42 lines
2.7 KiB
Markdown
42 lines
2.7 KiB
Markdown
# Deployment facts and live-test plan
|
|
|
|
## MeshCentral deployment
|
|
|
|
- Hostname: `mesh.ledrew.me`
|
|
- Internal address: `10.10.10.177:80`
|
|
- Reported version: `1.2.5`
|
|
- Location: LXC on PVE2
|
|
- Installation method: Proxmox Community Scripts MeshCentral installer
|
|
- Test endpoint: `PVE3`
|
|
- Integration account: `sa_clawdia`
|
|
|
|
## Secret handling
|
|
|
|
The integration password was provided out-of-band in the project conversation and is intentionally **not stored in this repository, project files, logs, command lines, or agent prompts**. The real adapter must receive it through a protected runtime secret mechanism, such as a root-readable `0600` environment file or equivalent secret store.
|
|
|
|
If the credential is ever committed, logged, pasted into a command, or exposed to an unintended audience, rotate it immediately in MeshCentral.
|
|
|
|
## Live-test prerequisites
|
|
|
|
Before connecting:
|
|
|
|
- Confirm that `mesh.ledrew.me` is intended to resolve/reach the internal MeshCentral service from the proposed bridge host.
|
|
- Determine whether the reported port 80 is plain HTTP behind a reverse proxy and whether the MeshCentral control channel is available at the corresponding `/control.ashx` WebSocket endpoint.
|
|
- Verify the certificate/trust path if the control channel uses TLS; never disable certificate validation.
|
|
- Confirm `sa_clawdia` has only the required read-only permissions for the first test.
|
|
- Confirm `PVE3` is the sole target allowlisted for the first live test.
|
|
- Use only read-only operations: authentication/health check, server version, device groups, device inventory, and selected device metadata.
|
|
- Capture no password or session token in logs.
|
|
|
|
## Security Hardening Status
|
|
|
|
- **Concurrency & Rate Limits**: 5 concurrent requests max; token-bucket rate limiter applied to all outbound requests.
|
|
- **Audit Redaction**: Structured audit logs automatically redact secrets (base64, hex, known key patterns) and never capture credentials.
|
|
- **Verification**: 90/90 tests pass; TypeScript build passes with no errors; ESLint passes with no warnings.
|
|
- **Remaining Live-Test Gates**: See TODO.md for the operational checklist. Rob authorized read-only project access on 2026-08-26; no additional per-test approval is required, but all scope and stop conditions remain mandatory.
|
|
- **Rollback Rules**: If rollback is required: stop service immediately, rotate integration credential in MeshCentral, review audit logs, and document incident.
|
|
|
|
## Authorization checkpoint
|
|
|
|
A live connectivity test is authorized under Rob's project-level read-only access decision on 2026-08-26. The authorization covers only the documented read-only operations and PVE3 target; it does not cover commands, diagnostics, or state changes.
|