Security & Privacy Policy

NXD is engineered with a security-first architecture. It strictly isolates credentials, enforces identity verification, and prevents ambient privilege escalation.

Core Security Invariants

1. Secret Isolation & Mediation

• No Secrets in Nix Store: Secret values (SSH private keys, API tokens, Tailscale preauth keys) are never written into Nix store paths or canonical JSON specifications.
• Binding References Only: Canonical configurations contain only secret binding coordinates (e.g. secret/hosts/medo/tailscale-preauth-key).
• Runtime Resolution: Secrets are resolved at runtime via SOPS/age directly into process memory or temporary files with strict file permissions (0600), cleaned up automatically upon exit.

2. Zero-Trust Identity Verification

• Exact Host Key Pinning: Every SSH transport connection verifies target host Ed25519 host keys against managed identity records (identity.json). Connections with mismatched or unverified host keys are immediately refused.
• No Ambiguous Mutators: Direct target mutation routes operate strictly on verified exact node identities and deployment targets.

3. Fail-Closed Planning

• Node Ownership Mismatches: Re-enrollment or deletion of resources owned under a different user or tag requires explicit operator --reenroll or --replace flags with approved plan digests.
• Digest-Bound Execution: nxd apply and nxd switch execute only exact, signed/recorded plan digests. Any change in inputs between planning and apply invalidates the plan.

Reporting Security Vulnerabilities

Report security issues privately to LamT ([email protected]).

[!WARNING] Do not file public issues containing secret values, encrypted SOPS documents, private endpoints, or raw production log traces.