Levelrail

Appearance

Security overview ​

This page is a map, not a duplicate. Each topic below has its own detailed page; this one explains how the pieces fit together and links out.

Secrets: envelope encryption ​

Every secret (an app env var marked secret: true, email credentials, API tokens, and so on) gets its own random data encryption key (DEK). Every DEK is wrapped under one master key held in memory by the control plane, never written to disk in plaintext.

TIP

Rotating the master key re-wraps every DEK without ever exposing plaintext. See Master key rotation for the full procedure and failure modes.

Credentials for backup targets and registry integrations follow the same write-only pattern described in Backups and storage: once saved, the plaintext is never returned by the API again, only a masked placeholder.

Sessions and tokens ​

  • Session cookies are set Secure, which means they only round-trip over HTTPS. Embedded Caddy is expected to terminate TLS in front of the control plane; hitting it directly over plain HTTP (common in local dev) means the cookie never comes back on the next request.
  • API tokens are minted per-user, scoped by ability, and can be issued through a device-code flow for headless environments.
  • Two-factor authentication (TOTP) is available per user, with recovery codes for account lockout.

Full detail on all three: Identity and access.

Authorization: abilities, roles, and IAM policies ​

Levelrail layers two permission models:

  • Abilities: a flat list (AbilityRead, AbilityWrite, AbilityDeploy, AbilityRoot, and so on) attached to a user or token. Cheap to check, coarse-grained.
  • IAM policies: AWS-IAM-shaped Allow/Deny documents scoped to a specific app or database, for when a flat ability isn't precise enough.

Evaluation order, the full ability list, and policy examples: Identity and access.

TLS and network exposure ​

  • Certificates are issued and renewed automatically through embedded Caddy's ACME client. See the ACME verification runbook if issuance fails.
  • HSTS (Strict-Transport-Security) is opt-in, not on by default, because turning it on for a domain that later loses TLS locks users out until the header expires. See Domains and ingress.
  • WAF mode and rate limiting are configurable per domain, with a detect-only mode for testing rules before enforcing them. See Domains and ingress.
  • The node agent dials out to the control plane. No inbound ports need to be open on a managed server for enrollment or day-to-day operation.

Audit log ​

Every mutating API call from an authenticated principal is recorded: who, what, when, and the outcome. The log is queryable and exportable as CSV. See Identity and access.

Reporting a vulnerability ​

Levelrail does not yet have a dedicated security disclosure address. Until one exists, open a private security advisory on the GitHub repository rather than a public issue.

What this does not cover yet ​

  • No SSO/SAML, only local password auth and OAuth sign-in.
  • No secret scanning of an app's own source repository.
  • No container-escape hardening beyond what Docker itself provides; rootless Docker and Podman support are open questions (see the root CLAUDE.md's open decisions).

See also ​

Released under the Apache 2.0 License.

Copyright © GLINCKER