Security and backup model

Safeguards in the design

• Dashboard/API runs as dashboardportal, not root.
• Privileged work uses a root-owned helper with typed operations, input validation, and a local socket.
• Native apps have per-project service accounts, environment files, release directories, and systemd hardening.
• Generated Nginx changes are restricted to Portal-owned files, tested before reload, and restored on failure.
• Credentials, environment content, webhook endpoints, and database passwords are encrypted at rest; public responses redact them.

Operator responsibilities

• Use trusted repositories only and review Docker Compose before deploying it.
• Protect the owner password, HOSTMGR_SECRET_KEY, release signing private key, backups, and SSH access.
• Keep 80/443 public only as required; do not publish Portal’s loopback port 3100.
• Do not hand-edit Portal-managed Nginx files or project systemd units. Use the dashboard or restore a verified snapshot.

Security limits

Portal deliberately has no free-form terminal or arbitrary command endpoint. It also does not make untrusted repository code safe. Native source and trusted Compose source are application code chosen by the owner; Compose restrictions are guardrails, not a multi-tenant sandbox.