Robust authentication
Signed JWTs plus opaque refresh tokens, stored hashed and rotated on every use, in an HttpOnly cookie. Passwords hashed with Argon2id (OWASP parameters).
Security & privacy
Built to protect what matters
Your data never leaves your server. Security is built into every layer of the platform — from password hashing to the module sandbox.
Two-factor authentication
TOTP (RFC 6238) with the secret encrypted at rest, single-use backup codes hashed with Argon2id, and 2FA enforceable for all administrators.
Step-up re-authentication
Critical actions — API tokens, account security — require proving presence again through a dedicated token that grants no API access of its own.
Encryption
AES-256-GCM for secrets at rest: TOTP, SMTP passwords, LDAP binds, remote-mount credentials. A full set of security headers (HSTS, CSP, X-Frame-Options…).
Execution lockdown
On Linux, the seccomp crate blocks <code>execve</code> in modules that do not need it: even a compromised dependency cannot run a command on the host.
Schema separation
Each app keeps its tables in its own PostgreSQL schema: clean boundaries, independent migrations and targeted backups.
Audit trail
Every administrative action is recorded — who, what, when, from where — in an allowlist-based journal: no secret can ever surface there, even by accident.
Sessions under control
Per-device revocation, configurable idle expiry, a password policy per organisational unit, and a security dashboard.
No information leaks
Public routes never distinguish “unknown email” from “wrong password” — a dummy hash is even verified to equalise response times.
Derived internal secret
Each module receives an HMAC-derived secret, verified in constant time: a compromised module cannot impersonate another.
No calls to Google
Interface fonts are served by your own instance, not a CDN: the HTML no longer contains any reference to <code>fonts.googleapis.com</code> or <code>fonts.gstatic.com</code>, not even a preconnect hint. Open your browser's Network tab — nothing goes to Google, and an instance cut off from the Internet renders identically.
Overload shield
Per-IP rate limiting, per-user budgets, a concurrency cap with load-shedding and slow-request cut-off — built into the server, tunable live.
Our design principles
- Total sovereignty — 100% self-hosted, no telemetry, no third-party service required — external integrations (GIF search, push notifications) remain optional.
- Least privilege — the
kubuno-seccompcrate blocks theexecvecall inside modules. - Data isolation — a dedicated PostgreSQL schema per app, never a table outside its scope.
- Protected secrets — passwords and refresh tokens never appear in logs or JSON responses.
- Transparency — all the code is free software (AGPLv3) and publicly auditable.