b1a35783bb
- Merge Infrastructure + Secure + Systems → SNS Networking (Business #1) - Merge Web + Software + Cloud → SNS Digital (planned) - SNS Support unchanged (planned) - Add infra/ folder with 16 FOSS-first buildable designs - Update all agent knowledge, division briefs, legal structure - Restructure businesses/ from 7 to 3 operating folders
84 lines
3.0 KiB
Markdown
84 lines
3.0 KiB
Markdown
# VPN & Access Control — SNS Networking
|
|
|
|
**Entity:** SNS Networking · **Status:** Partially built (WireGuard + Tailscale active)
|
|
|
|
## What it is
|
|
|
|
Zero-trust-lite access model. No service is reachable from the public internet unless
|
|
it explicitly needs to be. All management access goes through VPN. All web UIs gated
|
|
by Authelia 2FA.
|
|
|
|
## Layers
|
|
|
|
```
|
|
Layer 1: Network (WireGuard / Tailscale)
|
|
└── Can you even reach the port?
|
|
|
|
Layer 2: Authentication (Authelia + SSH keys)
|
|
└── Who are you?
|
|
|
|
Layer 3: Authorization (per-service ACLs)
|
|
└── Are you allowed to do this?
|
|
```
|
|
|
|
## Access Matrix
|
|
|
|
| What | Who | How they get in |
|
|
|------|-----|-----------------|
|
|
| Proxmox Web UI | Sam | Tailscale IP → port 8006 |
|
|
| SSH to any host | Sam | WireGuard/Tailscale → ProxyJump |
|
|
| Gitea web | Sam + future devs | Caddy → Authelia 2FA → Gitea |
|
|
| Monitoring (Grafana) | Sam | Caddy → Authelia 2FA → Grafana |
|
|
| Client websites | Public | Caddy → site (no auth) |
|
|
| Client WordPress admin | Client | Caddy → Authelia or IP-restrict |
|
|
| Vaultwarden | Sam | Caddy → Authelia 2FA → Vaultwarden |
|
|
|
|
## Authelia Configuration (key decisions)
|
|
|
|
- **Backend:** file-based users (YAML). Swap to LDAP when user count > 10.
|
|
- **2FA:** TOTP (Authelia built-in). No hardware key requirement yet.
|
|
- **Session:** 12h idle timeout, 7d absolute timeout.
|
|
- **Policy:** two_factor for all protected domains. No single_factor exceptions.
|
|
- **Integration:** Caddy `forward_auth` directive per-site.
|
|
|
|
```
|
|
# Caddyfile pattern for Authelia-protected service
|
|
grafana.internal.sns {
|
|
forward_auth authelia:9091 {
|
|
uri /api/authz/forward-auth
|
|
copy_headers Remote-User Remote-Groups Remote-Email
|
|
}
|
|
reverse_proxy grafana:3000
|
|
}
|
|
```
|
|
|
|
## Certificate Management
|
|
|
|
| Scope | Tool | Method |
|
|
|-------|------|--------|
|
|
| Public sites | Caddy (built-in ACME) | Let's Encrypt, auto-renewal |
|
|
| Internal services | Caddy (internal CA) or Step-CA | Caddy can issue self-signed internal certs automatically |
|
|
| WireGuard | Native (Noise protocol) | No PKI needed — public key exchange |
|
|
| SSH | OpenSSH keys | Ed25519 keys, no CA (until 20+ hosts) |
|
|
|
|
**Future:** SSH Certificate Authority (step-ca) when managing keys for 20+ hosts
|
|
becomes unwieldy.
|
|
|
|
## Security Posture
|
|
|
|
- **No service exposed without auth** (except public websites by design).
|
|
- **2FA mandatory** on every web UI — no exceptions.
|
|
- **Session tokens short-lived** — 12h idle forces re-auth.
|
|
- **No VPN split tunneling for management** — if you're on the mesh, you can reach
|
|
management ports. If you're not, you can't. Binary.
|
|
- **Key rotation:** SSH keys rotated annually. WireGuard keys annually.
|
|
Authelia TOTP secrets only on device change.
|
|
|
|
## Upgrade Path
|
|
|
|
- **Keycloak + LDAP:** When you have employees or multiple clients needing SSO.
|
|
- **Hardware keys (WebAuthn):** When the threat model justifies it (high-value targets).
|
|
- **SSH CA (step-ca):** When managing individual authorized_keys files across 20+ hosts
|
|
becomes toil.
|
|
- **Mutual TLS (mTLS):** For service-to-service auth if zero-trust goes full-depth.
|