Security: keys on the hosts, mTLS and signed releases
Sard manages backups but holds no keys to them. Below: what is protected, how, and what that does not protect.
The server is a control plane, not a key holder
Storage addresses, repository passwords and access keys stay on the agent hosts and are never sent to the server. Compromising the server does not expose the backups, but it does let an attacker run steps on the agents: we do not hide that.
The agent dials out, over mutual TLS
The agent connects to the server over gRPC with mTLS, so hosts open no inbound ports. The agents’ port 9090 is open, but without a certificate from the server’s CA only registration is reachable, and only with a one-time token of limited lifetime.
A CA of its own
- The server issues the agents’ certificates itself. The CA key sits in a file with 0600 permissions, and the CA lives 10 years. An existing CA can be imported.
- The server certificate lasts 90 days and is reissued on its own, and its key lives only in memory.
- The agent renews its certificate by itself without interrupting work. The console and Telegram warn when the term is running out.
- Losing the CA key means registering every agent again, so the key goes into the self-backup and should also be kept apart from the database.
Secrets: by name, from a file, only where allowed
A source config names a secret, and the value sits in a file on the agent host. The host’s operator decides where a secret may go: a binding names the plugin, host and database, and the password goes nowhere else, whatever the server sends. For PostgreSQL scram-sha-256 and server TLS certificate verification apply by default. Secret values are masked in step logs.
Administrator sign-in and the console
- A password of 12 to 1024 characters is stored as an Argon2id hash. Five wrong attempts in 15 minutes block the address for 15 minutes.
- The first sign-in uses a one-time code from the server log.
- The console listens on 127.0.0.1 only by default: the password and the setup code travel over HTTP without TLS, so a TLS proxy goes in front.
Signed releases
Agent releases and install files are signed with minisign, and the images in GHCR with cosign. Releases carry SBOMs (CycloneDX) and GitHub build provenance. Take the release key from the repository, not from the server you downloaded the package from. Everything can be verified offline too.
About vulnerabilities
Do not open a public issue: the private reporting procedure is in the repository’s SECURITY.md.