provider keys, runtime passwords
integrated (openclaw-plus-fabric*)optional fabric_auth_token for read-only Fabric context surfaces, optional registry credentials for private imagescaller may hand over the same credentials to the existing execution contract without adding IaC-side secret discoveryFabric write credentials, host mutation credentials, long-lived tokens

Operational credential and mutation controls:

  • docs/REGISTRY_CREDENTIALS_RUNBOOK.md
  • docs/MUTATION_WINDOW_POLICY.md
  • environments/test/scripts/verify-host-sudo-credential-rotation.sh | cloud mutation (hetzner-staging) | provider credentials injected outside Git for explicitly approved runs | stronger operator guardrails and rotation runbook | provider keys, cloud secrets |

Credential handoff rule:

  • jhf-deployment consumes provided credentials only as execution inputs
  • no credential generation, rotation, or persistence is implemented in this repository
  • remediation checks must pass credentials via stdin, not command-line interpolation
  • deployment runbooks must not include inline sudo secret pipelines

Protected Interfaces​

  • Docker socket and host selection
  • Fabric datasource auth if enabled
  • private OCI registry access
  • cloud-provider credential use

Artifact Trust Boundaries​

Allowed:

  • explicit pinned artifact inputs via artifact_sources
  • resolver handoff through explicit tfvars.json files
  • package_reference as provenance evidence only

Disallowed:

  • implicit latest or auto-latest fallback
  • mixed coordinate style in one artifact entry (image plus repository/tag)
  • hidden resolver behavior inside IaC modules

Required review points:

  • changes to artifact input validation rules
  • new registry/repository trust boundaries
  • runtime-mode changes from probe to native-service

Inputs That Must Never Be Left Open​

  • unaudited terraform apply / destroy triggered by external systems
  • direct write access from Fabric into this repo's working directories or state
  • broad remote Docker control on shared hosts

Actions That Must Never Be Uncontrolled​

  • destructive Terraform runs against shared environments
  • artifact source widening to unpinned latest
  • secret injection into committed files
  • remote host mutation on <internal-runtime-redacted> without explicit intent and verification
  • Fabric-triggered mutation of IaC lifecycle commands

Primary Risks​

  • wrong host or provider target during mutation
  • silent drift caused by unpinned artifacts
  • leaked credentials in operator environments or CI
  • Fabric being mis-modeled as a write controller instead of a read source

License: AGPLv3 Source and governance: https://helpifyr.com