Security & hardening

Security is built into every layer.

Authentication & encryption #

  • Short-lived access JWTs + opaque refresh tokens in an HttpOnly cookie.
  • Passwords in Argon2id; sensitive data in AES-256-GCM.
Flow: browser, core (verifies the JWT), then module via injected headers
The core authenticates, then proxies while injecting the identity; the module never sees the tokens.

Isolation #

  • Seccomp sandbox: modules cannot execute processes (execve forbidden).
  • One PostgreSQL schema per module; no tables outside its scope.
  • Internal routes protected by X-Internal-Secret; HSTS / X-Frame-Options headers; anti-DDoS hardening.
Best practice

All the code is free software (AGPLv3) and auditable. Keep your secrets out of the repositories. The token signing secret (jwt_secret) can be changed at any time — that signs everyone out, nothing more. Encrypted data, for its part, depends on a separate key (/var/lib/kubuno/data.key): if you suspect it has been weak or exposed, renew it with kubuno security:rekey, which re-encrypts everything it protects. kubuno security:rekey --check verifies, without writing anything, that the instance can still read its own secrets.