Glossary

Glossary

Every term the wiki uses, in plain language, with a pointer to the page that explains it properly. Terms a newcomer is likely to meet first are marked (basics); the start-from-zero pages introduce them in order, beginning at Start here if you are new.

Term	Meaning
ACL	Access control list: a list of who may reach what. In Twingate, a signed list of the resources a client (or connector) is allowed to reach. Twingate: the four pieces
Active provider	A cloud marked active: true in docs/stages/approved.json, meaning it is applied right now. The active providers' approved figures must together fit under the current phase's ceiling. CI, tests and the cost gate
API (basics)	Application programming interface. Here: the web interface a cloud provider exposes so programs can create and change resources. Everything the web console does is an API call underneath. What is the cloud
API token (basics)	A long random string that authenticates a program to an API. As powerful as a password, and usually less protected. Identity, secrets and zero trust
Apply (basics)	The OpenTofu step that carries out a plan and changes real infrastructure. Always preceded by a plan a human has read. What is infrastructure as code
Application service (appservice)	A Matrix component the homeserver trusts to act for many users. The homeserver pushes events to it over HTTP, so it must be reachable from the homeserver. Bridges are application services. Planned, not built: it belongs to the stage 3 bridge design. Roadmap: stage 3
ATT&CK	MITRE ATT&CK, a public catalogue of attacker techniques. Used to ask which techniques a set of detection rules does not cover. Build your own mini SOC: keep tinkering
Authentication / authorization (basics)	Who are you? versus What may you do? Two different questions; a system can get one right and the other wrong. Identity, secrets and zero trust
auto.tfvars	A value file name (*.auto.tfvars) that OpenTofu loads by itself. The repository ignores it like any *.tfvars, and the committed example is deliberately not named this way. Variables, tfvars and secrets
Branch (basics)	A parallel line of history in git. Work happens on a branch and is merged into main through a pull request. Git, GitHub and pull requests
Branch protection	A GitHub setting that stops direct pushes to main: changes need a pull request with passing checks. Git, GitHub and pull requests: branch protection
Bridge	Software that relays messages between two chat networks, here Discord and Matrix. Planned for stage 3, not built. Roadmap: stage 3
Bucket (basics)	A container of files in object storage, reached over HTTPS with an access key. DigitalOcean's product is Spaces. What is the cloud
CI (basics)	Continuous integration: automated checks that run on every proposed change and report pass or fail. Here CI only tests; it never changes infrastructure. CI, tests and the cost gate
CIDR (basics)	A range of IP addresses written as a start address and a slash number, such as 10.78.0.0/24 (256 addresses). 0.0.0.0/0 means every address. Networking basics
ClickOps	Building infrastructure by clicking in a web console. The thing infrastructure as code replaces. What is infrastructure as code
cloud-init	The standard tool that configures a Linux cloud machine on its first boot from a text file (its user-data) handed over at creation. Droplet hardening
Cloud firewall (basics)	A firewall that runs in the provider's network, outside the machine, so the machine cannot turn it off. Attached here by tag. DigitalOcean network and firewalls
Commit (basics)	One recorded set of changes in git, with a message saying why. Git, GitHub and pull requests
Connector	Twingate's component inside your network. Makes outbound connections only and forwards authorized traffic to resources. Here, two small droplets. Twingate
Container (basics)	An isolated process that sees its own filesystem and network but shares the host's kernel. Lighter than a virtual machine, less isolated. Containers and Docker basics
Controller	Twingate's hosted coordinator: configuration, sign-in, signed ACLs. Never carries traffic. Twingate: the four pieces
Cost gate	scripts/cost_check.py, which fails CI if planned spend exceeds the approved total or an unpriced paid resource appears. How money works in the cloud
Credit specification	An AWS setting on burstable (T-family) instances: standard stops at the credit balance, unlimited bills surplus credits outside the fixed price. The cost gate requires standard. Terraform reference: AWS modules
Data source	In OpenTofu, something that already exists and is looked up rather than created. The admin SSH key here. Lessons learned: the SSH key that already existed
Default deny (basics)	Block everything, then allow only what is needed. Fails safe: a forgotten rule breaks something instead of exposing something. Enterprise habits: default deny
DFD	Data flow diagram: actors, processes, data stores and the flows between them, with trust boundaries drawn on it. Threat Dragon draws one. Threat Dragon exercise
Disposable (basics)	A machine that holds nothing irreplaceable and can be destroyed and rebuilt from code at any time. "Stateless" means roughly the same. How money works: destroy order
Doppler	Hosted secrets manager. Every real secret in this project lives there. Doppler and secrets
Drift	Reality no longer matching the code because something was changed by hand. The next plan shows it. What is infrastructure as code: drift
Droplet (basics)	A DigitalOcean virtual machine. What is the cloud
East-west / north-south	Traffic between machines inside a network versus traffic between the network and the internet. Good cloud designs filter both. Networking basics: a VPC
Functions (DigitalOcean)	DigitalOcean's serverless product, the equivalent of AWS Lambda: a piece of code that runs on a schedule or a request and is billed by the GiB-second, with a free monthly allowance. Deployed with doctl, not OpenTofu. Containers and Docker basics: serverless
GYST	git-your-ship-together, the author's library of reusable, hardened GitHub Actions workflows. CI, tests and the cost gate
HCL (basics)	HashiCorp Configuration Language, the language Terraform and OpenTofu files are written in. Blocks, names and values. What is infrastructure as code
Hypervisor	The software on a physical server that splits it into virtual machines. What is the cloud: a virtual machine
IaC (basics)	Infrastructure as code: describing an environment in text files that a tool turns into real resources. What is infrastructure as code
Idempotent	Safe to run again: applying the same configuration twice changes nothing the second time. What is infrastructure as code: declarative
IdP (basics)	Identity provider, the one service that actually checks who you are and enforces MFA, used by everything else to sign people in. Identity basics: MFA and identity providers
Image (basics)	A frozen filesystem with a program and its dependencies, from which containers are started. Published to a registry such as ghcr.io. Containers and Docker basics
IMDSv2	The session-token version of the AWS instance metadata service. Required on the AWS connector, with a hop limit of 1, so a plain request cannot read the metadata. Terraform reference: AWS modules
Inbound / outbound (basics)	From a machine's view: connections others open toward it, versus connections it opens toward others. This project's droplets allow zero inbound. Networking basics
Instance profile	The AWS wrapper that lets an EC2 instance carry an IAM role. The AWS connector deliberately has none, so there is no cloud credential on the machine to steal. AWS: the same four pieces
instance_of	The field in a stack instance manifest that names the base stack whose code it reuses; the cloud and machine count are taken from that stack. Multiple sites: how the cost gate sees a second site
IP address (basics)	A device's number on a network. Private addresses (10.x, 172.16-31.x, 192.168.x) work only inside one network; public addresses are unique worldwide. Networking basics: addresses
Lateral movement	An attacker moving from the first compromised system to others on the same network. Threat model
Least privilege (basics)	Give each person and program the smallest set of permissions that lets it do its job. Identity basics: least privilege
LINDDUN	A privacy-focused threat categorisation, like STRIDE but for privacy threats. Named, not used, in this wiki. Threat Dragon exercise
Listening (basics)	A program waiting for connections on a port. Only listening programs can be attacked over the network. Networking basics: ports and listening
MFA (basics)	Multi-factor authentication: a second proof beyond the password, such as a code from an app or a hardware key. Identity basics: MFA and identity providers
Module	A reusable OpenTofu building block: a folder of HCL that does one thing and takes inputs. Never applied on its own here. OpenTofu, stacks and modules
NAT gateway	A managed service that lets machines with no public address reach out. Textbook for private machines, but about $33 to $37 a month on AWS or Azure, so the cost gate refuses it. AWS: where the money goes
NOC / SOC / SIEM	A team that watches whether things are up (network operations centre), a team that watches whether anything is suspicious (security operations centre), and the tool that collects and searches the events (security information and event management). Cloud telemetry: NOC, SOC and SIEM
NSG	Network security group, Azure's firewall filter, attached to a subnet or a network interface. Azure: the same four pieces
Object storage (basics)	File storage reached over HTTPS, paid per gigabyte, with no operating system to manage. S3 is the common name; Spaces is DigitalOcean's. What is the cloud
OIDC	OpenID Connect. Here: short-lived identity tokens that let one service authenticate to another without a stored secret. Spacelift: no OIDC on this plan
OpenTofu (basics)	Open-source, MPL-licensed fork of Terraform. Same language, same providers; tofu instead of terraform. What is infrastructure as code
Plan (basics)	The OpenTofu step that compares the code with reality and lists what would be created, changed or destroyed, without doing it. The thing a human reads before confirming. What is infrastructure as code: plan and apply
Plan no-op check	scripts/plan_noop_check.py: with default values, a saved plan of an edited live stack must change nothing and name only the known resource addresses. Variables, tfvars and secrets: the no-op plan check
Port (basics)	A number from 1 to 65535 that directs a packet to the right program on a machine. 22 is SSH, 443 is HTTPS. Networking basics: ports and listening
Portainer	A web UI for a Docker host: stacks, containers, logs. Community Edition is free. It talks to Docker over the local socket, which is root on the host, so its UI is reached only through Twingate here. Containers and Docker basics: Compose and Portainer
OPA / Rego	Open Policy Agent, a general-purpose policy engine, and Rego, the language its policies are written in. Spacelift policies are Rego; this repo tests its push policy with opa test in CI. Spacelift: why a pull request gets no run
Proposed run	A Spacelift plan for a pull request. Gets no credentials in this repo, and the push policy stops Spacelift starting one at all. Spacelift: why a pull request plan gets no credentials
Push policy (Spacelift)	A Rego policy that decides which Git events start a Spacelift run, and whether as a tracked or proposed run. Here: .spacelift/policies/push.rego, which tracks merges that change a stack and never proposes. Spacelift
Provider (basics)	An OpenTofu plugin that knows how to talk to one service's API: DigitalOcean, Twingate. What is infrastructure as code: provider
Public key / private key (basics)	The two halves of a key pair. You publish one and keep the other; anything locked with one opens only with the other. SSH login here uses them instead of passwords. Identity basics: how keys work
Pull request (basics)	A proposal to merge a branch into main, showing the exact diff, with automated checks and human review. Every change here goes through one. Git, GitHub and pull requests
Region (basics)	A provider's datacenter location, with a short code such as tor1 (Toronto). A machine and a VPC live in exactly one. What is the cloud: regions
Registry	Where container images are published and pulled from, such as ghcr.io. Containers and Docker basics
Relay	Twingate component that joins a client and connector when a direct path is impossible, without terminating the encryption. Twingate: the four pieces
Remote network (site)	Twingate's name for a network that connectors serve, here access-tor1. Twingate: the site is created by OpenTofu
Resource	Two meanings. In OpenTofu, one thing the tool creates and tracks. In Twingate, one destination (address plus allowed ports) that a group can be granted. What is infrastructure as code: resource
resource_key	The short, immutable label that names one site's resources (empty means the region). Changing it on a live stack replaces everything it names. Variables, tfvars and secrets
Runbook	Written operating steps: how to build, verify, rotate and tear down. This project's are in docs/stages/. Enterprise habits: runbooks
SASE / SSE	Secure Access Service Edge / Security Service Edge. Vendor categories that bundle ZTNA with other network security services. Small example: remote access
Secret (basics)	Any string that lets its holder do something: a password, a token, a private key. Lives in Doppler here, never in a file. Identity basics: what a secret is
Secrets manager (basics)	A service whose only job is to hold secrets and hand them to programs at run time, by name, with logging and expiry. Identity basics: the fix
Security group	AWS's firewall filter, attached to a machine's network interface; a rule's source can be another group. Why the clouds differ: which machines a rule is about
Serverless (basics)	Running a small program on a schedule or request without a machine of your own; the provider runs it and bills the seconds. Containers and Docker basics: serverless
Settings manifest	docs/settings.json, the one machine-readable list of every setting, from which the Settings reference page is generated and against which tests check the code. Settings reference
Shared responsibility	The split between what the provider secures (hardware, hypervisor, their API) and what you secure (your firewall rules, updates, logins, tokens). What is the cloud: who is responsible
site_name	The human-readable site label used only on telemetry (empty means site-<region>). It never appears in a resource name or tag. Multiple sites and identity
Sites map	An optional sites entry under a provider in approved.json that gives each extra site its own approved figure, inside the provider's total. CI, tests and the cost gate
Spacelift	Hosted runner for infrastructure as code: plans, applies, holds state, waits for approval. Spacelift
Spaces	DigitalOcean's S3-compatible object storage. A bucket of files reached over HTTPS, with optional versioning that keeps earlier copies of every object. What is the cloud
SSH (basics)	The program and protocol for a command line on a remote Linux machine, on TCP port 22. Keys only here, never passwords. Networking basics: SSH
Stack	A unit of infrastructure applied on its own with its own state. One Spacelift stack per stacks/ directory. OpenTofu, stacks and modules
Stack instance	A second deployment of the same stack code, made visible to the cost gate by a data-only manifest under stacks/sites/<resource_key>/. Multiple sites: how the cost gate sees a second site
State (basics)	OpenTofu's record of what it created and the real IDs. Lose it and the tool forgets what it built; it can contain secrets, so where it lives matters. What is infrastructure as code: state
Stateful firewall	One that lets replies to allowed connections through automatically. New connections in either direction still need a rule. DigitalOcean network and firewalls: inbound and outbound
STRIDE	Six prompts for finding threats: spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege. Threat model exercise: the STRIDE table
Supply chain (basics)	Everything you pull in from others: actions, packages, images, installers. You are only as secure as all of it, so pin versions by hash and verify downloads. Git, GitHub and pull requests: the supply chain problem
Tag (DigitalOcean)	A label on a resource. Firewalls attach to tags, so a droplet is protected the moment it has one. DigitalOcean network and firewalls: attach by tag
TCP / UDP (basics)	Two ways to send data to a port. TCP sets up a connection first (SSH, HTTPS); UDP just sends (DNS, time sync, Twingate peer-to-peer). Networking basics: TCP and UDP
Terraform (basics)	The tool that made infrastructure as code mainstream. OpenTofu is its open-source fork; read "Terraform" here as OpenTofu. What is infrastructure as code
tfvars	A file of values for your own site (terraform.tfvars), ignored by git. A committed .example shows the shape. Never holds a secret. Variables, tfvars and secrets
Threat Dragon	OWASP Threat Dragon, a free tool for drawing a data flow diagram and attaching threats to it. The repository ships a model in docs/threat-model/. Threat Dragon exercise
Threat model	A written list of what is worth protecting, who might come for it, what stops them, and what is accepted. Threat model
Tracked run	A Spacelift run on main that can apply after confirmation. The only kind that gets credentials. Spacelift: the run lifecycle
Trust boundary	A line on a diagram where the level of trust changes, such as the internet versus the VPC. Threats cluster where flows cross one. Threat model exercise: draw the trust boundaries
User-data	The cloud-init configuration passed to a droplet at creation. Readable from the metadata endpoint. Droplet hardening: first boot
Virtual machine (VM) (basics)	A slice of a physical server that behaves like a whole computer with its own operating system. A droplet is one. What is the cloud: a virtual machine
Volume (basics)	A folder on the host mounted into a container so its data survives the container. Containers and Docker basics: state
VPC (basics)	Virtual private cloud: a private network you define, that only your machines are on. Networking basics
VPN (remote access)	A tunnel that places a device on a private network. The alternative this project chose not to use. Why ZTNA and not a VPN
Zero trust (basics)	A design rule: never grant access because of where a request comes from; grant it per request based on who is asking and what for. Identity basics: zero trust
ZTNA	Zero trust network access: per-user, per-resource access decided on every connection, with no implicit trust from network location. Twingate is the ZTNA product here. Why ZTNA and not a VPN