kevinveenbirkenbachandClaude Opus 4.7
16bdbf03d7
Three classes of drift cleaned up across 85 .md files:
- Em-dashes: replaced ` — ` with the contextually correct separator
(colon for `term: explanation`, period to split clauses across
sentences/source lines, parentheses for asides, semicolon for
tight-linked continuations). Two intentional exceptions remain
in `docs/contributing/documentation.md` (the rule literal) and
inside a fenced ```sh block in `docs/contributing/actions/debugging/ci.md`.
- SPOT self-labels: rewrote "This is the SPOT for X" to describe
the subject directly ("This directory holds X" / "This file
describes X"). Cross-references to other artefacts' canonical
role remain unchanged.
- Heading-emoji position: moved leading-emoji headings (`# 🧩 Title`)
to trailing position (`# Title 🧩`) per the headline rule that
emojis MUST come after the title text.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2.8 KiB
Security Guidelines 🛡️
Infinito.Nexus is designed with security in mind. However, while following our guidelines can greatly improve your system's security, no IT system can be 100% secure. Please report any vulnerabilities as soon as possible.
In addition to the user security guidelines, administrators have additional responsibilities to secure the entire system:
-
Deploy on an Encrypted Server You SHOULD install Infinito.Nexus on an encrypted server to prevent hosting providers from accessing end-user data. For a practical guide on setting up an encrypted server, refer to the Hetzner Arch LUKS repository 🔐. (Learn more about disk encryption on Wikipedia.)
-
Centralized User Management & SSO For robust authentication and central user management, you SHOULD set up Infinito.Nexus using Keycloak and LDAP. This configuration enables centralized Single Sign-On (SSO), simplifying user management and boosting security.
-
Enforce 2FA and Use a Password Manager Administrators MUST enforce 2FA and SHOULD use a password manager with auto-generated passwords. We recommend KeePass. The KeePass database can be stored securely in your Nextcloud instance and synchronized between devices.
-
Avoid Root Logins & Plaintext Passwords Infinito.Nexus MUST NOT allow logging in via the root user or using simple passwords. Instead, an SSH key MUST be generated and transferred during system initialization. When executing commands as root, always use
sudo(or, if necessary,sudo su, but only if you understand the risks). (More information on SSH and sudo is available on Wikipedia.) -
Manage Inventories Securely Your inventories for running Infinito.Nexus MUST be managed in a separate repository and secured with tools such as Ansible Vault 🔒. Sensitive credentials MUST NEVER be stored in plaintext; use a password file to secure these details.
-
Reporting Vulnerabilities If you discover a security vulnerability in Infinito.Nexus, you MUST report it immediately through SECURITY.md and MUST NOT open a public issue. We encourage proactive vulnerability reporting so that issues can be addressed as quickly as possible.
By following these guidelines, both end users and administrators can achieve a high degree of security. Stay vigilant, keep your systems updated, and report any suspicious activity. While we strive for maximum security, no system is completely infallible.