security: require explicit safe transport for remote administration #356

New issue

Closed

opened 2026-07-16 21:03:42 +02:00 by dries · 0 comments

dries commented

2026-07-16 21:03:42 +02:00

Owner

What to build

Make remote administration transport choices fail safe. Encrypted transport should be the normal path, while plaintext operation must require an explicit trusted-overlay opt-in and incomplete TLS configuration must stop the remote listener.

Acceptance criteria

Remote client and listener configuration cannot silently select plaintext transport.
Providing only a TLS certificate or only a TLS key returns a startup error.
Plaintext bearer-token transport requires an explicit trusted-overlay configuration.
Logs and status output clearly report the selected security posture without exposing tokens.
Tests cover TLS, explicit plaintext, incomplete TLS, and accidental plaintext configurations.
User-facing remote setup documentation describes the secure default and trusted-overlay exception.

Blocked by

None - can start immediately.

## What to build Make remote administration transport choices fail safe. Encrypted transport should be the normal path, while plaintext operation must require an explicit trusted-overlay opt-in and incomplete TLS configuration must stop the remote listener. ## Acceptance criteria - [ ] Remote client and listener configuration cannot silently select plaintext transport. - [ ] Providing only a TLS certificate or only a TLS key returns a startup error. - [ ] Plaintext bearer-token transport requires an explicit trusted-overlay configuration. - [ ] Logs and status output clearly report the selected security posture without exposing tokens. - [ ] Tests cover TLS, explicit plaintext, incomplete TLS, and accidental plaintext configurations. - [ ] User-facing remote setup documentation describes the secure default and trusted-overlay exception. ## Blocked by None - can start immediately.