1c3b7e53a1
GitHub Actions Workflows: - docker-compose-validation.yml: Validates all compose files - Syntax validation - Network configuration checks - Traefik label validation - Port exposure warnings - Domain consistency checks - File naming convention enforcement - security-checks.yml: Security scanning and validation - Gitleaks secret detection - Environment file validation - Placeholder password checks - Container image vulnerability scanning with Trivy - Dependency review for pull requests - Security report generation - yaml-lint.yml: YAML formatting and validation - yamllint with custom configuration - File extension consistency checks - YAML structure validation - Service naming convention checks - Docker Compose version validation - documentation.yml: Documentation quality checks - Markdown linting - Link validation - README completeness verification - Service documentation checks - Domain URL validation - auto-label.yml: Automated PR labeling - Category-based labeling (core/media/services) - File type detection - Size-based labeling - Security-related changes detection Configuration Files: - .yamllint.yml: YAML linting rules for Docker Compose - .markdownlint.json: Markdown formatting rules - .markdown-link-check.json: Link checking configuration - .pre-commit-config.yaml: Pre-commit hooks setup - .github/labeler.yml: Auto-labeler configuration - .github/CODEOWNERS: Code ownership definitions Templates: - pull_request_template.md: Comprehensive PR checklist - ISSUE_TEMPLATE/bug-report.md: Bug report template - ISSUE_TEMPLATE/service-request.md: New service request template Documentation: - SECURITY.md: Security policy and best practices - CONTRIBUTING.md: Contribution guidelines Benefits: - Automated validation of all compose files - Security scanning on every PR - Consistent code formatting - Documentation quality assurance - Automated issue/PR management - Pre-commit hooks for local validation - Comprehensive security policy - Clear contribution guidelines
144 lines
4.3 KiB
Markdown
144 lines
4.3 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
This is a personal homelab configuration repository. The latest commit on `main` is always the supported version.
|
|
|
|
| Branch | Supported |
|
|
| ------ | ------------------ |
|
|
| main | :white_check_mark: |
|
|
| other | :x: |
|
|
|
|
## Security Considerations
|
|
|
|
### Secrets Management
|
|
|
|
**DO NOT commit secrets to this repository!**
|
|
|
|
- All passwords in `.env` files should use placeholder values (e.g., `changeme_*`)
|
|
- Real passwords should only be set in your local deployment
|
|
- Use environment variables or Docker secrets for sensitive data
|
|
- Never commit files containing real credentials
|
|
|
|
### Container Security
|
|
|
|
- All container images are scanned for vulnerabilities via GitHub Actions
|
|
- HIGH and CRITICAL vulnerabilities are reported in security scans
|
|
- Keep images up to date by pulling latest versions regularly
|
|
- Review security scan results before deploying
|
|
|
|
### Network Security
|
|
|
|
- All services are behind Traefik reverse proxy
|
|
- SSL/TLS is enforced via Let's Encrypt
|
|
- Internal services use isolated Docker networks
|
|
- SSO is enabled on most services via Tinyauth
|
|
|
|
### Authentication
|
|
|
|
- LLDAP provides centralized user management
|
|
- Tinyauth handles SSO authentication
|
|
- Services with built-in authentication are documented in README
|
|
- Change all default passwords before deployment
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you discover a security vulnerability in this configuration:
|
|
|
|
1. **DO NOT** open a public issue
|
|
2. Contact the repository owner directly via GitHub private message
|
|
3. Include:
|
|
- Description of the vulnerability
|
|
- Steps to reproduce
|
|
- Potential impact
|
|
- Suggested fix (if any)
|
|
|
|
### What to Report
|
|
|
|
- Exposed secrets or credentials
|
|
- Insecure configurations
|
|
- Vulnerable container images (not already detected by CI)
|
|
- Authentication bypasses
|
|
- Network security issues
|
|
|
|
### What NOT to Report
|
|
|
|
- Issues with third-party services (report to their maintainers)
|
|
- Theoretical vulnerabilities without proof of concept
|
|
- Social engineering attempts
|
|
|
|
## Security Best Practices
|
|
|
|
### Before Deployment
|
|
|
|
1. **Change all passwords** in `.env` files
|
|
2. **Review** all service configurations
|
|
3. **Update** container images to latest versions
|
|
4. **Configure** firewall to only allow ports 80/443
|
|
5. **Enable** automatic security updates on host OS
|
|
|
|
### After Deployment
|
|
|
|
1. **Monitor** logs regularly for suspicious activity
|
|
2. **Update** services monthly (at minimum)
|
|
3. **Backup** data regularly
|
|
4. **Review** access logs
|
|
5. **Test** disaster recovery procedures
|
|
|
|
### Network Hardening
|
|
|
|
- Use a firewall (ufw, iptables, etc.)
|
|
- Only expose ports 80 and 443 to the internet
|
|
- Consider using a VPN for administrative access
|
|
- Enable fail2ban or similar intrusion prevention
|
|
- Use strong DNS providers with DNSSEC
|
|
|
|
### Container Hardening
|
|
|
|
- Run containers as non-root when possible
|
|
- Use read-only filesystems where applicable
|
|
- Limit container resources (CPU, memory)
|
|
- Enable security options (no-new-privileges, etc.)
|
|
- Regularly scan for vulnerabilities
|
|
|
|
## Automated Security Scanning
|
|
|
|
This repository includes automated security scanning:
|
|
|
|
- **Gitleaks**: Detects secrets in commits
|
|
- **Trivy**: Scans container images for vulnerabilities
|
|
- **YAML Linting**: Ensures proper configuration
|
|
- **Dependency Review**: Checks for vulnerable dependencies
|
|
|
|
Review GitHub Actions results before merging PRs.
|
|
|
|
## Compliance
|
|
|
|
This is a personal homelab configuration and does not claim compliance with any specific security standards. However, it follows general security best practices:
|
|
|
|
- Principle of least privilege
|
|
- Defense in depth
|
|
- Secure by default
|
|
- Regular updates and patching
|
|
|
|
## External Dependencies
|
|
|
|
Security of this setup depends on:
|
|
|
|
- Docker and Docker Compose security
|
|
- Container image maintainers
|
|
- Traefik security
|
|
- LLDAP security
|
|
- Host OS security
|
|
|
|
Always keep these dependencies up to date.
|
|
|
|
## Disclaimer
|
|
|
|
This configuration is provided "as is" without warranty. Use at your own risk. The maintainer is not responsible for any security incidents resulting from the use of this configuration.
|
|
|
|
## Additional Resources
|
|
|
|
- [Docker Security Best Practices](https://docs.docker.com/engine/security/)
|
|
- [Traefik Security Documentation](https://doc.traefik.io/traefik/https/overview/)
|
|
- [OWASP Container Security](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html)
|