trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Archive relocate-brouter-to-dedicated-host

Browse source 
Final step (task 9.4) of the BRouter relocation. The change is moved to
openspec/changes/archive/2026-04-24-relocate-brouter-to-dedicated-host/
and the four delta specs (brouter-integration, infrastructure,
observability, security-hardening) are merged into the main specs:

  + 6 added requirements
  ~ 4 modified requirements

The two intentionally-unchecked tasks are 2.2 (obsoleted, see crossed-out
note) and 9.4 itself (this archive).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ullrich Schäfer 2026-04-24 18:35:37 +02:00
parent 2e5606458d
commit 66fb5d3044
12 changed files with 121 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

22
openspec/specs/security-hardening/spec.md
View file

@ -1,9 +1,7 @@
## Purpose
Security headers, scanner path blocking, secret scanning, dependency auditing, non-root containers, and vulnerability disclosure policy.
## Requirements
### Requirement: Security response headers
All HTTP responses SHALL include security headers to protect against common web attacks.
@ -61,3 +59,23 @@ The repository SHALL include a SECURITY.md with responsible disclosure instructi
#### Scenario: Security contact
- **WHEN** a security researcher finds a vulnerability
- **THEN** SECURITY.md provides clear instructions for reporting it
### Requirement: BRouter access control
The BRouter service SHALL be reachable only from the flagship host over a private Hetzner vSwitch, and every request SHALL carry a valid `X-BRouter-Auth` shared-secret header. The token SHALL be stored only in SOPS-encrypted secrets and GitHub Actions secrets, never committed in cleartext.
#### Scenario: Request from public internet
- **WHEN** an attacker sends a request to the BRouter host's public IP on the BRouter service port
- **THEN** the host firewall refuses the connection
#### Scenario: Request from vSwitch without token
- **WHEN** a request arrives on the BRouter host over the vSwitch without a valid `X-BRouter-Auth` header
- **THEN** the Caddy sidecar responds with HTTP 403 and BRouter never sees the request
#### Scenario: Token storage
- **WHEN** `BROUTER_AUTH_TOKEN` is added or rotated
- **THEN** the token is written only to `infrastructure/secrets.infra.env` (SOPS-encrypted) and to the GitHub Actions secret store, and is never committed in cleartext to the repository
#### Scenario: Token rotation
- **WHEN** the token is rotated
- **THEN** operators update SOPS, redeploy the Planner (new token in outbound header), and redeploy the Caddy sidecar (new token in the matcher), in that order, with zero downtime