Initial project documentation and status

2026-08-30 14:46:23 -04:00
commit 765f372c72
50 changed files with 12916 additions and 0 deletions
@@ -0,0 +1,41 @@
+# Deployment facts and live-test plan
+
+## MeshCentral deployment
+
+- Hostname: `mesh.ledrew.me`
+- Internal address: `10.10.10.177:80`
+- Reported version: `1.2.5`
+- Location: LXC on PVE2
+- Installation method: Proxmox Community Scripts MeshCentral installer
+- Test endpoint: `PVE3`
+- Integration account: `sa_clawdia`
+
+## Secret handling
+
+The integration password was provided out-of-band in the project conversation and is intentionally **not stored in this repository, project files, logs, command lines, or agent prompts**. The real adapter must receive it through a protected runtime secret mechanism, such as a root-readable `0600` environment file or equivalent secret store.
+
+If the credential is ever committed, logged, pasted into a command, or exposed to an unintended audience, rotate it immediately in MeshCentral.
+
+## Live-test prerequisites
+
+Before connecting:
+
+- Confirm that `mesh.ledrew.me` is intended to resolve/reach the internal MeshCentral service from the proposed bridge host.
+- Determine whether the reported port 80 is plain HTTP behind a reverse proxy and whether the MeshCentral control channel is available at the corresponding `/control.ashx` WebSocket endpoint.
+- Verify the certificate/trust path if the control channel uses TLS; never disable certificate validation.
+- Confirm `sa_clawdia` has only the required read-only permissions for the first test.
+- Confirm `PVE3` is the sole target allowlisted for the first live test.
+- Use only read-only operations: authentication/health check, server version, device groups, device inventory, and selected device metadata.
+- Capture no password or session token in logs.
+
+## Security Hardening Status
+
+- **Concurrency & Rate Limits**: 5 concurrent requests max; token-bucket rate limiter applied to all outbound requests.
+- **Audit Redaction**: Structured audit logs automatically redact secrets (base64, hex, known key patterns) and never capture credentials.
+- **Verification**: 90/90 tests pass; TypeScript build passes with no errors; ESLint passes with no warnings.
+- **Remaining Live-Test Gates**: See TODO.md for the operational checklist. Rob authorized read-only project access on 2026-08-26; no additional per-test approval is required, but all scope and stop conditions remain mandatory.
+- **Rollback Rules**: If rollback is required: stop service immediately, rotate integration credential in MeshCentral, review audit logs, and document incident.
+
+## Authorization checkpoint
+
+A live connectivity test is authorized under Rob's project-level read-only access decision on 2026-08-26. The authorization covers only the documented read-only operations and PVE3 target; it does not cover commands, diagnostics, or state changes.