Security Practices

Security Practices

This page documents the security measures baked into the project. Nothing here is revolutionary — it's mostly about being disciplined with the basics.

Action Pinning

All GitHub Actions are pinned to full commit SHAs, not version tags:

# ✅ Pinned to commit SHA
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0

# ❌ Not this — tags can be moved
- uses: actions/checkout@v4

Why? Tags are mutable — a compromised action could have its v4 tag pointed at malicious code. A commit SHA is immutable. If someone compromises the action, the SHA won't match and the workflow fails rather than running malicious code.

🔗 GitHub's guidance on pinning actions

Dependabot

Dependabot monitors the Actions used in workflows and raises PRs when updates are available. This keeps things patched without manual checking:

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

Secrets Never in Code

• Application secrets → Azure KeyVault
• Infrastructure credentials → GitHub Secrets (per-environment)
• Token replacement happens at runtime, never committed
• .env files containing secrets are never pushed to the repository

See Secrets & Credentials for the full breakdown.

Least Privilege

• The Azure SPN only has Key Vault Secrets User on the specific vault — nothing else
• SSH access uses a dedicated key pair — not a personal key
• The smb user has no shell access or sudo — it's purely for file sharing
• NUT client runs as secondary — it can't control the UPS, only monitor

Host Identity Verification

SSH host fingerprints are pinned as GitHub Secrets rather than using ssh-keyscan at runtime. This prevents MITM attacks where an attacker could intercept the WireGuard tunnel and present a fake host key.

See Network & Connectivity for details.

Network Isolation

• All management access goes through the WireGuard tunnel
• The WireGuard endpoint is the only inbound port on the network edge
• GitHub Actions runners are ephemeral — no persistent access tokens on disk

Permissions Block

All workflows declare minimal GitHub token permissions:

permissions:
  contents: read

This follows the principle of least privilege for the GITHUB_TOKEN — the workflow only needs to read the repository, not write to it.