Security
flareover handles credentials for your DNS, certificates, storage, and edge. Its security posture is deliberately conservative.
Auth from the environment only, never on argv
Section titled “Auth from the environment only, never on argv”Every credential is read from an environment variable. flareover never accepts a secret as a command-line flag, because anything on the command line leaks via ps auxww, /proc/<pid>/cmdline, shell history, and CI job logs.
export PDNS_API_KEY=…export CERTMATE_TOKEN=…flareover provision --pdns-url http://pdns:8081 --certmate-url http://certmate:8000 …Passing --pdns-key or --certmate-token is refused with a pointer to the env var: the invariant is enforced, not just documented.
Environment variables by purpose
Section titled “Environment variables by purpose”| Purpose | Variable(s) |
|---|---|
Read the source zone (extract, zones) |
CLOUDFLARE_API_TOKEN (read-only) |
| PowerDNS | PDNS_API_KEY |
| CertMate | CERTMATE_TOKEN |
| Scaleway DNS / S3 | SCW_SECRET_KEY, SCW_DEFAULT_PROJECT_ID / SCW_ACCESS_KEY, SCW_SECRET_KEY |
| OVH DNS / S3 | OVH_APPLICATION_KEY, OVH_APPLICATION_SECRET, OVH_CONSUMER_KEY / OVH_S3_ACCESS_KEY, OVH_S3_SECRET_KEY |
| Gandi | GANDI_PAT |
| Leaseweb | LEASEWEB_API_KEY |
| Hetzner DNS | HETZNER_DNS_TOKEN |
| Route 53 | AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY |
| Cloud DNS | GOOGLE_APPLICATION_CREDENTIALS |
| Azure DNS | AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID, AZURE_RESOURCE_GROUP |
| Contabo / Aruba S3 | CONTABO_S3_* / ARUBA_S3_* |
| bunny.net | BUNNYNET_API_KEY |
Use a read-only source token: flareover never writes to the source.
Least privilege at the edges
Section titled “Least privilege at the edges”- The engine never touches your source provider or your registrar. The DS publish and the final NS move are explicit human steps.
- The origin stays inbound-free. The recommended shape puts a WireGuard mesh between the edge and the origin, so the origin has zero public inbound; the edge dials nothing the origin didn’t initiate.
- Egress shield (optional).
secure-proxy-managerenforces default-deny outbound with an allowlist, fail-closed, so a compromised edge can’t phone home to arbitrary hosts.
Supply chain
Section titled “Supply chain”- Zero external Go dependencies: standard library only. A small, auditable surface with no third-party module tree to vet.
- Signed releases. Every release ships an SBOM and a
checksums.txtsigned keyless via Sigstore/cosign. Verify before you run (see Installation). - AGPL-3.0-only. Network use counts as distribution, so any derivative service must offer its source under the same terms.
Handle generated artifacts as secrets
Section titled “Handle generated artifacts as secrets”Some generated outputs contain key material:
- The edge cloud-init (
out/edge/cloud-init.yaml) embeds the mesh WireGuard private key. - A
decisions.lockmay encode operational choices you’d rather not publish.
Keep out/ and decisions.lock out of public version control. The repository’s .gitignore already excludes them for in-repo runs, and Terraform state / *.tfvars are excluded too.
Certificates
Section titled “Certificates”CertMate issues real, publicly-trusted certificates via DNS-01 (wildcard-capable), from Let’s Encrypt or Actalis (an EU CA) with --ca actalis. Pre-cutover, solve DNS-01 against the source DNS (--certmate-dns <provider>), since the NS haven’t moved yet.