From 02ff36bc3621f91064f7fd34e230818c2d47f070 Mon Sep 17 00:00:00 2001 From: Sam Rolfe Date: Wed, 14 Oct 2026 14:16:02 +1100 Subject: [PATCH] Decision: maps.lab stays public (Obsidian embeds); never publish secrets there --- AGENTS.md | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index 1ba598c..4217126 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -171,8 +171,25 @@ Resolved: 2. Scanning is accepted as normal — the goal is **control**, not zero noise. 3. Authelia over Authentik (lighter, fits Caddy forward-auth). +**`maps.lab` — PUBLIC BY DESIGN (decided 2026-10-14).** + +Obsidian embeds the Archify maps and Gitea content, so `maps.lab` must stay +reachable without auth. Accepted: it discloses internal hostnames, ports and +service names to anyone who asks. + +Rationale from Sam: *"the network info is not really that bad — if someone gets +in they have that anyway. No keys, passwords etc matter."* + +Rules that follow from this: +- **NEVER publish a secret, key, password, token or credential to `maps.lab`.** + It is world-readable. (Publishing a *public* SSH key is fine.) +- Directories named after secrets (for example `inmotionhosting_S3_email`) must + not contain sensitive material. +- Optional hardening, not required: turn off directory `browse` so the tree index + is not listable while direct links keep working. + Remaining: -1. Which hosts are **genuinely public**? (Needs Sam's list for the allowlist.) +1. Which other hosts are **genuinely public**? (Needs Sam's list for the allowlist.) 2. Should CrowdSec run in **ban** mode from the start, or observe first? 3. Where do the alerts go — Apprise to which channel? 4. Do we add `nuclei`/`semgrep` to Gitea CI, or run them by hand?