Security model
Who can do what, where the boundaries are, and what CloudZH does not protect against.
Layers
| Layer | Protection |
|---|---|
| Entry | Caddy as the only door, HTTPS everywhere, admin apps behind the dashboard login, session cookie removed before requests reach an app |
| Sign-in | Password policy, passkeys, authenticator codes with recovery codes, lockout after failed attempts, devices list with sign-out |
| Rules | Admin only from home network or VPN, 2FA required, password confirmation for sensitive actions |
| Dashboard | No privileges, hardened container, no third-party packages |
| Agent | Fixed command list over a Unix socket, systemd hardening, paths checked without following symlinks, audit log |
| Server | System software only from the command line, Fail2Ban on logins, security updates by button |
Secrets
- Invite links are stored only as hashes. License keys are checked by hash and stored encrypted, so you can view them in your account.
- AI keys are stored encrypted, the browser sees the last four characters.
- Your Plex account token stays in memory during setup only.
- Admin apps get their API keys from their own config files; keys are never sent to the browser.
Limits
Whoever has root on the server can read and change everything, including CloudZH. Two apps, Lingarr and Requestrr, run without their own login and are reachable by other containers on the Docker network; from outside they sit behind the dashboard login like every admin app.