Skip to content

Security: farscapian/printstack

Security

docs/security.md

Security (printstack-specific)

Generic rules (never echo secrets, env hygiene): see .agentstack/docs/security.md.

.env file permissions

Bootstrap scripts warn if the deployment env file is world-readable. Recommend chmod 600:

chmod 600 ~/.printstack/default.env

Git hygiene

Track in git Never track
examples/deployment.env.example ~/.printstack/*.env (real deployment files)
Scripts, cloud-init templates *.img, *.img.xz

~/.printstack/ (artifacts, logs, deployment *.env files) lives outside the repo entirely -- nothing there is ever tracked or gitignored, it just never enters the working tree.

Secrets in this project

All in the single deployment env file (~/.printstack/default.env by default):

Secret Used for
WIFI_PASSWORD Pi WiFi join
SSH_PUBKEYS SSH access on all nodes
NAMECHEAP_API_KEY DNS-01 TLS challenge
NAMECHEAP_API_USER Namecheap API auth

TLS / API keys

Namecheap API requires whitelisting NAMECHEAP_CLIENT_IP (management machine's public IP). The API key grants DNS record modification for domains in the account -- protect it like a password.

Firewall defaults

  • SSH: restricted to SSH_CIDRS when set; otherwise open to any
  • Print services: always restricted to PRINT_CIDRS
  • TLS mode: port 443 open to any (required for HTTPS printing from outside LAN if desired)

When tightening SSH, ensure your management machine's IP is in SSH_CIDRS.

There aren't any published security advisories