generated from DAM/ts-TEMPLATE
8e3df8934a
- Move Vikunja DB user/password/database and JWT secret to environment variables - Update .env.example with clear sections and 'change-me' placeholders - Update SECURITY.md to reflect that more secrets now live in .env
40 lines
1.3 KiB
Markdown
40 lines
1.3 KiB
Markdown
# Security Notes
|
|
|
|
## Sensitive Files
|
|
|
|
- `.env` — Contains your Tailscale/Headscale auth key and service configuration. **Never commit this file.**
|
|
- `tailscale/tailscale-data/` — Contains Tailscale node state and keys. **Never commit this directory.**
|
|
|
|
## Capabilities
|
|
|
|
This compose file adds the following capabilities to the Tailscale sidecar:
|
|
|
|
- `net_admin` — Required for Tailscale to manage network interfaces and routes.
|
|
|
|
These capabilities are necessary for Tailscale to function but increase the attack surface if the container is compromised.
|
|
|
|
## Recommendations
|
|
|
|
- Use a dedicated, limited-scope auth key for each service.
|
|
- Regularly rotate auth keys.
|
|
- Review Headscale/Tailscale ACLs to ensure services only have the access they need.
|
|
- Keep the Tailscale Docker image reasonably up to date.
|
|
|
|
## Default Passwords
|
|
|
|
The `docker-compose.yml` file contains placeholder values (`***`) for sensitive items such as:
|
|
|
|
- Postgres password
|
|
- Vikunja JWT secret
|
|
|
|
**Change these values** before deploying anywhere security matters. Never use the default placeholders in production or shared environments.
|
|
|
|
## Environment File
|
|
|
|
The `.env` file now contains additional sensitive values including:
|
|
|
|
- Database credentials
|
|
- Vikunja JWT secret
|
|
|
|
**Never commit your `.env` file.** Always use `.env.example` as a template and keep real values private.
|