Security and compliance

Two things drive the security posture here. The estate is a family home network, so the consequences of getting exposure wrong are immediate and personal. And it is a deliberate practice ground for the controls a regulated environment actually asks for, which is why two prudential standards are run against it end to end rather than name-dropped.

471architecture decisions recorded
49decisions published here in full
97CI/CD pipelines, 76 of them deploying

Nothing reaches the internet without a gate or a recorded approval

The rule is that a public hostname is three coupled resources — a tunnel route, a DNS record and an access application — and that adding the first two without the third is the silent failure the control exists to prevent. It is silent because everything works: the service is reachable, nothing errors, and the only symptom is that it is reachable by everyone.

That was not theoretical. An audit diffing tunnel routes against access applications found several hostnames published with no gate. Each had a legitimate reason — anonymous clients genuinely cannot complete a browser identity handshake — and none had been recorded or approved. The decisions were implicit, which is the same as absent.

Two things closed it. A CI conformance gate that fails the infrastructure plan if any route is neither gated nor an approved register entry, shipping its own proven-red regression test. And a third posture for the clients that really cannot log in interactively: an access service token, risk-tiered, so a mobile API client gets off-network reachability without the hostname becoming public — ADR-0249.

The public site you are reading was built inside that same control, and it exposed a real gap in it. The exposure rule was written around a hostname that resolves publicly and routes to a home origin. This site has no home origin — it is a static bundle on someone else’s edge — so it was invisible to the estate’s flagship exposure control by construction. That finding is being closed by widening the standard from hostname exposure to information exposure, and by adding the data classification the corpus did not previously have.

Credentials are least-privilege by default, and the default is audit

The pattern repeats across every integration: a dedicated identity per consumer, scoped to what that consumer actually does, and read-only unless writing is the job.

The hypervisor token is audit-only and cannot mutate anything (ADR-0362).
The backup server’s agent credential moved off an administrator account onto a dedicated audit-scoped token (ADR-0212).
The deploy credential for this very site is a token with exactly one permission group and nothing else — deliberately not the estate’s general-purpose token, which holds DNS, tunnel and access write and must never sit on a build agent.

Secret values never appear on a command line. Not in a container run, not as a script argument, not in a credential flag — because a value on argv lands in the process table, which is readable by any local process on a host several concurrent sessions share. Values are passed by environment or on standard input.

Supply chain: SBOMs for the fleet, and a gate that proves the import landed

Every host and every container image is scanned and its bill of materials imported into a dependency-tracking platform; dependency bumps are automated and triaged. That is table stakes. The part worth reading is the failure it had.

The import step originally read the project list once, immediately after uploading around sixty image SBOMs, and failed the run if too many had not appeared. But ingestion is asynchronous — the queue was still draining — so a single early read misread ingestion lag as systemic loss and failed the pipeline for two days while the platform was healthy throughout. The fix polls to a bounded deadline; only imports still absent after the window count as loss (ADR-0200).

The deeper version of that lesson — an upload token proves the platform accepted the document, never that it imported it — is why stacks could sit weeks stale while every run reported success. Acceptance is not completion, and the end state has to be read back from the system of record.

A declared control that is not enforced everywhere is not a control

Secret scanning is declared fleet-wide. The interesting question is not whether it runs, but whether it runs on every repository — and the honest answer, before the gate existed, was no. So a conformance gate now enumerates every build definition and fails when a repository lacks its scan, which makes the declaration and its enforcement land in the same place rather than drifting apart (ADR-0277).

That generalises into the standard enforcement standard: a written standard with no machine check is a suggestion, and the estate tracks which of its standards have teeth and which are still on trust. The vulnerability management standard is the same discipline applied to findings — triage, ownership, and a closing gate that re-scans rather than trusting a fix.

Compliance run properly, or declared and not claimed

Two prudential standards are launched here and assessed against the real estate; two more frameworks are declared but not launched, and their mappings are recorded for traceability while claiming no assurance at all. That distinction is enforced rather than stylistic: the compliance assurance standard defines what “launched” requires, and an unlaunched framework’s mappings cannot be reported as coverage.

It is a small thing that says most of what this estate is about. The temptation with a compliance mapping is to publish the table and let the reader infer assurance. Recording declared, not launched is less impressive and is the only honest thing to write.