sns-network-solutions/vpn-and-access.md at feature/issue-48

Samuel James b1a35783bb Consolidate 7 divisions to 3: Networking, Digital, Support

- Merge Infrastructure + Secure + Systems → SNS Networking (Business #1)
- Merge Web + Software + Cloud → SNS Digital (planned)
- SNS Support unchanged (planned)
- Add infra/ folder with 16 FOSS-first buildable designs
- Update all agent knowledge, division briefs, legal structure
- Restructure businesses/ from 7 to 3 operating folders

2026-07-18 13:08:23 -05:00

3.0 KiB

Raw Permalink Blame History

Entity: SNS Networking · Status: Partially built (WireGuard + Tailscale active)

What it is

Zero-trust-lite access model. No service is reachable from the public internet unless it explicitly needs to be. All management access goes through VPN. All web UIs gated by Authelia 2FA.

Layers

Layer 1: Network (WireGuard / Tailscale)
  └── Can you even reach the port?

Layer 2: Authentication (Authelia + SSH keys)
  └── Who are you?

Layer 3: Authorization (per-service ACLs)
  └── Are you allowed to do this?

Access Matrix

What	Who	How they get in
Proxmox Web UI	Sam	Tailscale IP → port 8006
SSH to any host	Sam	WireGuard/Tailscale → ProxyJump
Gitea web	Sam + future devs	Caddy → Authelia 2FA → Gitea
Monitoring (Grafana)	Sam	Caddy → Authelia 2FA → Grafana
Client websites	Public	Caddy → site (no auth)
Client WordPress admin	Client	Caddy → Authelia or IP-restrict
Vaultwarden	Sam	Caddy → Authelia 2FA → Vaultwarden

Authelia Configuration (key decisions)

Backend: file-based users (YAML). Swap to LDAP when user count > 10.
2FA: TOTP (Authelia built-in). No hardware key requirement yet.
Session: 12h idle timeout, 7d absolute timeout.
Policy: two_factor for all protected domains. No single_factor exceptions.
Integration: Caddy forward_auth directive per-site.

# Caddyfile pattern for Authelia-protected service
grafana.internal.sns {
    forward_auth authelia:9091 {
        uri /api/authz/forward-auth
        copy_headers Remote-User Remote-Groups Remote-Email
    }
    reverse_proxy grafana:3000
}

Certificate Management

Scope	Tool	Method
Public sites	Caddy (built-in ACME)	Let's Encrypt, auto-renewal
Internal services	Caddy (internal CA) or Step-CA	Caddy can issue self-signed internal certs automatically
WireGuard	Native (Noise protocol)	No PKI needed — public key exchange
SSH	OpenSSH keys	Ed25519 keys, no CA (until 20+ hosts)

Future: SSH Certificate Authority (step-ca) when managing keys for 20+ hosts becomes unwieldy.

Security Posture

No service exposed without auth (except public websites by design).
2FA mandatory on every web UI — no exceptions.
Session tokens short-lived — 12h idle forces re-auth.
No VPN split tunneling for management — if you're on the mesh, you can reach management ports. If you're not, you can't. Binary.
Key rotation: SSH keys rotated annually. WireGuard keys annually. Authelia TOTP secrets only on device change.

Upgrade Path

Keycloak + LDAP: When you have employees or multiple clients needing SSO.
Hardware keys (WebAuthn): When the threat model justifies it (high-value targets).
SSH CA (step-ca): When managing individual authorized_keys files across 20+ hosts becomes toil.
Mutual TLS (mTLS): For service-to-service auth if zero-trust goes full-depth.

3.0 KiB Raw Permalink Blame History

VPN & Access Control — SNS Networking