# VPN & Access Control — SNS Networking

**Entity:** SNS Networking · **Status:** Partially built (WireGuard + Tailscale active)

## What it is

Zero-trust-lite access model. No service is reachable from the public internet unless
it explicitly needs to be. All management access goes through VPN. All web UIs gated
by Authelia 2FA.

## Layers

```
Layer 1: Network (WireGuard / Tailscale)
  └── Can you even reach the port?

Layer 2: Authentication (Authelia + SSH keys)
  └── Who are you?

Layer 3: Authorization (per-service ACLs)
  └── Are you allowed to do this?
```

## Access Matrix

| What | Who | How they get in |
|------|-----|-----------------|
| Proxmox Web UI | Sam | Tailscale IP → port 8006 |
| SSH to any host | Sam | WireGuard/Tailscale → ProxyJump |
| Gitea web | Sam + future devs | Caddy → Authelia 2FA → Gitea |
| Monitoring (Grafana) | Sam | Caddy → Authelia 2FA → Grafana |
| Client websites | Public | Caddy → site (no auth) |
| Client WordPress admin | Client | Caddy → Authelia or IP-restrict |
| Vaultwarden | Sam | Caddy → Authelia 2FA → Vaultwarden |

## Authelia Configuration (key decisions)

- **Backend:** file-based users (YAML). Swap to LDAP when user count > 10.
- **2FA:** TOTP (Authelia built-in). No hardware key requirement yet.
- **Session:** 12h idle timeout, 7d absolute timeout.
- **Policy:** two_factor for all protected domains. No single_factor exceptions.
- **Integration:** Caddy `forward_auth` directive per-site.

```
# Caddyfile pattern for Authelia-protected service
grafana.internal.sns {
    forward_auth authelia:9091 {
        uri /api/authz/forward-auth
        copy_headers Remote-User Remote-Groups Remote-Email
    }
    reverse_proxy grafana:3000
}
```

## Certificate Management

| Scope | Tool | Method |
|-------|------|--------|
| Public sites | Caddy (built-in ACME) | Let's Encrypt, auto-renewal |
| Internal services | Caddy (internal CA) or Step-CA | Caddy can issue self-signed internal certs automatically |
| WireGuard | Native (Noise protocol) | No PKI needed — public key exchange |
| SSH | OpenSSH keys | Ed25519 keys, no CA (until 20+ hosts) |

**Future:** SSH Certificate Authority (step-ca) when managing keys for 20+ hosts
becomes unwieldy.

## Security Posture

- **No service exposed without auth** (except public websites by design).
- **2FA mandatory** on every web UI — no exceptions.
- **Session tokens short-lived** — 12h idle forces re-auth.
- **No VPN split tunneling for management** — if you're on the mesh, you can reach
  management ports. If you're not, you can't. Binary.
- **Key rotation:** SSH keys rotated annually. WireGuard keys annually.
  Authelia TOTP secrets only on device change.

## Upgrade Path

- **Keycloak + LDAP:** When you have employees or multiple clients needing SSO.
- **Hardware keys (WebAuthn):** When the threat model justifies it (high-value targets).
- **SSH CA (step-ca):** When managing individual authorized_keys files across 20+ hosts
  becomes toil.
- **Mutual TLS (mTLS):** For service-to-service auth if zero-trust goes full-depth.